If a user goes to /user, Drupal will redirect the user to their user profile, /user/[uid]. Drupal does not need to check if the user has permission to "access user profiles" because the user always has permission to view their own profile.
And, yet, template_preprocess_username() (D8) and theme_username() (D7) currently check for the "access user profiles" permission before adding a link to a user's own profile page. That's wrong.
Check if the currently logged in user is the same as the user account that the theme hook is linking to.
Previously, all themed usernames would have no links if the "access user profiles" permission was turned off for their user roles. After this patch, the current user's themed username would have a link to the profile page, while all other usernames would continue to have no links.
None.
| Comment | File | Size | Author |
|---|---|---|---|
| #8 | 2536750-8-username-perm.patch | 2.12 KB | johnalbin |
| #4 | 2536750-username-perm-D7-do-not-test.patch | 1.26 KB | johnalbin |
Comments
Comment #1
johnalbinHere's the patch for D8 and D7.
Comment #2
johnalbinTest please!
Comment #4
johnalbinRenaming D7 patch.
Comment #6
johnalbinFixed simpletest.
Comment #8
johnalbinBah. uploaded wrong patch file. Here's the correct one.
Comment #10
vermauv commentedI had applied the above patch to 8.1.x and the patch applies fine. I think the changes suggested by JohnAlbin are correct and checking if a user has permission to view her/his is redundant.
This is for the first time I am testing a patch hence not moving to RTBC, would seek feedback from some more folks as well.
Comment #12
dpi