diff -u b/core/lib/Drupal/Core/Render/Element/PasswordConfirm.php b/core/lib/Drupal/Core/Render/Element/PasswordConfirm.php --- b/core/lib/Drupal/Core/Render/Element/PasswordConfirm.php +++ b/core/lib/Drupal/Core/Render/Element/PasswordConfirm.php @@ -14,12 +14,13 @@ * @code * $form['pass'] = array( * '#type' => 'password_confirm', + * '#title1' => t('New password'), * '#title' => $this->t('Password'), * '#size' => 25, * ); * $form['pass'] = array( * '#type' => 'password_confirm', - * '#title1' => t('New password'), + * '#title' => t('Password'), * '#size' => 25, * ); * @endcode @@ -84,6 +85,9 @@ 'visible' => array( ':input[name="pass[pass1]"]' => ['filled' => TRUE], ), + 'required' => array( + ':input[name="pass[pass1]"]' => ['filled' => TRUE], + ), ), ); $element['#element_validate'] = array(array(get_called_class(), 'validatePasswordConfirm')); diff -u b/core/modules/user/src/AccountForm.php b/core/modules/user/src/AccountForm.php --- b/core/modules/user/src/AccountForm.php +++ b/core/modules/user/src/AccountForm.php @@ -81,18 +81,6 @@ '#weight' => -10, ); - // The mail field is NOT required if account originally had no mail set - // and the user performing the edit has 'administer users' permission. - // This allows users without email address to be edited and deleted. - // Also see \Drupal\user\Plugin\Validation\Constraint\UserMailRequired. - $form['account']['mail'] = array( - '#type' => 'email', - '#title' => $this->t('Email address'), - '#description' => $this->t('A valid email address. All emails from the system will be sent to this address. The email address is not made public and will only be used if you wish to receive a new password or wish to receive certain news or notifications by email.'), - '#required' => !(!$account->getEmail() && $user->hasPermission('administer users')), - '#default_value' => (!$register ? $account->getEmail() : ''), - ); - // Only show name field on registration form or user can change own username. $form['account']['name'] = array( '#type' => 'textfield', @@ -108,6 +96,20 @@ ), '#default_value' => (!$register ? $account->getUsername() : ''), '#access' => ($register || ($user->id() == $account->id() && $user->hasPermission('change own username')) || $admin), + '#weight' => -10, + ); + + // The mail field is NOT required if account originally had no mail set + // and the user performing the edit has 'administer users' permission. + // This allows users without email address to be edited and deleted. + // Also see \Drupal\user\Plugin\Validation\Constraint\UserMailRequired. + $form['account']['mail'] = array( + '#type' => 'email', + '#title' => $this->t('Email address'), + '#description' => $this->t('A valid email address. All emails from the system will be sent to this address. The email address is not made public and will only be used if you wish to receive a new password or wish to receive certain news or notifications by email. In case you want to change this email address you also need to confirm your current password.'), + '#required' => !(!$account->getEmail() && $user->hasPermission('administer users')), + '#default_value' => (!$register ? $account->getEmail() : ''), + '#weight' => -9, ); // Display password field only for existing users or when user is allowed to @@ -119,7 +121,8 @@ '#title1' => $this->t('New password'), '#title2' => $this->t('Confirm new password'), '#size' => 25, - '#description' => $this->t('To change the current user password, enter the new password.'), + '#description' => $this->t('To change the current user password, enter the new password here. To be allowed to do this you also need to confirm your current password.'), + '#weight' => -7, ); // To skip the current password field, the user must have logged in via a @@ -138,7 +141,7 @@ '#title' => $this->t('Current password'), '#size' => 25, '#access' => !$form_state->get('user_pass_reset'), - '#weight' => -5, + '#weight' => -8, // Do not let web browsers remember this password, since we are // trying to confirm that the person submitting the form actually // knows the current one. @@ -149,7 +152,7 @@ // The user may only change their own password without their current // password if they logged in via a one-time login link. if (!$form_state->get('user_pass_reset')) { - $form['account']['current_pass']['#description'] = $this->t('Confirm your current password to change the %mail or %pass above. Reset your password.', array( + $form['account']['current_pass']['#description'] = $this->t('Confirm your current password to change the %mail or to set a %pass. Reset your password.', array( '%mail' => $form['account']['mail']['#title'], '%pass' => $this->t('New password'), ':request_new_url' => $this->url('user.pass'), @@ -160,6 +163,11 @@ [':input[name="mail"]' => ['!value' => $account->getEmail()]], [':input[name="pass[pass1]"]' => ['filled' => TRUE]], ], + // Mark the field as required if mail or password has changed. + 'required' => [ + [':input[name="mail"]' => ['!value' => $account->getEmail()]], + [':input[name="pass[pass1]"]' => ['filled' => TRUE]], + ], ]; } }