From 0f784e7f7a0b9f5c0674c90966b9d5528cc16e2b Mon Sep 17 00:00:00 2001
From: Stalin <161853795+0x5t4l1n@users.noreply.github.com>
Date: Mon, 3 Aug 2026 00:53:38 +0530
Subject: [PATCH] fix: normalise email to lowercase and reject duplicate
 addresses

Resolves #500. Account creation was case-sensitive: User@Berkeley.EDU
and user@berkeley.edu would both pass validation and create two separate
accounts. Fix by lowercasing the email in clean_email() before the
domain check, and raising ValidationError when an account with that
address (case-insensitive) already exists.
---
 hknweb/forms.py | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/hknweb/forms.py b/hknweb/forms.py
index 70e4c514..bf5aeb95 100644
--- a/hknweb/forms.py
+++ b/hknweb/forms.py
@@ -59,14 +59,23 @@ class SignupForm(UserCreationForm):
 
     def clean_email(self):
         email = self.cleaned_data.get("email")
+        # Normalise to lowercase so User@Berkeley.EDU and user@berkeley.edu
+        # are treated as the same address throughout the system.
+        if email:
+            email = email.lower()
         if (email is None) or not email.endswith(
             "berkeley.edu"
         ):  # lgtm [py/incomplete-url-substring-sanitization]
             raise forms.ValidationError(
-                "Please a berkeley.edu email to register!", code="invalid"
+                "Please use a berkeley.edu email to register!", code="invalid"
             )
-        else:
-            return email
+        # Reject duplicate addresses (case-insensitive) to prevent phantom accounts.
+        if User.objects.filter(email__iexact=email).exists():
+            raise forms.ValidationError(
+                "An account with this email address already exists.",
+                code="duplicate",
+            )
+        return email
 
     class Meta:
         model = User