Error on changing own password [#43668]

If a user doesn't have the right to "change own username" he's also not allowed to change his password:

You are not allowed to change this username.

This issue seems to be only in the newest cvs snapshot, not in 4.7.0-beta2 nor in an older snapshot.

If the user is allowed to "change own username" an error appears though the changes are saved.

warning: array_filter() [function.array-filter]: The first argument should be an array in /usr/local/apache2/htdocs/portal/modules/user.module on line 1247.

I'm using PHP 5.1.1.

Comment	File	Size	Author
#8	user_submit_0.patch	382 bytes	chx
#8
#4	user_name.patch	514 bytes	chx
#4

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

Cvbge CreditAttribution: Cvbge commented 8 January 2006 at 16:06

Priority:

Normal

» Critical

Confirmed, not a PHP 5.x issue.
Critical because users are left with auto-generated passwords which are ugly.

Comment #2

jakeg CreditAttribution: jakeg commented 8 January 2006 at 16:06

cvbge and myself confirmd this bug. setting priority to critical.

Comment #3

Cvbge CreditAttribution: Cvbge commented 8 January 2006 at 18:35

Introduced by 'change own username' patch:
user_edit_form() does not add 'name' field if user does not have permission.
Then in user_edit_validate() if user does not have permission we check elseif $edit['name'] != $user->name while the left part is not set.

I think the correct solution would be to drop the elseif completly - if user does not have the permission, the field won't be set.

Comment #4

chx CreditAttribution: chx commented 8 January 2006 at 22:31

File	Size
user_name.patch	514 bytes

Aye and if the name is not set, then $form_values['name'] won't be set either. Wonders of form API. Indeed that elseif is not needed.

Comment #5

chx CreditAttribution: chx commented 9 January 2006 at 14:11

Status:

Active

» Reviewed & tested by the community

Comment #6

Dries CreditAttribution: Dries commented 9 January 2006 at 14:14

Status:

Reviewed & tested by the community

» Fixed

Committed to HEAD. Thanks.

Comment #7

darius CreditAttribution: darius commented 9 January 2006 at 15:39

One more thing to change in there:
warning: array_filter(): The first argument should be an array in /home/tinklas/public_html/cs/modules/user.module on line 1244.

The error occurs in function _user_edit_submit($uid, &$edit), line: $edit['roles'] = array_filter($edit['roles']);. If the user is not an admin, $edit['roles']) is NULL.

Darius

Comment #8

chx CreditAttribution: chx commented 9 January 2006 at 15:48

File	Size
user_submit_0.patch	382 bytes

Comment #9

chx CreditAttribution: chx commented 9 January 2006 at 15:49

Status:

Fixed

» Reviewed & tested by the community

Comment #10

Dries CreditAttribution: Dries commented 9 January 2006 at 18:21

Status:

Reviewed & tested by the community

» Fixed

Committed to HEAD.

Comment #11

Dries CreditAttribution: Dries commented 24 January 2006 at 06:19

Status:

Fixed

» Closed (fixed)

Comment #12

matias CreditAttribution: matias commented 26 January 2006 at 01:16

Version:	x.y.z	» 4.6.5
Status:	Closed (fixed)	» Active

I think this isn't fixed yet
I can duplicate this error in a fresh CVS install.
On line 1210 of user.module

  elseif ($edit['name'] != $user->name) {
    form_set_error('name', t('You are not allowed to change this username.'));

If the user is not allowed to "change own username" $edit['name'] is not defined the "You are not allowed to change this username." error appears and the changes are not saved.