I have been having a conversation regarding user imports over here: https://www.drupal.org/node/2092895#comment-9828027
The issue is simple, during a user import UID 1 is unprotected. If you conduct a user import and have set the "delete non existing users" option for the importer, there is no way to protect the super admin account. This has the effect of destroying websites since the importer is simply doing what is is asked: if the user doesn't exist within the import CSV, blast it from the site. This is a great option (like the addition of blocking users instead of deleting them) but this feature lacks some basic protections for those using the user importer.
We can't assume that anyone conducting an import is fully knowledgeable about how CSV imported data works -- and should they be learning as they do this, having them kill their super admin in the process is kind of "mean".
| Comment | File | Size | Author |
|---|---|---|---|
| #15 | interdiff-2485059-11-15.txt | 2.58 KB | megachriz |
| #15 | feeds-protect-user-1-2485059-15.patch | 4.59 KB | megachriz |
| #11 | interdiff-2485059-9-11.txt | 735 bytes | megachriz |
| #11 | feeds-protect-user-1-2485059-11.patch | 4.68 KB | megachriz |
| #9 | interdiff-2485059-6-9.txt | 1.86 KB | megachriz |
Comments
Comment #1
shane birley commentedThis may have already been proposed or it may already been available but protecting UID 1 and a role of the importers choosing. I suspect this would be asked in the future.
Comment #2
shane birley commentedRolling a new patch for protection of UID 1 and users with certain roles.
Comment #3
shane birley commentedIt would help if one attached the file.
Comment #4
shane birley commentedThis adds a section called PROTECT under the user processor settings page. It allows importers to protect the UID1 account as well as users with a selected role.
Comment #5
megachrizCould you provide the changes in a patch? By providing a modified version of a file, it's harder to find out what you actually modified, especially when the same file changes later in dev. See "Creating patches" on https://www.drupal.org/patch.
Comment #6
megachrizHere is a patch that adds protection for user 1. It prevents user 1 from being deleted via either the "Delete items" form or via the "delete non-existent" feature. Also attached a patch with tests only, to demonstrate that the tests are failing without the fix.
The feature for protecting certain roles is not included.
Comment #9
megachrizI think that when trying to delete user 1, while user 1 does not get deleted, the associated feeds item should get deleted. Else there would be no way to get rid of that redundant feeds item. New patch.
Comment #11
megachrizThe feeds item doesn't have to be deleted when deleting non-existing users, I think. Only when really clearing a feed.
Comment #13
megachrizAll tests are passing, not sure why the testbot moved the status to "Needs work". Back to "Needs review".
Comment #14
twistor commentedI don't think this needs to be conditional.
Other than that, looks good!
Comment #15
megachriz@twistor
Thanks for reviewing. I see that a variable doesn't have to exist to unset it.
I fixed this and made a few tiny corrections in the tests (mainly text corrections). If this is passes, I'll commit it.
Comment #17
megachrizCommitted #15.