FEATURE: don't allow username and email to be the same

app/assets/javascripts/discourse/controllers/create-account.js.es6

@@ -317,12 +317,19 @@ export default DiscourseController.extend(ModalFunctionality, {
       });
     }
 
+    if (!this.blank('accountEmail') && this.get('accountPassword') === this.get('accountEmail')) {
+      return Discourse.InputValidation.create({
+        failed: true,
+        reason: I18n.t('user.password.same_as_email')
+      });
+    }
+
     // Looks good!
     return Discourse.InputValidation.create({
       ok: true,
       reason: I18n.t('user.password.ok')
     });
-  }.property('accountPassword', 'rejectedPasswords.@each'),
+  }.property('accountPassword', 'rejectedPasswords.@each', 'accountUsername', 'accountEmail'),
 
   fetchConfirmationValue: function() {
     var createAccountController = this;

config/locales/client.en.yml

@@ -515,6 +515,7 @@ en:
         too_short: "Your password is too short."
         common: "That password is too common."
         same_as_username: "Your password is the same as your username."
+        same_as_email: "Your password is the same as your email."
         ok: "Your password looks good."
         instructions: "At least %{count} characters."
 

config/locales/server.en.yml

@@ -293,6 +293,7 @@ en:
             password:
               common: "is one of the 10000 most common passwords. Please use a more secure password."
               same_as_username: "is the same as your username. Please use a more secure password."
+              same_as_email: "is the same as your email. Please use a more secure password."
             ip_address:
               signup_not_allowed: "Signup is not allowed from this account."
         color_scheme_color:

lib/validators/password_validator.rb

@@ -10,6 +10,8 @@ class PasswordValidator < ActiveModel::EachValidator
       record.errors.add(attribute, :too_short, count: SiteSetting.min_password_length)
     elsif record.username.present? && value == record.username
       record.errors.add(attribute, :same_as_username)
+    elsif record.username.present? && value == record.email
+      record.errors.add(attribute, :same_as_email)
     elsif SiteSetting.block_common_passwords && CommonPasswords.common_password?(value)
       record.errors.add(attribute, :common)
     end

spec/components/validators/password_validator_spec.rb

@@ -79,6 +79,13 @@ describe PasswordValidator do
       validate
       expect(record.errors[:password]).to be_present
     end
+
+    it "adds an error when password is the same as the email" do
+      @password = "pork@chops.com"
+      record.email = @password
+      validate
+      expect(record.errors[:password]).to be_present
+    end
   end
 
   context "password not required" do

test/javascripts/controllers/create-account-test.js.es6

@@ -28,6 +28,7 @@ test('passwordValidation', function() {
 
   var controller = subject();
   controller.set('passwordRequired', true);
+  controller.set('accountEmail',      'pork@chops.com');
   controller.set('accountUsername',   'porkchops');
   controller.set('prefilledUsername', 'porkchops');
 
@@ -45,4 +46,5 @@ test('passwordValidation', function() {
   testInvalidPassword('', undefined);
   testInvalidPassword('x', I18n.t('user.password.too_short'));
   testInvalidPassword('porkchops', I18n.t('user.password.same_as_username'));
+  testInvalidPassword('pork@chops.com', I18n.t('user.password.same_as_email'));
 });