{"record":{"id":"144ab5eb5824f014","repo":"getgrav/grav","slug":"user-account-with-this-username-already-exists","errorCode":null,"errorMessage":"User account with this username already exists","messagePattern":"User account with this username already exists","errorType":"validation","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"system/src/Grav/Common/Flex/Types/Users/UserObject.php","lineNumber":615,"sourceCode":"    public function save()\n    {\n        // TODO: We may want to handle this in the storage layer in the future.\n        $key = $this->getStorageKey();\n        // `@@` is Flex's marker for an in-memory (not-yet-persisted) storage key.\n        // `str_contains` is the correct predicate here — `strpos` returns 0 when\n        // the marker is at position 0 (e.g. `@@hash`), which is falsy and would\n        // have skipped the uniqueness check below.\n        $isNewUser = $key === '' || str_contains($key, '@@');\n\n        if ($isNewUser) {\n            $newKey = $this->getKey();\n\n            // Prevent overwriting an existing account when a low-privileged user\n            // creates a new user with an already-taken username (GHSA-rr73-568v-28f8).\n            // Applies to every storage implementation, not just FileStorage.\n            $storage = $this->getFlexDirectory()->getStorage();\n            if ($storage->hasKey($newKey)) {\n                throw new RuntimeException('User account with this username already exists');\n            }\n\n            $this->setStorageKey($newKey);\n        }\n\n        $password = $this->getProperty('password') ?? $this->getProperty('password1');\n        if (null !== $password && '' !== $password) {\n            $password2 = $this->getProperty('password2');\n            if (!\\is_string($password) || ($password2 && $password !== $password2)) {\n                throw new \\RuntimeException('Passwords did not match.');\n            }\n\n            $this->setProperty('hashed_password', Authentication::create($password));\n        }\n        $this->unsetProperty('password');\n        $this->unsetProperty('password1');\n        $this->unsetProperty('password2');\n","sourceCodeStart":597,"sourceCodeEnd":633,"githubUrl":"https://github.com/getgrav/grav/blob/6040efed04efa69b8209448ed81308e7c24147c2/system/src/Grav/Common/Flex/Types/Users/UserObject.php#L597-L633","documentation":"Error \"User account with this username already exists\" thrown in getgrav/grav.","triggerScenarios":"Thrown at system/src/Grav/Common/Flex/Types/Users/UserObject.php:615 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6040efed04efa69b8209448ed81308e7c24147c2","analyzedAt":"2026-08-17T05:07:31.593Z","schemaVersion":2},"datasetVersion":"2026-08-17T09:17:11.063Z"}