diff --git a/core/modules/user/src/AccountForm.php b/core/modules/user/src/AccountForm.php index d695968..cba4492 100644 --- a/core/modules/user/src/AccountForm.php +++ b/core/modules/user/src/AccountForm.php @@ -69,7 +69,7 @@ public function form(array $form, FormStateInterface $form_state) { $language_interface = \Drupal::languageManager()->getCurrentLanguage(); $register = $account->isAnonymous(); - $admin = $user->hasPermission('administer users'); + $admin = $user->hasPermission('administer users') || ($user->id() != $account->id()); // Account information. $form['account'] = [ diff --git a/core/modules/user/src/Form/UserCancelForm.php b/core/modules/user/src/Form/UserCancelForm.php index da7a5f4..615a0d3 100644 --- a/core/modules/user/src/Form/UserCancelForm.php +++ b/core/modules/user/src/Form/UserCancelForm.php @@ -49,7 +49,8 @@ public function getCancelUrl() { public function getDescription() { $description = ''; $default_method = $this->config('user.settings')->get('cancel_method'); - if ($this->currentUser()->hasPermission('administer users') || $this->currentUser()->hasPermission('select account cancellation method')) { + $admin = $this->currentUser()->hasPermission('administer users') || ($this->entity->id() != $this->currentUser()->id()); + if ($admin || $this->currentUser()->hasPermission('select account cancellation method')) { $description = $this->t('Select the method to cancel the account above.'); } // Options supplied via user_cancel_methods() can have a custom @@ -75,7 +76,7 @@ public function buildForm(array $form, FormStateInterface $form_state) { $this->cancelMethods = user_cancel_methods(); // Display account cancellation method selection, if allowed. - $admin_access = $user->hasPermission('administer users'); + $admin_access = $user->hasPermission('administer users') || ($this->entity->id() != $user->id()); $form['user_cancel_method'] = [ '#type' => 'radios', '#title' => ($this->entity->id() == $user->id() ? $this->t('When cancelling your account') : $this->t('When cancelling the account')), @@ -111,7 +112,7 @@ public function buildForm(array $form, FormStateInterface $form_state) { // if desired. $form['access'] = [ '#type' => 'value', - '#value' => $user->hasPermission('administer users'), + '#value' => $admin_access, ]; $form = parent::buildForm($form, $form_state); diff --git a/core/modules/user/src/Plugin/Validation/Constraint/UserMailRequired.php b/core/modules/user/src/Plugin/Validation/Constraint/UserMailRequired.php index b500a8d..ee7f970 100644 --- a/core/modules/user/src/Plugin/Validation/Constraint/UserMailRequired.php +++ b/core/modules/user/src/Plugin/Validation/Constraint/UserMailRequired.php @@ -8,7 +8,7 @@ * Checks if the user's email address is provided if required. * * The user mail field is NOT required if account originally had no mail set - * and the user performing the edit has 'administer users' permission. + * and the user performing the edit is an administrator. * This allows users without email address to be edited and deleted. * * @Constraint( diff --git a/core/modules/user/src/Plugin/Validation/Constraint/UserMailRequiredValidator.php b/core/modules/user/src/Plugin/Validation/Constraint/UserMailRequiredValidator.php index 7e20b7a..f83830b 100644 --- a/core/modules/user/src/Plugin/Validation/Constraint/UserMailRequiredValidator.php +++ b/core/modules/user/src/Plugin/Validation/Constraint/UserMailRequiredValidator.php @@ -9,7 +9,7 @@ * Checks if the user's email address is provided if required. * * The user mail field is NOT required if account originally had no mail set - * and the user performing the edit has 'administer users' permission. + * and the user performing the edit is an administrator. * This allows users without email address to be edited and deleted. */ class UserMailRequiredValidator extends ConstraintValidator { @@ -29,7 +29,8 @@ public function validate($items, Constraint $constraint) { $existing_value = $account_unchanged->getEmail(); } - $required = !(!$existing_value && \Drupal::currentUser()->hasPermission('administer users')); + $admin = \Drupal::currentUser()->hasPermission('administer users') || ($account->id() != \Drupal::currentUser()->id()); + $required = !(!$existing_value && $admin); if ($required && (!isset($items) || $items->isEmpty())) { $this->context->addViolation($constraint->message, ['@name' => $account->getFieldDefinition('mail')->getLabel()]); diff --git a/core/modules/user/src/RegisterForm.php b/core/modules/user/src/RegisterForm.php index 4974e69..33bf2d9 100644 --- a/core/modules/user/src/RegisterForm.php +++ b/core/modules/user/src/RegisterForm.php @@ -18,7 +18,7 @@ public function form(array $form, FormStateInterface $form_state) { $user = $this->currentUser(); /** @var \Drupal\user\UserInterface $account */ $account = $this->entity; - $admin = $user->hasPermission('administer users'); + $admin = !$user->isAnonymous(); // Pass access information to the submit handler. Running an access check // inside the submit function interferes with form processing and breaks // hook_form_alter().