Page is now populated with the email address previously submitted but rejected

This is almost certainly a browser autocomplete issue.

To verify that please try and create the first user in browser a and the second user in browser b.

Now tested with Firefox, Chrome and Safari
This is NOT an autocomplete error.

Further test,
Login as 1 of the users
Go to edit profile page
Change email address to address of other user but DO NOT change the confirm email address (now both email addresses are different)
Click Submit
You get an error message as expected
Now go to homepage
Then return to Edit Profile Page
The 2 email addresses are different

The issue is that the 'bad data' is being held in the session, from a userbility perspective it should be cleared after the submit because it is bad data. By holding it in the session cache, when you return to the page it gives the impression the profile has been updated.

Sorry for jumping to a conclusion - i can confirm this issue

If form is submited and saving fails

• then data are added to session to be able to continue editing and correct the error without re-typing

Normally we need some way to decide how to clear the data from session

• so this is done when user clicks the edit link again
• or when user click cancel

The profile controller is overriding the "edit" task

• but unlike the code in default edit task it lacks clearing the session data
• also session data are not cleared when you click cancel

// This line is missing from edit task of profile coontroller
\JFactory::getApplication()->setUserState('com_users.edit.profile.data', null);

// Redirect to the edit screen.
$this->setRedirect(JRoute::_('index.php?option=com_users&view=profile&layout=edit', false));

so if the edit task is patced to have the missing statement this will be fixed

• that is when you use this edit that goes through edit task

index.php?option=com_users&task=profile.edit&user_id=770

but if you use link from menu "edit user profile":
index.php?option=com_users&view=profile&layout=edit&Itemid=NNN

then you will not go through edit task and you will have same problem

• not security issue here , the view itself check if user is logged before access user's profile
  but the bad is that without going though edit task, we cannot easily detect if session data needs to be cleared

Set to "closed" on behalf of @franz-wohlkoenig by The JTracker Application at issues.joomla.org/joomla-cms/17875

closed as having Pull Request #24088