diff --git a/core/modules/user/src/AccountForm.php b/core/modules/user/src/AccountForm.php index 5f4d820..260555d 100644 --- a/core/modules/user/src/AccountForm.php +++ b/core/modules/user/src/AccountForm.php @@ -69,7 +69,7 @@ public function form(array $form, FormStateInterface $form_state) { $language_interface = \Drupal::languageManager()->getCurrentLanguage(); $register = $account->isAnonymous(); - $admin = $user->hasPermission('administer users'); + $admin = $user->hasPermission('administer users') || ($user->id() != $account->id()); // Account information. $form['account'] = array( @@ -85,7 +85,7 @@ public function form(array $form, FormStateInterface $form_state) { '#type' => 'email', '#title' => $this->t('Email address'), '#description' => $this->t('A valid email address. All emails from the system will be sent to this address. The email address is not made public and will only be used if you wish to receive a new password or wish to receive certain news or notifications by email.'), - '#required' => !(!$account->getEmail() && $user->hasPermission('administer users')), + '#required' => !(!$account->getEmail() && $admin), '#default_value' => (!$register ? $account->getEmail() : ''), ); @@ -222,7 +222,7 @@ public function form(array $form, FormStateInterface $form_state) { '#open' => TRUE, // Display language selector when either creating a user on the admin // interface or editing a user account. - '#access' => !$register || $user->hasPermission('administer users'), + '#access' => !$register || $admin, ); $form['language']['preferred_langcode'] = array( diff --git a/core/modules/user/src/Form/UserCancelForm.php b/core/modules/user/src/Form/UserCancelForm.php index 0ab8933..8f81bf6 100644 --- a/core/modules/user/src/Form/UserCancelForm.php +++ b/core/modules/user/src/Form/UserCancelForm.php @@ -47,7 +47,8 @@ public function getCancelUrl() { public function getDescription() { $description = ''; $default_method = $this->config('user.settings')->get('cancel_method'); - if ($this->currentUser()->hasPermission('administer users') || $this->currentUser()->hasPermission('select account cancellation method')) { + $admin = $this->currentUser()->hasPermission('administer users') || ($user->id() != $account->id()); + if ($admin || $this->currentUser()->hasPermission('select account cancellation method')) { $description = $this->t('Select the method to cancel the account above.'); } // Options supplied via user_cancel_methods() can have a custom @@ -73,7 +74,7 @@ public function buildForm(array $form, FormStateInterface $form_state) { $this->cancelMethods = user_cancel_methods(); // Display account cancellation method selection, if allowed. - $admin_access = $user->hasPermission('administer users'); + $admin_access = $user->hasPermission('administer users') || ($user->id() != $account->id()); $form['user_cancel_method'] = array( '#type' => 'radios', '#title' => ($this->entity->id() == $user->id() ? $this->t('When cancelling your account') : $this->t('When cancelling the account')), @@ -109,7 +110,7 @@ public function buildForm(array $form, FormStateInterface $form_state) { // if desired. $form['access'] = array( '#type' => 'value', - '#value' => $user->hasPermission('administer users'), + '#value' => $admin_access, ); $form = parent::buildForm($form, $form_state); diff --git a/core/modules/user/src/RegisterForm.php b/core/modules/user/src/RegisterForm.php index 9bc047b..64ea871 100644 --- a/core/modules/user/src/RegisterForm.php +++ b/core/modules/user/src/RegisterForm.php @@ -16,7 +16,7 @@ public function form(array $form, FormStateInterface $form_state) { $user = $this->currentUser(); /** @var \Drupal\user\UserInterface $account */ $account = $this->entity; - $admin = $user->hasPermission('administer users'); + $admin = !$user->isAnonymous(); // Pass access information to the submit handler. Running an access check // inside the submit function interferes with form processing and breaks // hook_form_alter(). diff --git a/core/modules/user/user.module b/core/modules/user/user.module index 638ed64..26f7eb7 100644 --- a/core/modules/user/user.module +++ b/core/modules/user/user.module @@ -806,6 +806,7 @@ function _user_cancel_session_regenerate() { function user_cancel_methods() { $user_settings = \Drupal::config('user.settings'); $anonymous_name = $user_settings->get('anonymous'); + $admin = \Drupal::currentUser()->hasPermission('administer users') || ($user->id() != $account->id()); $methods = array( 'user_cancel_block' => array( 'title' => t('Disable the account and keep its content.'), @@ -822,7 +823,7 @@ function user_cancel_methods() { 'user_cancel_delete' => array( 'title' => t('Delete the account and its content.'), 'description' => t('Your account will be removed and all account information deleted. All of your content will also be deleted.'), - 'access' => \Drupal::currentUser()->hasPermission('administer users'), + 'access' => $admin, ), ); // Allow modules to customize account cancellation methods.