[security] Account registration does not check for existing accounts

[RalfJung]

When creating a new account, if I pick an already existing account name, the system accepts this just fine. Dudel then seems to mix up both accounts, e.g. the original account's email address shows up in the profile.

This is on the hotfix branch. I know Dudel is being re-written, but I hope this is critical enough to warrant a fix. For now, I will try to disable account creation.

[RalfJung]

This is even more trouble some considering that "being an admin" is decided by

    def is_admin(self):
        return "ADMINS" in app.config and self.username in app.config["ADMINS"]

[opatut]

Ouch 😉

This is on the hotfix branch

What do you mean with that? Do you have a hotfix, if so, please submit a PR :)

[RalfJung]

I meant: There is a branch called hotfix in your repo. This is the branch I am using.

[Akasch]

The Problem is the form.populate_obj(user) in views.py line 122, as the documentation stats it is a destructive operation the Group creation have the same Problem.