fix: make email readonly in personal data form to prevent user lockout

src/Controller/Account/PersonalDataController.php

@@ -84,11 +84,20 @@ class PersonalDataController extends AbstractController
         $newsletterSubscribed = $this->newsletterManager->hasConfirmedOptIn($email);
         $newsletterPendingConfirmation = $this->newsletterManager->hasPendingConfirmation($email);
 
+        // The e-mail is deliberately locked here: BPN stores it on the address, where it doubles as
+        // the login identity of any person on that address. Accepting a submitted value would let
+        // one household member overwrite another's login. It is only ever echoed back to BPN as read.
         $personalDataForm = $this->createForm(PersonalDataType::class, $personalData, [
             'attr' => ['novalidate' => 'novalidate'],
             'validation_groups' => ['personal_data'],
+            'email_editable' => false,
         ]);
-        $personalDataForm->handleRequest($request);
+
+        // A failed load yields an empty PersonalData. Updating from it would send blank values for
+        // fields we never read - including the e-mail - so the form must not accept a submission.
+        if (null !== $personalData->addressId) {
+            $personalDataForm->handleRequest($request);
+        }
 
         if ($personalDataForm->isSubmitted() && $personalDataForm->isValid()) {
             try {