Problem/Motivation

  • Realname module alters the display name, but at user/1234 the username is shown. This is incorrect.
  • Tons of places in core that show the username, but need to show the users display name.
  • Comments do not show DisplayName for registered users.
  • Security problem as usernames should never shown on websites. With real names you cannot login and try passwords, with a username you can.

In Drupal 8.0.0 we deprecated \Drupal\Core\Session\AccountInterface::getUsername(). This is because it was being used for both the display name and getting the username.

The deprecation message is:

   *   Use \Drupal\Core\Session\AccountInterface::getAccountName() or
   *   \Drupal\user\UserInterface::getDisplayName() instead.

The docs for getAccountName() describe the difference:

  /**
   * Returns the unaltered login name of this account.
   *
   * @return string
   *   An unsanitized plain-text string with the name of this account that is
   *   used to log in. Only display this name to admins and to the user who owns
   *   this account, and only in the context of the name used to login. For
   *   any other display purposes, use
   *   \Drupal\Core\Session\AccountInterface::getDisplayName() instead.
   */
  public function getAccountName();

We need to carefully go through the usages and change to getAccountName() or getDisplayName() as required. This is not that simple. For example, another issue was created to covert the following code in UserController to getDisplayName().

          $this->messenger()
            ->addWarning($this->t('Another user (%other_user) is already logged into the site on this computer, but you tried to use a one-time link for user %resetting_user. Please <a href=":logout">log out</a> and try using the link again.',
              [
                '%other_user' => $account->getUsername(),
                '%resetting_user' => $reset_link_user->getUsername(),
                ':logout' => $this->url('user.logout'),
              ]));

However as this is dealing with the logged in user and a password reset link that works using the account name maybe these should be changed to getAccountName().

Proposed resolution

Blocked by #2787871: Properly deprecate getUserName() and use getAccountName() instead

  • Fix all places where getAccountName() is used, but getDisplayName() should be used.
  • Change core to enable a DisplayName by default. That is why tons of tests are failing because of wrong usage.
  • Where changing to getDisplayName() add test coverage\
  • Ensure getDisplayName() and getAccountName() have good documentation so contrib and custom pick the correct function.

Followup tasks

Allow for configurable truncation length of display name: #2767787: Allow custom truncate username settings

User interface changes

Users display name will be properly shown where appropriate.

API changes

API addition: Entity::getDisplayNameTruncated to get the correct abreviation used in theme_preprocess_username() function.

Data model changes

none

CommentFileSizeAuthor
#229 2629286-229.patch2.08 KB_utsavsharma
#216 2629286-216-fixes-only.patch2.07 KBBerdir
#216 2629286-216-interdiff.txt489 bytesBerdir
#216 2629286-216.patch62.91 KBBerdir
#213 2629286-213.patch63.15 KBBerdir
#212 2629286-212-d878.diff63.41 KBTommyChris
#206 2629286-206.patch60.42 KBtormi
#202 2629286-199-d865.diff70.42 KBTommyChris
#201 2629286-199-d864.diff70.33 KBTommyChris
#197 2629286-197-d863.diff70.55 KBTommyChris
#196 2629286-196-d862.diff72.65 KBTommyChris
#190 2629286-190.patch61.75 KBalexpott
#190 188-190-interdiff.txt9.79 KBalexpott
#188 2629286-188.patch52.96 KBalexpott
#188 177-188-interdiff.txt35.64 KBalexpott
#177 2629286-177.patch60.31 KBalexpott
#177 176-177-interdiff.txt6.16 KBalexpott
#176 2629286-175.patch66.48 KBalexpott
#176 172-175-interdiff.txt8.71 KBalexpott
#172 2629286-172.patch66.65 KBalexpott
#172 171-172-interdiff.txt1.21 KBalexpott
#171 2629286-171.patch66.66 KBalexpott
#168 2629286-168-d861.diff72.61 KBTommyChris
#157 2629286-157-d855.patch78.25 KBiamdroid
#156 2629286-156-d854.diff78.16 KBTommyChris
#150 2629286-146-150-interdiff.txt3.62 KBgnuget
#150 2629286-150.patch81.88 KBgnuget
#149 without_the_truncated_class.png9.69 KBgnuget
#149 with_the_truncated_class.png11.6 KBgnuget
#146 2629286-146.patch81.04 KBgnuget
#140 Screen Shot 2017-11-23 at 20.06.10.png9.4 KBmarkconroy
#126 2629286-126.patch80.22 KBjofitz
#120 use_getdisplayname-2629286-120.patch72.13 KBharings_rob
#118 use_getDisplayName_consistently-2629286-118.patch71.99 KBsheise
#113 Issue-2629286-by-hass-Use-getDisplayName-for-user-na.patch77.25 KBhass
#112 Issue-2629286-by-hass-Use-getDisplayName-for-user-na.patch77.24 KBhass
#110 Issue-2629286-by-hass-Use-getDisplayName-for-user-na.patch75.47 KBhass
#107 Issue-2629286-by-hass-Use-getDisplayName-for-user-na.patch75.21 KBhass
#103 2629286-103.patch132.09 KBgaurav.kapoor
#101 2629286-101.patch132.15 KBgaurav.kapoor
#97 2629286_97.patch79.16 KBmohit_aghera
#95 interdiff-2629286-91-94.txt450 bytesmohit_aghera
#95 2629286_94.patch78.76 KBmohit_aghera
#93 interdiff-2629286-90-92.txt450 bytesmohit_aghera
#93 2629286_92.patch78.76 KBmohit_aghera
#91 interdiff-2629286-89-91.txt2.89 KBmohit_aghera
#91 2629286_91.patch78.55 KBmohit_aghera
#89 interdiff-2629286-87-89.txt586 bytesmohit_aghera
#89 2629286_89.patch77.98 KBmohit_aghera
#87 2629286_87.patch78.47 KBmohit_aghera
#78 2629286_78.patch76.35 KBMile23
#67 fix_the_displayname_mess-2629286-67.patch76.28 KBgnuget
#67 2629286-interdiff-65-67.txt3.06 KBgnuget
#64 Issue-2629286-Fix-the-DisplayName-mess_11-reroll.patch76.23 KBgnuget
#61 Issue-2629286-by-hass-Fix-the-DisplayName-mess.patch72.86 KBhass
#60 Issue-2629286-by-hass-Fix-the-DisplayName-mess.patch73.01 KBhass
#58 Issue-2629286-by-hass-Fix-the-DisplayName-mess.patch71.14 KBhass
#54 Issue-2629286-by-hass-Fix-the-DisplayName-mess.patch70.89 KBhass
#53 Issue-2629286-by-hass-Fix-the-DisplayName-mess.patch69.62 KBhass
#52 Issue-2629286-by-hass-Fix-the-DisplayName-mess.patch68.94 KBhass
#47 Issue-2629286-by-hass-Fix-the-DisplayName-mess.patch65.32 KBhass
#45 Issue-2629286-by-hass-Fix-the-DisplayName-mess.patch61.25 KBhass
#43 Issue-2629286-by-hass-Fix-the-DisplayName-mess.patch58.12 KBhass
#41 Issue-2629286-by-hass-Fix-the-DisplayName-mess.patch57.18 KBhass
#39 Issue-2629286-by-hass-Fix-the-DisplayName-mess.patch56.22 KBhass
#37 Issue-2629286-by-hass-Fix-the-DisplayName-mess.patch48.12 KBhass
#34 Issue-2629286-by-hass-Fix-the-DisplayName-mess.patch48.12 KBhass
#31 Issue-2629286-by-hass-Enable-display-name.patch1.49 KBhass
#18 interdiff.txt430 bytesvasi
#18 2629286-user-display-name-18.patch3.56 KBvasi
#13 Issue-2629286-by-hass-User-title-does-not-show-displ.patch3.68 KBhass
#5 Issue-2629286-by-hass-User-title-does-not-show-displ.patch3.64 KBhass
#3 Issue-2629286-by-hass-User-title-does-not-show-displ.patch1.6 KBhass
User-title-need-to-use-getDisplayName.patch806 byteshass
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

hass created an issue. See original summary.

hass’s picture

hass’s picture

Status: Needs review » Needs work

The last submitted patch, 3: Issue-2629286-by-hass-User-title-does-not-show-displ.patch, failed testing.

hass’s picture

Priority: Normal » Major
Status: Needs work » Needs review
FileSize
3.64 KB

Now with a new display name test. There will be more tests added in follow up cases.

hass’s picture

Just checked with D7 and the real name / display name was not allowed to contain <em> with realname enabled. realname strips html.

Need to check again if core alone allowed it in D7. In this case all places in D8 core need to allow it, too.

hass’s picture

Priority: Major » Critical

Can someone RTBC this, please?

legolasbo’s picture

Priority: Critical » Major
Status: Needs review » Needs work

This does not qualify as critical as far as I know.

There will be more tests added in follow up cases.

If you know there are more relevant cases to be tested, why not add them now?

  1. +++ b/core/modules/user/src/Tests/UserDisplayNameTest.php
    @@ -0,0 +1,68 @@
    +    // Login after the alter hook has been enabled or the username is shown.
    

    'or the username is shown.' I don't know what is meant by this.

  2. +++ b/core/modules/user/src/Tests/UserEntityCallbacksTest.php
    @@ -56,7 +59,7 @@
    -    $this->assertEqual($this->anonymous->getUserName(), '', 'The raw anonymous user name should be empty string');
    +    $this->assertEqual($this->anonymous->getUsername(), '', 'The raw anonymous user name should be empty string');
    

    I don't know what is changed here, but it seems to be unrelated.

hass’s picture

Status: Needs work » Needs review

You could first read the patch and than comment. You can answer your above comments yourself than.

legolasbo’s picture

Status: Needs review » Needs work

I am sorry I gave you the impression I did not read the patch, because I have actually read the patch thoroughly, which raised my questions. What makes you think that I didn't read the patch?

There will be more tests added in follow up cases.

If you know there are more relevant cases to be tested, why not add them now?

I don't think i can answer this question by reading the patch. But the question is valid in my opinion. If you know about more relevant test cases, they should be added no?

Your comment // Login after the alter hook has been enabled or the username is shown. just makes no sense to me. When I look at the code a user is logged in after the hook is enabled. The hook being enabled is obvious and does not require a comment, but nowhere is a page being requested or a render function being called before that comment line. So how can a username be shown?

As for the last question. A changed line ending is the only reason I can think of which would cause that change. Other than that both lines are identical and not changing any functionality. They are therefor unrelated and should be removed.

At first I felt really offended by the way you (aggressively) commented on my review. But after counting to 10 and assuming you might just be having a bad day, I've chosen to answer openly en truthfully like I did above. I do however feel that I should inform you about the way your comment made me feel, so you can maybe adjust your way of responding in the future.

hass’s picture

There will be more tests added in follow up cases.

I linked follow up patches. These will add more patches. I can delete my comment if it helps you ignoring it.

Your comment // Login after the alter hook has been enabled or the username is shown. just makes no sense to me.

That is because you have not understood the patch. One line before is the hook enabled. It is just a note that the order of both lines is important.

The other changed line changes getUserName to getUsername. The function in the class is named getUsername and not getUserName. It is easy to see that this is changed. You said you cannot see a change. I can see this change very well.

legolasbo’s picture

I linked follow up patches. These will add more patches. I can delete my comment if it helps you ignoring it.

I overlooked the Meta issue. With that context I understand the comment and I agree the additional test coverage should be part of their respective issues.

That is because you have not understood the patch. One line before is the hook enabled. It is just a note that the order of both lines is important.

I understand the patch perfectly and also know the order of those lines are important. The comment in it's current form however only adds confusion instead of clarity. How about this?
// We must login after the alter hook as been enabled or the username will be shown instead of the display name.

The other changed line changes getUsername to getUserName. The function in the class is named getUserName and not getUsername.

I have seriously been staring at these two lines for several minutes, both before and after my initial comment, but totally missed that. Thanks for clarifying.

If you improve the comment I'll RTBC the patch.

hass’s picture

Status: Needs review » Needs work

The last submitted patch, 13: Issue-2629286-by-hass-User-title-does-not-show-displ.patch, failed testing.

hass’s picture

Status: Needs work » Needs review

Status: Needs review » Needs work

The last submitted patch, 13: Issue-2629286-by-hass-User-title-does-not-show-displ.patch, failed testing.

hass’s picture

Tests are running fine here. There is no php syntax error. No idea what problem the bot has.

vasi’s picture

Status: Needs work » Needs review
FileSize
3.56 KB
430 bytes

I'm not sure why it didn't work, but when I applied your patch I ended up with a missing closing brace. Rerolled with the brace.

effulgentsia’s picture

Issue tags: +Triaged core major

Discussed this with @catch, @alexpott, @xjm, and @Cottser, and we agree this is Major.

This is a regression from Drupal 7, and explicitly violates the docs of AccountInterface::getAccountName(), which says Only display this name to admins and to the user who owns this account, whereas "access user profiles" is not an admin-level permission.

hass’s picture

@effulgentsia: can you RTBC the patch, please?

Version: 8.0.x-dev » 8.1.x-dev

Drupal 8.0.6 was released on April 6 and is the final bugfix release for the Drupal 8.0.x series. Drupal 8.0.x will not receive any further development aside from security fixes. Drupal 8.1.0-rc1 is now available and sites should prepare to update to 8.1.0.

Bug reports should be targeted against the 8.1.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.2.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

hass’s picture

Status: Needs review » Reviewed & tested by the community
catch’s picture

Status: Reviewed & tested by the community » Needs work
+++ b/core/modules/user/src/Tests/UserDisplayNameTest.php
@@ -0,0 +1,69 @@
+ * Tests that display name is shown everywhere.

This doesn't test that the display name is shown everywhere.

Also do we really need a new test, or is there an existing login test we could add an assertion to?

hass’s picture

You are not requiring me to test all places in core, aren't you? Maybe the guy who integrated the DisplayName feature should have written it... I just started one to make sure and others will follow up in more cases. This way I can reuse this file.

catch’s picture

Please read the comment I posted again.

The added test only tests one place, we have other tests for that page, so:

Also do we really need a new test, or is there an existing login test we could add an assertion to?

hass’s picture

I have not found any useful place to test this, but I'm open minded to where this could be added. I thought it is better to keep all these DisplayName tests together in on test. It is easier to maintain and extend one place in future than spreading 100 assertions over the whole core code base. At least this was my idea as it is not easy to find otherwise. Not sure if every module should test on it's own if display name works in their module.

This patch here is a start as I have not found a single assertion for display name and it fixes the most important issue and is currently causing a test fail in realname. I cannot get the realname tests green without this patch or I need to comment the code out. I may miss than later to add it back.

I wish it is not contribs job to test if core works properly... :-)

hass’s picture

Any suggestions/answers?

jonathanshaw’s picture

I'm not sure but I think you may not be understanding what @catch meant.

I don't think he's saying "test everywhere, make 100 assertions all over the place". I think he's saying "don't create a new test, take 1 of the existing login tests for that user/ page and add an assertion to that instead".

we [already] have other tests for that [user/] page

is there an existing login test [from among these other tests] we could add an assertion to

However, I could not see a test in the user module that tested the basic contents of the user/userID page. I assume this is my own ignorance and I've overlooked something, but if you can't find the file with the basic tests for this page either, maybe you could report that to @catch and see what he advises. Surely is must exist somewhere.

hass’s picture

Status: Needs work » Reviewed & tested by the community

However, I could not see a test in the user module that tested the basic contents of the user/userID page. I assume this is my own ignorance and I've overlooked something

No you have not overlooked anything. There is NO test yet. This one will be the first. I have no idea where I could add it to. Nothing makes sense to me. If nobody can point me to a useful place this is the right one.

hass’s picture

Status: Reviewed & tested by the community » Needs work

As Drupal core is a mess if it comes to testing DisplayName I see only one other solution. We need to enable 'user_hooks_test' module with core - always. Otherwise every module that shows a display name need to enable this module by itself what is quite stupid. This affects very many places in core.

hass’s picture

Let's see how seriously this will break core tests.

hass’s picture

Status: Needs work » Needs review

Status: Needs review » Needs work

The last submitted patch, 31: Issue-2629286-by-hass-Enable-display-name.patch, failed testing.

hass’s picture

Uh, really? Only 30 fails? Let's add all core bugs now and see how many fails this bugfixes may have. This patch incorporates #2658602: User picture alt text should user display name to fix all the tons of bugs in a bunch.

hass’s picture

Title: User title does not show display name » Fix the DisplayName mess

Changing title.

Status: Needs review » Needs work

The last submitted patch, 34: Issue-2629286-by-hass-Fix-the-DisplayName-mess.patch, failed testing.

hass’s picture

Status: Needs work » Needs review
FileSize
48.12 KB

Status: Needs review » Needs work

The last submitted patch, 37: Issue-2629286-by-hass-Fix-the-DisplayName-mess.patch, failed testing.

hass’s picture

I'd like to note that testSessionSaveRegenerate() already has the test we have looked for, BUT it has not catched the bug reported here first.

Status: Needs review » Needs work

The last submitted patch, 39: Issue-2629286-by-hass-Fix-the-DisplayName-mess.patch, failed testing.

hass’s picture

Every fix seems to brings up more unseen bugs... really worse test coverage.

Status: Needs review » Needs work

The last submitted patch, 41: Issue-2629286-by-hass-Fix-the-DisplayName-mess.patch, failed testing.

hass’s picture

Status: Needs review » Needs work

The last submitted patch, 43: Issue-2629286-by-hass-Fix-the-DisplayName-mess.patch, failed testing.

hass’s picture

Status: Needs review » Needs work

The last submitted patch, 45: Issue-2629286-by-hass-Fix-the-DisplayName-mess.patch, failed testing.

hass’s picture

Status: Needs work » Needs review
FileSize
65.32 KB

Status: Needs review » Needs work

The last submitted patch, 47: Issue-2629286-by-hass-Fix-the-DisplayName-mess.patch, failed testing.

hass’s picture

Issue summary: View changes
Issue tags: +Security improvements

Rewritten case summary.

hass’s picture

Issue summary: View changes
hass’s picture

Issue summary: View changes
hass’s picture

hass’s picture

hass’s picture

The last submitted patch, 52: Issue-2629286-by-hass-Fix-the-DisplayName-mess.patch, failed testing.

The last submitted patch, 53: Issue-2629286-by-hass-Fix-the-DisplayName-mess.patch, failed testing.

Status: Needs review » Needs work

The last submitted patch, 54: Issue-2629286-by-hass-Fix-the-DisplayName-mess.patch, failed testing.

hass’s picture

Status: Needs work » Needs review
FileSize
71.14 KB

Status: Needs review » Needs work

The last submitted patch, 58: Issue-2629286-by-hass-Fix-the-DisplayName-mess.patch, failed testing.

hass’s picture

hass’s picture

The last submitted patch, 60: Issue-2629286-by-hass-Fix-the-DisplayName-mess.patch, failed testing.

Status: Needs review » Needs work

The last submitted patch, 61: Issue-2629286-by-hass-Fix-the-DisplayName-mess.patch, failed testing.

gnuget’s picture

Here a #61's reroll.

I will try to fix the test which are still failing.

gnuget’s picture

Assigned: Unassigned » gnuget

I've been working today on this.

+++ b/core/profiles/testing/testing.info.yml
@@ -9,6 +9,8 @@ dependencies:
+  # Make sure DisplayName is always enabled and properly tested.
+  - user_hooks_test

I do not agree with this, even if it is stupid like #30 said if this module is enabled by default this will make the output in certain tests be unexpected and will confuse developers when they write new tests because some <em> tags will appear in the DisplayName.

If every module which uses display name enable this module at least it will give an insight why the displayname has some extra tags.

I will try to provide a patch which not require this module by default.

hass’s picture

Hey, the sense of this patch is to show WHERE dispayname is broken. This is why i wrote this. Developers need to expect the display name AND html. Currently they often do not and THIS is the problem!!!

gnuget’s picture

Assigned: gnuget » Unassigned
Status: Needs work » Needs review
FileSize
3.06 KB
76.28 KB

Hi hass

Hey, the sense of this patch is to show WHERE dispayname is broken. This is why i wrote this. Developers need to expect the display name AND html.
Currently they often do not and THIS is the problem!!!

You are right, I left the user_hooks_test in the testing.info.yml file so we know which tests we need to fix (thanks!)

I hit a wall here:

    \Drupal::state()->set('user_hooks_test_user_format_name_alter_safe', TRUE);
    $this->drupalPostForm('node/' . $this->node->id(), $edit, t('Preview'));
    $this->assertTrue($this->webUser->getDisplayName() instanceof MarkupInterface, 'Username is marked safe');
    $this->assertNoEscaped($this->webUser->getDisplayName());
    $this->assertRaw($this->webUser->getDisplayName());
    \Drupal::state()->set('user_hooks_test_user_format_name_alter_safe', FALSE);

Basically, the test expect the "<em></em>" be wrapping the display name BUT if the displayname is longer than 20 characters the getDisplayNameTruncated will remove the last leaving something like: <em>Firstname3… which makes me wonder if the getDisplayNameTruncated should strip the html tags before to truncate the string and if we should rewrite the test above.

I attached my progress so far.

Status: Needs review » Needs work

The last submitted patch, 67: fix_the_displayname_mess-2629286-67.patch, failed testing.

hass’s picture

That is something I wasted hours with... if not 2 days. No idea how to fix this test. Since the EM is checkplained there should be no issue for now.

A follow up issue should be consitency of the DisplayName. Tons of places strip HTML and others do not. This is very strange. But we can and should do this in followup's. It may require many theme changes, but not sure yet. In general HTML is supported in display name. Maybe we need to fix all occurrences where tags are stripped. Need some core maintainer to decide on this.

I also have posted a patch in #2767787: Allow custom truncate username settings that disables display name truncating. I'm in high favor to remove truncating by default and only enable it where it is required. Something that may need some discussion...

hass’s picture

  1. +++ b/core/modules/comment/src/Tests/CommentPreviewTest.php
    @@ -45,6 +45,7 @@ function testCommentPreview() {
    +    \Drupal::service('module_installer')->install(['user_hooks_test']);
    

    that looks strange... that should be installed by default.

  2. +++ b/core/modules/user/src/Entity/User.php
    @@ -383,7 +383,7 @@ public function getDisplayName() {
    +      $name = Unicode::truncate((string) $name, 15, FALSE, TRUE);
    

    How is it possible that $name is no string?

  3. +++ b/core/modules/user/src/Tests/UserAdminTest.php
    @@ -178,7 +178,7 @@ function testNotificationEmailAddress() {
    +    $subject = strip_tags('Account details for ' . $user->getDisplayName() . ' at ' . $system->get('name') . ' (pending admin approval)');
    

    I would better only strip on the display name

gnuget’s picture

  1. that looks strange... that should be installed by default

    Yeah, it is weird, not sure why in this case is not there by default, I will check why.

  2. How is it possible that $name is no string?

    That is because of this:

    if (\Drupal::state()->get('user_hooks_test_user_format_name_alter_safe', FALSE)) {
            $name = SafeMarkup::format('<em>@display-name</em>', array('@display-name' => 'Firstname' . $uid . ' Lastname' . $uid));
    }
    

    SafeMarkup::format() returns an instance of MarkupInterface

  3. I would better only strip on the display name

    True, I will fix that in my next patch.

Version: 8.1.x-dev » 8.2.x-dev

Drupal 8.1.9 was released on September 7 and is the final bugfix release for the Drupal 8.1.x series. Drupal 8.1.x will not receive any further development aside from security fixes. Drupal 8.2.0-rc1 is now available and sites should prepare to upgrade to 8.2.0.

Bug reports should be targeted against the 8.2.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.3.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

ekes’s picture

Hi,

Just run into this one with some tests on a site with the a changed display name.

Reading up, I was wondering - honest question, I've not delved deeply into the different usages of DisplayName - could the issue and patch be broken into two (or three)? One of them RTBC as lots of them are trivial fixes that might as well go in, and one detailing the problems with different usages.

hass’s picture

I fear core developers will only commit with full test coverage... just a guess.

ekes’s picture

I agree changing the active code without tests to cover it wouldn't be good. Could those case be spun off into another issue that actually details what the problem is. But plenty of this patch should be good no?

The core _tests_ are presently broken. If you implement a change to getDisplayName() there's red. There are tests that use getUserName() in them, which pass only because the output is the same as getDisplayName(); but they should be using getDisplayName() because that's being put into the strings. This patch includes those changes, can't see any reason they shouldn't go in already. Committing changes to the tests already would be an improvement?

Also if there are some changes to the active code, cleaning up other places that it's wrong - with tests - would be an improvement too?

Then it's the complicated bits that could be fleshed out? Like I say, a thought.

hass’s picture

I think they will complain why we need to commit this patch as we are not proving the bugs by running the failing tests. This patch here shows all the already existing bugs... not sure how you'd like to split it.

ekes’s picture

Interesting question. Guess to prove the tests fail you have to implement a test module that changes getDisplayName so it's not the same as getUserName.

Anyway if it's not going to speed up getting fixes in, doesn't matter.

Mile23’s picture

Title: Fix the DisplayName mess » Use getDisplayName() for user names consistently
Issue summary: View changes
FileSize
76.35 KB

This might be enough of a change to bump up to 8.3.x, but it's a major bug so leaving it at 8.2.x.

I think it's a reviewable size as-is, though it is big.

Just a couple things related to the truncated name:

  1. +++ b/core/lib/Drupal/Core/Session/AccountInterface.php
    @@ -146,6 +146,18 @@ public function getAccountName();
       /**
    +   * Returns the truncated display name of this account.
    +   *
    +   * @see getDisplayName()
    +   *
    +   * @return string|\Drupal\Component\Render\MarkupInterface
    +   *   Either a string that will be auto-escaped on output or a
    +   *   MarkupInterface object that is already HTML escaped. Either is safe
    +   *   to be printed within HTML fragments.
    +   */
    +  public function getDisplayNameTruncated();
    

    Either add a length parameter or document the truncated length. But really add a length parameter that defaults to 20. :-)

  2. +++ b/core/modules/user/user.module
    @@ -471,10 +471,9 @@ function template_preprocess_username(&$variables) {
    +  $name  = $account->getDisplayNameTruncated();
    +  $variables['name_raw'] = $account->getDisplayName();
       if (Unicode::strlen($name) > 20) {
    -    $name = Unicode::truncate($name, 15, FALSE, TRUE);
         $variables['truncated'] = TRUE;
    

    If you have a way to pass in the truncated length, then you can do that here and know that 20 is the biggest non-truncated name without trusting.

Here's a straight re-roll of #67.

Mile23’s picture

Status: Needs work » Needs review

Status: Needs review » Needs work

The last submitted patch, 78: 2629286_78.patch, failed testing.

hass’s picture

I think we should not mix this up. I 100% agree with you that the length should be configurable, but as of now it is not and this may end in an endless discussion. See #2767787: Allow custom truncate username settings for this.

hass’s picture

Mile23’s picture

Issue summary: View changes

OK, so #2767787: Allow custom truncate username settings is a follow-up. That's a D7 issue, btw.

Still needs passing tests here.

mohit_aghera’s picture

Assigned: Unassigned » mohit_aghera
ifrik’s picture

Assigned: mohit_aghera » Unassigned

Mohit_aghera,

great that you want to contribute to this issue, but there is no need to assign this to you.
Even though the issue tracker technically allows people to assign issues, this feature is generally not used in order to encourage everybody to contribute.
And as you can see in this case: there are several people actively working on the issue.

If you want to contribute: please write that into a comment. Don't claim issues for yourself. I'll unassign you.

(And to anybody committing this later: Don't credit me in the issue commit. I'm just writing a note.)

Version: 8.2.x-dev » 8.3.x-dev

Drupal 8.2.6 was released on February 1, 2017 and is the final full bugfix release for the Drupal 8.2.x series. Drupal 8.2.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.3.0 on April 5, 2017. (Drupal 8.3.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.3.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.4.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

mohit_aghera’s picture

Status: Needs work » Needs review
FileSize
78.47 KB

Here is straight re-roll of #78 for initial testing

Status: Needs review » Needs work

The last submitted patch, 87: 2629286_87.patch, failed testing.

mohit_aghera’s picture

Status: Needs work » Needs review
FileSize
77.98 KB
586 bytes

Uploading patch with initial try to fix test case failures.

Status: Needs review » Needs work

The last submitted patch, 89: 2629286_89.patch, failed testing.

mohit_aghera’s picture

Status: Needs work » Needs review
FileSize
78.55 KB
2.89 KB

Updating relevant method names.

Status: Needs review » Needs work

The last submitted patch, 91: 2629286_91.patch, failed testing.

mohit_aghera’s picture

Status: Needs work » Needs review
FileSize
78.76 KB
450 bytes

Added missing namespace which was causing fatal errors.

Status: Needs review » Needs work

The last submitted patch, 93: 2629286_92.patch, failed testing.

mohit_aghera’s picture

Status: Needs work » Needs review
FileSize
78.76 KB
450 bytes

Status: Needs review » Needs work

The last submitted patch, 95: 2629286_94.patch, failed testing.

mohit_aghera’s picture

Status: Needs work » Needs review
FileSize
79.16 KB

Re-rolling patch again as it was not getting applied after recent test case changes.

Status: Needs review » Needs work

The last submitted patch, 97: 2629286_97.patch, failed testing.

DuaelFr’s picture

Thank you for your contribution. Beware of duplication with #2801645: Use \Drupal\user\UserInterface::getDisplayName() on user pages instead of the plain User::getUsername() , though.
I'm not confident enough to decide which of your issues should be closed in favor of the other. Could you have a look there and see how you can converge?

idebr’s picture

gaurav.kapoor’s picture

Status: Needs work » Needs review
FileSize
132.15 KB

Status: Needs review » Needs work

The last submitted patch, 101: 2629286-101.patch, failed testing.

gaurav.kapoor’s picture

Status: Needs work » Needs review
FileSize
132.09 KB

Status: Needs review » Needs work

The last submitted patch, 103: 2629286-103.patch, failed testing.

hass’s picture

What are you doing there? Your patch is not really good and has tons of bugs introduced. Without reviewing your patch in detail - code like below can only incorrect. This can only be getAccountName() if you login to something, but you need to verify every occurence one by one.

-    $this->basicAuthGet($url, $account->getUsername(), $account->pass_raw);
-    $this->assertText($account->getUsername(), 'Account name is displayed.');
+    $this->basicAuthGet($url, $account->getDisplayName(), $account->pass_raw);
+    $this->assertText($account->getDisplayName(), 'Account name is displayed.');
-    $this->basicAuthGet($url, $account->getUsername(), $account->pass_raw);
+    $this->basicAuthGet($url, $account->getDisplayName(), $account->pass_raw);

You cannot simply search and replace getUsername with getDisplayName(). In most if not all - cases this is incorrect. This case is to fix places where the username is shown, but displayname should shown. Not everywhwere is this true.

Go back to #97, please.

hass’s picture

That looks Like a bad idea as usernames cannot changed, but display names can. If we log something it should be the username or we lose the reference of the log if a user changes it's getDisplayName.

if (!$message->isPersonal()) {
       $this->logger->notice('%sender-name (@sender-from) sent an email regarding %contact_form.', array(
-        '%sender-name' => $sender_cloned->getUsername(),
+        '%sender-name' => $sender_cloned->getDisplayName(),
hass’s picture

Reroled the patch.

Status: Needs review » Needs work

The last submitted patch, 107: Issue-2629286-by-hass-Use-getDisplayName-for-user-na.patch, failed testing.

hass’s picture

Status: Needs review » Needs work

The last submitted patch, 110: Issue-2629286-by-hass-Use-getDisplayName-for-user-na.patch, failed testing.

hass’s picture

hass’s picture

The last submitted patch, 112: Issue-2629286-by-hass-Use-getDisplayName-for-user-na.patch, failed testing.

Status: Needs review » Needs work

The last submitted patch, 113: Issue-2629286-by-hass-Use-getDisplayName-for-user-na.patch, failed testing.

hass’s picture

Issue summary: View changes

Version: 8.3.x-dev » 8.4.x-dev

Drupal 8.3.6 was released on August 2, 2017 and is the final full bugfix release for the Drupal 8.3.x series. Drupal 8.3.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.4.0 on October 4, 2017. (Drupal 8.4.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.4.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.5.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

sheise’s picture

Status: Needs work » Needs review
FileSize
71.99 KB

Here's an updated patch for 8.4.x-dev.

Status: Needs review » Needs work

The last submitted patch, 118: use_getDisplayName_consistently-2629286-118.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

harings_rob’s picture

Applied to 8.5.x as this won't go into 8.4 anymore.

hass’s picture

Status: Needs work » Needs review

Status: Needs review » Needs work

The last submitted patch, 120: use_getdisplayname-2629286-120.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

joelpittet’s picture

This issue seems to have morphed into adding truncation to usernames in core. Has it been scope creeped? Can that this problem be fixed without the API addition?

hass’s picture

@joelpittet: I think this is not possible without an API addition. Without the code becomes unreadable.

There are places in code where the string must be truncated and in others places we do not want this to happen, but it happens. If you need to write a test to verify if a string has been truncated, you need a function to know for this to be sure. There is also a patch in pipeline to make the length configurable.

If someone could help with some of the difficult remaining failures (I have not understood) it would be great! Patch from #113 is the latest to work on. The later patches are missing some of my code fixes what increased test failures.

Not sure why I'm the only who'd like to see this issue fixed as realname is used by a lot of people and core really has a lot of bugs about this...

jonathanshaw’s picture

Issue tags: +Needs reroll

Per #124 this needs a CAREFUL reroll of #113. Some previous attepmts to reroll have not caught all the fixes in the patch. A successful reroll should only have 8 test fails.

jofitz’s picture

Status: Needs work » Needs review
Issue tags: -Needs reroll
FileSize
80.22 KB

Re-rolled. I will check back if this does not have the expected 8 test fails.

Status: Needs review » Needs work

The last submitted patch, 126: 2629286-126.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

jofitz’s picture

Assigned: Unassigned » jofitz

Close, but not the expected 8 test fails. I'll investigate.

hass’s picture

Thanks. If you can also try to fix some of the others this would be great!

joelpittet’s picture

@hass why does this need to be truncated anywhere?

Couldn't you use text-overflow: ellipsis; in CSS and call it a day?
https://css-tricks.com/snippets/css/truncate-string-with-ellipsis/

And you can use a minimum width to hold the space with character spacing:
min-width: 20ch

Edit: Assuming this is for UI purposes. Please correct me if my assumption is incorrect.
https://caniuse.com/#search=text-overflow

hass’s picture

Sure that is UI issues. If you have no control about the length of the string a table cell will grow unexpectly. The CSS trick may be feasible, but this out of scope here. It is too late to change all places in core and contrib. This case is to fix the display name bugs only. We could create a follow up for new features.

joelpittet’s picture

Seems like a much quicker approach if the issue is UI to do the presentation with CSS. It may not go into stable/classy(maintainer must decide) but could be put into core, Seven and Bartik.

Here's a POC with the user table and some fake names.
https://jsfiddle.net/5r8qe42t/1/

hass’s picture

If this css works in all browsers it is a smarter solution I think. We could solve both issues in one.

Can we get approval by core maintainers that we do not waste time into a direction that may not accepted later?

How can we test this css abrrivation?

joelpittet’s picture

Manual testing for CSS changes, aka Screenshots.

I'll see if one of the theme system maintainers can weigh in on #132 as a viable direction.

markconroy’s picture

re: #132, I needed to do something similar a while back to only show first two letters of language switcher options on small screens (because of space issues), so EN | GA on small screens and ENGLISH | GAEILGE on larger ones.

I looked at using the ch css width to show only two characters, but it turns out that only works for mono-spaced fonts, which might be an issue if we add it to Drupal core. In the end, I solved it with a small bit of JS to search the string, split it at 2 characters, and then just show those on small screens.

Here's a stackoverflow issue that I came across - https://stackoverflow.com/questions/35328019/css-display-only-the-first-...

There's also a (partial support) issue with it in IE11 -

IE supports the ch unit, but unlike other browsers its width is that specifically of the "0" glyph, not its surrounding space. As a result, 3ch for example is shorter than the width of the string "000" in IE.

https://caniuse.com/#search=ch

hass’s picture

That is a different issue... we do not need exactly 2 chars here.

jofitz’s picture

Assigned: jofitz » Unassigned
markconroy’s picture

@hass,

I don't think it is a different issue.

From the code supplied in #132, it specifically states

 .username {
   min-width: 10ch;
   width: 100%;
 }
 
 
.views-field-name {
  max-width: 20ch;
}

Unless, I am reading this wrong, we are saying that the user name will be at least 10ch wide (10 monospaced characters) and at most 20ch (20 monospaced characters). BUT, if the font being used is not monospaced, then 20ch may cut off characters mid-point through a character (an "o" might end up looking like a "c").

In my example, I only need 2 characters, but this seems to be suggesting that we need up-to-20 and no more than 20 (which makes it look very similar to my issue (solved with JS)).

hass’s picture

The username need to be cut-off at a length that can be displayed properly without destroying the layout. So we define a width of a table column or an inline element and it cuts the length whereever it is needed. It is not important if it shows 10 letters with monospace and 11 letters in non-monospace fonts or vice versa. We only need to prevent that a username / display name of 255 chars destroys the layout of a page.

We can be a bit more flexible here... in past it was also not cut-off perfectly at a specific char. Unicode::truncate() is not that exact, too.

markconroy’s picture

I get the point, but what I am saying is that we might end up cutting off letters/characters mid-way through the character itself. Leaving us with something like this (presuming the user name was longer than yours is):

hass’s picture

Really? I tested with monospace and non-monospace and all differences I have seen was one has a letter more than the other... the ellipsis was always shown. Can you show a fiddle that shows this issue? If we cannot solve it with CSS we need to stick with the current solution I guess.

markconroy’s picture

I am basing my info on the link to stackoverflow and caniuse from my previous comment.

StackOverflow:

Unfortunately this works only with monospace fonts and not in older browsers.

- https://stackoverflow.com/questions/35328019/css-display-only-the-first-...

Can I Use:

IE supports the ch unit, but unlike other browsers its width is that specifically of the "0" glyph, not its surrounding space. As a result, 3ch for example is shorter than the width of the string "000" in IE.

- https://caniuse.com/#search=ch

Here's a basic fiddle showing it in action:
https://jsfiddle.net/3vwogyjs/1/

hass’s picture

Please add text-overflow:ellipsis and you will see it works without issues.

https://jsfiddle.net/yubct0fo/

gnuget’s picture

here a version with ellipsis and yes it totally works!

I really like this approach.

https://jsfiddle.net/e3ozc124/

markconroy’s picture

Excellent. Looks like we might have a solution so.

gnuget’s picture

here a reroll of #126.

I will provide a patch with the CSS trick and without the API addition in my next comment to keep this moving.

gnuget’s picture

Status: Needs work » Needs review

Status: Needs review » Needs work

The last submitted patch, 146: 2629286-146.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

gnuget’s picture

I found a problem with the new approach :-/

When the account is not verified the module appends a text letting the user know with this new approach that text is hidden.

This can be fixed if we add an extra tag to wrap the username and left the extra text outside of this tag but not sure if we can just change the markup at this point:

Without the patch:

With the patch:

gnuget’s picture

Let's see what the testbot says.

gnuget’s picture

Status: Needs work » Needs review

Status: Needs review » Needs work

The last submitted patch, 150: 2629286-150.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

Version: 8.5.x-dev » 8.6.x-dev

Drupal 8.5.0-alpha1 will be released the week of January 17, 2018, which means new developments and disruptive changes should now be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

dsp1’s picture

is this issue adding a display name field?

my recommendation, which I guess is similar to this, was to change user name to user login, and then add a new user name field for display.
https://www.drupal.org/project/drupal/issues/295440

pescetti’s picture

The patch at #150 applies correctly to Drupal core 8.5.3, but it doesn't apply any longer to Drupal core 8.5.4, released yesterday.

TommyChris’s picture

I rerolled the #150 for D8.5.4.

iamdroid’s picture

I rerolled the #156 for D8.5.5.

Version: 8.6.x-dev » 8.7.x-dev

Drupal 8.6.0-alpha1 will be released the week of July 16, 2018, which means new developments and disruptive changes should now be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

alexpott’s picture

Issue summary: View changes
alexpott’s picture

  1. +++ b/core/lib/Drupal/Core/Session/UserSession.php
    @@ -174,6 +178,23 @@ public function getDisplayName() {
    +    $display_name = $this->getDisplayName();
    +
    +    // If $display_name is an instance of MarkupInterface then convert it to
    +    // string to truncate it.
    +    $name = ($display_name instanceof MarkupInterface) ? $display_name->__toString() : $display_name;
    +    if (Unicode::strlen($name) > 20) {
    +      $name = Unicode::truncate((string) $name, 15, FALSE, TRUE);
    +    }
    +    $name = ($display_name instanceof MarkupInterface) ? Markup::create($name) : $name;
    +
    +    return $name;
    

    Truncated markup objects is super tricky. What happens if getDisplayName has added markup to the string - for whatever reason. This can end up in breaking the HTML. I think maybe we need to use \Drupal\Component\Render\PlainTextOutput::renderFromHtml() here to truncate safely. In fact, this makes me wonder if we shouldn't add a method to MarkupTrait to do this for us. Something like:

      public function truncate($max_length, $wordsafe = FALSE, $add_ellipsis = FALSE, $min_wordsafe_length = 1) {
        $string = PlainTextOutput::renderFromHtml($this->string);
        // @todo can we return an object of the same class?!?!?
        return Markup::create(Unicode::truncate($string, $max_length, $wordsafe, $add_ellipsis, $min_wordsafe_length));
      }
    
  2. +++ b/core/modules/user/src/Tests/UserPasswordResetTest.php
    @@ -90,7 +90,7 @@ public function testUserPasswordReset() {
    -    $subject = t('Replacement login information for @username at @site', ['@username' => $this->account->getUsername(), '@site' => $this->config('system.site')->get('name')]);
    +    $subject = t('Replacement login information for @username at @site', ['@username' => $this->account->getDisplayName(), '@site' => $this->config('system.site')->get('name')]);
    

    I'm not sure that login information should do use the display name. Looking at the docs for getAccountName()

       *   An unsanitized plain-text string with the name of this account that is
       *   used to log in. Only display this name to admins and to the user who owns
       *   this account, and only in the context of the name used to log in. For
       *   any other display purposes, use
       *   \Drupal\Core\Session\AccountInterface::getDisplayName() instead.
    

    I think when we're dealing with login information we should use getAccountName().

alexpott’s picture

+++ b/core/modules/comment/tests/src/Kernel/CommentFieldAccessTest.php
@@ -212,12 +212,12 @@ public function testAccessToAdministrativeFields() {
-          '@user' => $set['user']->getUsername(),
+          '@user' => $set['user']->getDisplayName(),
...
-          '@user' => $set['user']->getUsername(),
+          '@user' => $set['user']->getDisplayName(),
           '@state' => $may_update ? 'can' : 'cannot',

@@ -229,7 +229,7 @@ public function testAccessToAdministrativeFields() {
-        '@user' => $set['user']->getUsername(),
+        '@user' => $set['user']->getDisplayName(),

@@ -251,13 +251,13 @@ public function testAccessToAdministrativeFields() {
-          '@user' => $set['user']->getUsername(),
+          '@user' => $set['user']->getDisplayName(),
...
-          '@user' => $set['user']->getUsername(),
+          '@user' => $set['user']->getDisplayName(),

@@ -272,12 +272,12 @@ public function testAccessToAdministrativeFields() {
-          '@user' => $set['user']->getUsername(),
+          '@user' => $set['user']->getDisplayName(),
...
-          '@user' => $set['user']->getUsername(),
+          '@user' => $set['user']->getDisplayName(),

@@ -299,7 +299,7 @@ public function testAccessToAdministrativeFields() {
-          '@user' => $set['user']->getUsername(),
+          '@user' => $set['user']->getDisplayName(),

I think these should all be getAccountName() - this is a test for what that user account can do.

alexpott’s picture

After thinking about this some more I think we should complete the deprecation and convert everything to getAccountName() in #2787871: Properly deprecate getUserName() and use getAccountName() instead and then this issue can focus on when and where to use getDisplayName()

alexpott’s picture

Issue summary: View changes
hass’s picture

I spend all the time already. Please use the patch here. I reviewed all places and changed them as needed.

Whenever we can - the DisplayName should be used and not AcountName.

You would invalidate the complete patch and we start at zero. This would be an extreme demotivating.

alexpott’s picture

  1. @hass I don't want to demotivate you but this patch is doing three things which is why it is taking ages to get done. We should try to split these up so that we can get the goodness of this work in to core. The three things are:
    • Removing usage of getUsername() - let's do that in #2787871: Properly deprecate getUserName() and use getAccountName() instead
    • Adding new functionality to truncate usernames - we probably should add generic functionality to Markup objects to do that safely - also we should really discuss whether we can truncate usernames if the display version contains html or whether we should allow it but add documentation to the hook to tell people to not add html here because the display name is truncated.
    • Converting places to use getDisplayName() correctly and ensuring we have test coverage

    All three of these things are great things to do but doing them in the same issue means that the patch is large, hard to review and often has further scope creep (eg replace format_string() usage).

  2. +++ b/core/modules/content_translation/tests/src/Functional/ContentTranslationWorkflowsTest.php
    @@ -154,7 +154,7 @@ public function testWorkflows() {
    -    $args = ['@user_label' => $user->getUsername()];
    +    $args = ['@user_label' => $user->getDisplayName()];
    

    This is used in a test for an assertion message about permissions should be getAccountName()

  3. +++ b/core/modules/simpletest/src/WebTestBase.php
    @@ -294,7 +295,7 @@ protected function drupalLogin(AccountInterface $account) {
    -    $pass = $this->assert($this->drupalUserIsLoggedIn($account), format_string('User %name successfully logged in.', ['%name' => $account->getUsername()]), 'User login');
    +    $pass = $this->assert($this->drupalUserIsLoggedIn($account), new FormattableMarkup('User %name successfully logged in.', ['%name' => $account->getDisplayName()]), 'User login');
    

    This change is unnecessary this is a text assertion message in tests relating to whether the account is logged in.

  4. +++ b/core/modules/tracker/src/Controller/TrackerUserTab.php
    @@ -22,7 +22,7 @@ public function getContent(UserInterface $user) {
    -    return $user->getUsername();
    +    return $user->getDisplayName();
    

    +1 nice find.

  5. +++ b/core/modules/user/tests/modules/user_hooks_test/user_hooks_test.module
    @@ -11,12 +11,16 @@
    +  if (\Drupal::state()->get('user_hooks_test_user_format_name_alter', TRUE)) {
    

    I like this - making this always on makes heaps of sense.

  6. +++ b/core/modules/user/tests/src/Functional/UserAdminListingTest.php
    @@ -93,6 +96,8 @@ public function testUserListing() {
    +
    +    \Drupal::state()->set('user_hooks_test_user_format_name_alter', TRUE);
    

    This shouldn't be necessary - the test site is completely torn down and does not affect the next test.

  7. +++ b/core/profiles/testing/testing.info.yml
    @@ -9,6 +9,8 @@ dependencies:
    +  # Make sure DisplayName is always enabled and properly tested.
    +  - user_hooks_test
    

    +1,000,000 really great idea.

hass’s picture

We can split the GetUsername / GetAccountName / GetDisplayName from this patch and work on the tests in a follow up. Are you fine with this? So this patch does not get broken completly. I will not spend another 2 days investigating if DisplayName or AccountName should be used. I already done this!

alexpott’s picture

@hass but no of this is simple. For example:

+++ b/core/modules/user/user.module
@@ -1281,7 +1281,7 @@ function user_form_process_password_confirm($element) {
-      'username' => \Drupal::currentUser()->getUsername(),
+      'username' => \Drupal::currentUser()->getDisplayName(),

This one is more complex. This is used by the password JS to ensure you don't match your login name so - getUsername() should definitely be here BUT also I think the password should not match the display name either. However, this change as it stands is incorrect. And needs a separate issue with new tests to change how this works to be able to have multiple usernames or something like that.

This is why I proprose breaking this up into more manageable pieces and doing the deprecation and getUsername -> getAccountName first because then the noise in this patch will be lessened. If we get #2787871: Properly deprecate getUserName() and use getAccountName() instead done I'm happy to re-roll this on top and and document all the places where getDisplayName() should be used and why.

TommyChris’s picture

I rerolled the #157 for D8.6.1

alexpott’s picture

This patch needs a major re-rolled now that #2787871: Properly deprecate getUserName() and use getAccountName() instead has landed.

hass’s picture

@alexpot: Yes, and you offered to do the re-roll. :-)

alexpott’s picture

Status: Needs work » Needs review
FileSize
66.66 KB

Here's a reroll.

alexpott’s picture

The are a number of changes here that are unnecessary. And other that need discuss as far as I can see.

  1. +++ b/core/lib/Drupal/Core/Session/UserSession.php
    @@ -175,6 +179,23 @@ public function getDisplayName() {
    +  public function getDisplayNameTruncated() {
    +    $display_name = $this->getDisplayName();
    +
    +    // If $display_name is an instance of MarkupInterface then convert it to
    +    // string to truncate it.
    +    $name = ($display_name instanceof MarkupInterface) ? $display_name->__toString() : $display_name;
    +    if (Unicode::strlen($name) > 20) {
    +      $name = Unicode::truncate((string) $name, 15, FALSE, TRUE);
    +    }
    +    $name = ($display_name instanceof MarkupInterface) ? Markup::create($name) : $name;
    +
    +    return $name;
    +  }
    

    This logic can be a little simpler. Done that in the patch attached.

  2. +++ b/core/modules/simpletest/src/WebTestBase.php
    @@ -294,7 +294,7 @@ protected function drupalLogin(AccountInterface $account) {
    -    $pass = $this->assert($this->drupalUserIsLoggedIn($account), format_string('User %name successfully logged in.', ['%name' => $account->getAccountName()]), 'User login');
    +    $pass = $this->assert($this->drupalUserIsLoggedIn($account), new FormattableMarkup('User %name successfully logged in.', ['%name' => $account->getDisplayName()]), 'User login');
    

    This type of change on an assertion message is not necessary. In fact I'd argue that this gets in the way of knowing which user has successfully logged in. And there are a number of other test changes like this that I think should be dropped. For example all the changes to CommentFieldAccessTest

  3. +++ b/core/modules/user/tests/src/Functional/UserAdminTest.php
    @@ -71,20 +71,20 @@ public function testUserAdmin() {
    -    $this->assertNoText($user_a->getAccountName(), 'User A not on filtered by perm admin users page');
    -    $this->assertText($user_b->getAccountName(), 'Found user B on filtered by perm admin users page');
    -    $this->assertText($user_c->getAccountName(), 'Found user C on filtered by perm admin users page');
    +    $this->assertNoText($user_a->getDisplayNameTruncated(), 'User A not on filtered by perm admin users page');
    +    $this->assertEscaped($user_b->getDisplayNameTruncated(), 'Found user B on filtered by perm admin users page');
    +    $this->assertEscaped($user_c->getDisplayNameTruncated(), 'Found user C on filtered by perm admin users page');
    

    I'm not totally convinced that name listed on the admin users page should be the display name. I think there is a case that admins need the real username that a user logs in with.

  4. +++ b/core/modules/user/tests/src/Functional/UserCancelTest.php
    @@ -84,7 +84,7 @@ public function testUserCancelChangePermission() {
    -    $this->assertRaw(t('%name has been deleted.', ['%name' => $account->getAccountName()]), 'User deleted.');
    +    $this->assertRaw(t('%name has been deleted.', ['%name' => $account->getDisplayName()]), 'User deleted.');
         $this->assertFalse(User::load($account->id()), 'User is not found in the database.');
    
    @@ -198,7 +198,7 @@ public function testUserBlock() {
    -    $this->assertRaw(t('%name has been disabled.', ['%name' => $account->getAccountName()]), "Confirmation message displayed to user.");
    +    $this->assertRaw(t('%name has been disabled.', ['%name' => $account->getDisplayName()]), "Confirmation message displayed to user.");
    
    @@ -255,7 +255,7 @@ public function testUserBlockUnpublish() {
    -    $this->assertRaw(t('%name has been disabled.', ['%name' => $account->getAccountName()]), "Confirmation message displayed to user.");
    +    $this->assertRaw(t('%name has been disabled.', ['%name' => $account->getDisplayName()]), "Confirmation message displayed to user.");
    
    @@ -352,7 +352,7 @@ public function testUserAnonymize() {
    -    $this->assertRaw(t('%name has been deleted.', ['%name' => $account->getAccountName()]), "Confirmation message displayed to user.");
    +    $this->assertRaw(t('%name has been deleted.', ['%name' => $account->getDisplayName()]), "Confirmation message displayed to user.");
    
    @@ -471,7 +471,7 @@ public function testUserDelete() {
    -    $this->assertRaw(t('%name has been deleted.', ['%name' => $account->getAccountName()]), "Confirmation message displayed to user.");
    +    $this->assertRaw(t('%name has been deleted.', ['%name' => $account->getDisplayName()]), "Confirmation message displayed to user.");
    
    @@ -490,12 +490,12 @@ public function testUserCancelByAdmin() {
    -    $this->assertRaw(t('Are you sure you want to cancel the account %name?', ['%name' => $account->getAccountName()]), 'Confirmation form to cancel account displayed.');
    +    $this->assertRaw(t('Are you sure you want to cancel the account %name?', ['%name' => $account->getDisplayName()]), 'Confirmation form to cancel account displayed.');
    ...
    -    $this->assertRaw(t('%name has been deleted.', ['%name' => $account->getAccountName()]), 'User deleted.');
    +    $this->assertRaw(t('%name has been deleted.', ['%name' => $account->getDisplayName()]), 'User deleted.');
    
    @@ -518,12 +518,12 @@ public function testUserWithoutEmailCancelByAdmin() {
    -    $this->assertRaw(t('Are you sure you want to cancel the account %name?', ['%name' => $account->getAccountName()]), 'Confirmation form to cancel account displayed.');
    +    $this->assertRaw(t('Are you sure you want to cancel the account %name?', ['%name' => $account->getDisplayName()]), 'Confirmation form to cancel account displayed.');
    ...
    -    $this->assertRaw(t('%name has been deleted.', ['%name' => $account->getAccountName()]), 'User deleted.');
    +    $this->assertRaw(t('%name has been deleted.', ['%name' => $account->getDisplayName()]), 'User deleted.');
    

    Similarly I'm not sure that these actions should use the display name. This is tricky because many of these already use the display name.

  5. +++ b/core/profiles/testing/testing.info.yml
    @@ -9,6 +9,8 @@ install:
    +  # Make sure DisplayName is always enabled and properly tested.
    +  - user_hooks_test
    

    I think this is a very good idea but I'm scared that this is going to cause a lot of disruption for contrib and sites with automated tests.

The last submitted patch, 171: 2629286-171.patch, failed testing. View results

Status: Needs review » Needs work

The last submitted patch, 172: 2629286-172.patch, failed testing. View results

hass’s picture

Please keep in mind that the patch has not fixed many bugs in core. I only tried to fix the broken tests. This case is a prove of hundreds of test bugs mostly.

Display name need to be used everywhere with very rare exceptions. Nobody of the users should be able to gather the users usernames. An admin can always find the username in the user and he could also alter the view and add the account name when he need. If i use realname I search for realnames everywhere. I no longer think about usernames. However if I need the username, it can be found in the user and not only there, the query alter will search for both if you filter for usernames.

I think contrib need to learn about their bugs. The fixes are simple and it would improve the code quality. All failures that may happen - are bugs that need to be fixed. We should really enable this by default. I‘m not scared. Bad code fails as expected. I‘m more worried that many have not understood that display name should be used everywhere with just a few exceptions.

alexpott’s picture

Status: Needs work » Needs review
FileSize
8.71 KB
66.48 KB

Here's a few fixes.

+++ b/core/lib/Drupal/Core/Session/UserSession.php
@@ -175,6 +179,23 @@ public function getDisplayName() {
+  /**
+   * {@inheritdoc}
+   */
+  public function getDisplayNameTruncated() {
+    $display_name = $this->getDisplayName();
+
+    // If $display_name is an instance of MarkupInterface then convert it to
+    // string to truncate it.
+    $name = ($display_name instanceof MarkupInterface) ? $display_name->__toString() : $display_name;
+    if (Unicode::strlen($name) > 20) {
+      $name = Unicode::truncate((string) $name, 15, FALSE, TRUE);
+    }
+    $name = ($display_name instanceof MarkupInterface) ? Markup::create($name) : $name;
+
+    return $name;
+  }

+++ b/core/modules/user/src/Entity/User.php
@@ -387,6 +390,23 @@ public function getDisplayName() {
+  /**
+   * {@inheritdoc}
+   */
+  public function getDisplayNameTruncated() {
+    $display_name = $this->getDisplayName();
+
+    if (mb_strlen($display_name) > 20) {
+      // If $display_name is an instance of MarkupInterface then convert it to
+      // string to truncate it.
+      $markup_object = $display_name instanceof MarkupInterface;
+      $display_name = Unicode::truncate((string) $display_name, 15, FALSE, TRUE);
+      $display_name = $markup_object ? Markup::create($display_name) : $display_name;
+    }
+
+    return $display_name;
+  }

This code needs to be the same. It feels as though UserSession and User should be related in some way there's a lot of duplicate code. But we can open a follow-up discuss that. Also we need to be careful about how we truncated things with HTML in them so let's also remove HTML if we truncate. It also means we can do a correct count.

alexpott’s picture

Removed some of the unneeded changes from test assertion messages.

After reading through the patch I'm not sure that we need the new getDisplayNameTruncated() methods. It looks like we have them for asserts in tests. In HEAD truncation is part of template_preprocess_username() and not on an interface or anything. Obviously the changes in this patch make it so that truncation happens a lot more but the alternative approach would be to add something to the test classes or a UserTestingTrait or something.

The other thing that is interesting about the preprocess function is you have:

  // Set the name to a formatted name that is safe for printing and
  // that won't break tables by being too long. Keep an unshortened,
  // unsanitized version, in case other preprocess functions want to implement
  // their own shortening logic or add markup. If they do so, they must ensure
  // that $variables['name'] is safe for printing.
  $name = $account->getDisplayName();
  $variables['name_raw'] = $account->getAccountName();
  if (mb_strlen($name) > 20) {
    $name = Unicode::truncate($name, 15, FALSE, TRUE);
    $variables['truncated'] = TRUE;
  }
  else {
    $variables['truncated'] = FALSE;
  }
  $variables['name'] = $name;

So name_raw is the username and name is from the display name and might be truncated. It feels like we'd want the untruncated display name.

The last submitted patch, 176: 2629286-175.patch, failed testing. View results

Status: Needs review » Needs work

The last submitted patch, 177: 2629286-177.patch, failed testing. View results

jonathanshaw’s picture

I'm not totally convinced that name listed on the admin users page should be the display name. I think there is a case that admins need the real username that a user logs in with.

I see the case, but I think that it's worse for admin if it's display name everywhere else except here. Consistency seems like the most important thing.

AaronMcHale’s picture

I'm not totally convinced that name listed on the admin users page should be the display name. I think there is a case that admins need the real username that a user logs in with.

I see the case, but I think that it's worse for admin if it's display name everywhere else except here. Consistency seems like the most important thing.

I think as long as the name links to the user's profile then it would be fine to use the display name and I agree that from a consistency point of view we should as it avoids any potential confusion.

I think the only case where we couldn't link to the user's profile is in the account deleted confirmation message but even then showing the display name would be better than the username, because again, it's consistent and so avoids confusion.

alexpott’s picture

I not convinced by the arguments being made about the view to administer users. Not listing the username there feels really odd. This screen is about administering users. Finding them by the guarenteed site unique name feels correct. Say the user display name is being changed to be firstname lastname (which by the way is super tricky to get right - see https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-abou... but anyway) you have 0 zero guarantee that the name you are looking is unique.

alexpott’s picture

Also in Drupal 7 the admin screen didn't use the display name because it was not a view. This feels like an unintended side effect of converting to a view because we didn't have the type of test coverage being suggested here.

alexpott’s picture

#183 I'm wrong. The Drupal 7 code and fallback to the entity list builder in Drupal 8 all use the username theme which all end-up calling template_preprocess_username() so we're always falling back to the display name fwiw. Still not sure about doing that but that change is not part of this issue. It would be great to make this issue only about testing and not doing any fixes. Each bugfix should have its own separate issue to discuss because I don't think this is simple.

jonathanshaw’s picture

It would be great to make this issue only about testing and not doing any fixes.

I suspect it would really help progress here if you could spell out explicitly which hunks should stay in the patch on this issue (or even just make a cut down patch).

If I understand right we'll then work in other child issues, and eventually this issue will spontaneously become green without further patching here?

hass’s picture

@alexpotr: admin/people shows the DisplayName in D7 and not the username.

If admin/people view would show the username in Username column in D8 I'm fine. I can add a views alter in Realname (or core) and add another column with DisplayName field if a display name exists. This would be a working solution to me, too. I was never 100% happy in past with the DisplayName in Username column of admin/people. Often you need both when you administer a site. But this may be one rare exception in the whole system to show the username...

alexpott’s picture

  1. +++ b/core/modules/system/src/Tests/Session/SessionTest.php
    @@ -61,7 +61,7 @@ public function testSessionSaveRegenerate() {
    -    $pass = $this->assertText($user->getAccountName(), format_string('Found name: %name', ['%name' => $user->getAccountName()]), 'User login');
    +    $pass = $this->assertRaw($user->getDisplayName(), format_string('Found name: %name', ['%name' => $user->getDisplayName()]), 'User login');
    

    Given that we're making this change we could remove the format_string() etc... the and use assertEscaped($user->getDisplayName()) the default message is just as good.

  2. +++ b/core/modules/tracker/src/Controller/TrackerUserTab.php
    @@ -22,7 +22,7 @@ public function getContent(UserInterface $user) {
       public function getTitle(UserInterface $user) {
    -    return $user->getAccountName();
    +    return $user->getDisplayName();
       }
    

    This is a functional change - it is correct but it deserves its own bug report and discussion.

  3. +++ b/core/modules/user/src/Controller/UserController.php
    @@ -123,8 +123,8 @@ public function resetPass(Request $request, $uid, $timestamp, $hash) {
    -                '%other_user' => $account->getAccountName(),
    -                '%resetting_user' => $reset_link_user->getAccountName(),
    +                '%other_user' => $account->getDisplayName(),
    +                '%resetting_user' => $reset_link_user->getDisplayName(),
                     ':logout' => $this->url('user.logout'),
    

    This is a functional non-test change - I don't know if it is correct but it deserves its own bug report and discussion.

  4. +++ b/core/modules/user/user.module
    @@ -409,7 +408,7 @@ function user_user_view_alter(array &$build, UserInterface $account, EntityViewD
    -        $item->get('alt')->setValue(\Drupal::translation()->translate('Profile picture for user @username', ['@username' => $account->getAccountName()]));
    +        $item->get('alt')->setValue(\Drupal::translation()->translate('Profile picture for user @username', ['@username' => $account->getDisplayName()]));
    

    This is a functional change - it is correct but it deserves its own bug report and discussion.

  5. +++ b/core/modules/user/user.module
    @@ -1281,7 +1280,7 @@ function user_form_process_password_confirm($element) {
    -      'username' => \Drupal::currentUser()->getAccountName(),
    +      'username' => \Drupal::currentUser()->getDisplayName(),
    

    Your password should not be the same as your username or your display name. So we need to do this in a separate issue.

alexpott’s picture

Status: Needs work » Needs review
FileSize
35.64 KB
52.96 KB

Here's a patch with only test changes. It also changes the alter to not need to be truncated as that is the whole reason for the new getDisplayNameTruncated() is being added - so we don't need that change.

I still have a number of reservations about making the change to always turn on user name altering in the testing profile. For example, In contrib there probably are tests that are doing something similar to the ForumTest to test for double escaping and so doing this might force them to remove the assertion or disable the name altering.

In an ideal world we'd turn this on for core testing and make it really simple for contrib to opt-in and somehow tell contrib to update their tests without breaking them.

Status: Needs review » Needs work

The last submitted patch, 188: 2629286-188.patch, failed testing. View results

alexpott’s picture

Status: Needs work » Needs review
FileSize
9.79 KB
61.75 KB

Patch attached hopefully fixes most of the tests. But I still feel that we cannot just add the test module to the testing profile. The way it breaks the quickstart test shows why we're making too many assumptions. What we need to do is in a functional tests

  • detect whether it is a core test (no going to be super simple because we bascially have to reserve autolaod the test class name)
  • install the module if it is a core test of the test has a flag of $alterUserDisplayName set to TRUE so contrib tests can set this to true to get the same benefits

I also feel that by default we shouldn't have html in the altered name. This adds lots of complexity to the patch which is not really that relevant to the better test coverage.

Plus it would be great if people interested in the this issue could create the real bug issues for what's pointed out in #172 so we can fix and add tests for them. For example the user's tracker page title.

Also I'm not working on this patch for a bit so if anyone feels inspired to try to address the issues in this comment - go for it.

Status: Needs review » Needs work

The last submitted patch, 190: 2629286-190.patch, failed testing. View results

jonathanshaw’s picture

In an ideal world we'd turn this on for core testing and make it really simple for contrib to opt-in and somehow tell contrib to update their tests without breaking them.

What's the roadmap with this?

Most contrib module maintainers are never going to learn/bother with it and so it will stay off for them until it's turned on by default. Which as @hass says hides their bugs from them.

But whenever we turn it on (either at start of D9.x branch or start of a D8 minor release cycle) will cause fails on previously green patches in contrib, which is confusing and disruptive.

alexpott’s picture

But the start of D9 is exactly when we should be making this sort of disruption. A test disruption which has the ability to work for you in the previous 8.x branch is what we should be doing.

jonathanshaw’s picture

Ok, that's clear now.

hass’s picture

I can 100% assure you that core changes have broken my contrib modules test around 8 times in past 3 years. I think we overcomplicate what could happen and how difficult it is to fix. I always fixed the issues without bothering Core maintainers.

I also feel that by default we shouldn't have html in the altered name. This adds lots of complexity to the patch which is not really that relevant to the better test coverage.

I can assure you that there are several places in core that choke when HTML is inside. There are really a number of bugs in core where HTML tags are checkplained only as an example. Something that should not happen, but shows a bug as the input filters are often not correct in views. I tried to put a finger in an open wound and intentionally try to show the broken things.

Well we could open another bunch of issues, but we need a task force to resolve them. Or they are not fixed in 5 years as they all stay in CNR.

TommyChris’s picture

FileSize
72.65 KB

I rerolled the #168 for D8.6.2

TommyChris’s picture

FileSize
70.55 KB

I rerolled the #196 for D8.6.3

hass’s picture

Status: Needs work » Needs review

The last submitted patch, 168: 2629286-168-d861.diff, failed testing. View results

Status: Needs review » Needs work

The last submitted patch, 197: 2629286-197-d863.diff, failed testing. View results

TommyChris’s picture

FileSize
70.33 KB

I rerolled the #197 for D8.6.4

TommyChris’s picture

FileSize
70.42 KB

I rerolled the #202 for D8.6.5

apaderno’s picture

Status: Needs work » Needs review

Status: Needs review » Needs work

The last submitted patch, 202: 2629286-199-d865.diff, failed testing. View results

apaderno’s picture

The patches need to be created for the 8.7.x branch, not for any previous tag (such as 8.6.5 or 8.6.3). If the patch will be applied to previous versions, it will be still applied to branches.

tormi’s picture

Rerolled #190 against the 8.7.x branch.

tormi’s picture

Status: Needs work » Needs review
alexpott’s picture

@TommyChris and @tormi thanks for working on this. What would really really help is

Plus it would be great if people interested in the this issue could create the real bug issues for what's pointed out in #172 so we can fix and add tests for them. For example the user's tracker page title.

Status: Needs review » Needs work

The last submitted patch, 206: 2629286-206.patch, failed testing. View results

Version: 8.7.x-dev » 8.8.x-dev

Drupal 8.7.0-alpha1 will be released the week of March 11, 2019, which means new developments and disruptive changes should now be targeted against the 8.8.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

super_romeo’s picture

#206 Patch Failed to Apply

TommyChris’s picture

FileSize
63.41 KB

I rerolled the #202 for D8.7.8

Berdir’s picture

Status: Needs work » Needs review
FileSize
63.15 KB

basic reroll of the previous patch for 8.8.x but I'm very unsure about the direction here, just like @alexpott. Both introducing new methods and adding this by default to tests.

There is no reason for that html method to be on AccountInterface, we could easily make that a separate utility instead?

IMHO, a patch that just updates the actual code and then we add specific tests for that would have a much bigger chance to get in.

apaderno’s picture

The tests are falling because the following error:

PHP Fatal error: Cannot use Drupal\Component\Render\FormattableMarkup as FormattableMarkup because the name is already in use in /var/www/html/core/modules/simpletest/src/WebTestBase.php on line 31

apaderno’s picture

Should not $display_name->__toString() be replaced by (string) $display_name?

Berdir’s picture

Fixed the duplicated use so that tests can run again.

We actually just have this problem in a client project on the one-time-login-link page but the current page is way too unwieldy to use it. As I said, my suggestion would be to extract only the actual non-test usages, add specific test coverage for that and get that committed, and pushing the other things to a non-major follow-up.

As a start, and for a patch that we can use, I've extracted just the changes in user.module (minus the getDisplayNameTruncated() part) and UserController into an additional patch file, because as far as I see, these are the only non-test changes left here as the tracker.module one has been fixed in a separate issue. Won't work yet for people who also need the html truncating part, but I would actually suggest to move that method to the Unicode class as a new static method, possibly in yet another separate issue.

Berdir’s picture

Looks like for our project, we actually need to fix \Drupal\user\Form\UserPasswordResetForm::buildForm(), which the patch currently doesn't update yet. Since that's not failing, IMHO what the current test aproach is doing is basically testing the tests, but not the actual logic, we do not specific tests for that, otherwise we just assert that tests and actual code use the same method.

The last submitted patch, 216: 2629286-216.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.0-alpha1 will be released the week of October 14th, 2019, which means new developments and disruptive changes should now be targeted against the 8.9.x-dev branch. (Any changes to 8.9.x will also be committed to 9.0.x in preparation for Drupal 9’s release, but some changes like significant feature additions will be deferred to 9.1.x.). For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

dsp1’s picture

it is very annoying this issue is not being taken serious by leadership. having the login username as display name is a security issue.
keeps getting kicked down the road.

Version: 8.9.x-dev » 9.1.x-dev

Drupal 8.9.0-beta1 was released on March 20, 2020. 8.9.x is the final, long-term support (LTS) minor release of Drupal 8, which means new developments and disruptive changes should now be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 9.1.x-dev » 9.2.x-dev

Drupal 9.1.0-alpha1 will be released the week of October 19, 2020, which means new developments and disruptive changes should now be targeted for the 9.2.x-dev branch. For more information see the Drupal 9 minor version schedule and the Allowed changes during the Drupal 9 release cycle.

Version: 9.2.x-dev » 9.3.x-dev

Drupal 9.2.0-alpha1 will be released the week of May 3, 2021, which means new developments and disruptive changes should now be targeted for the 9.3.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.0-rc1 was released on November 26, 2021, which means new developments and disruptive changes should now be targeted for the 9.4.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.0-alpha1 was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.5.x-dev » 10.1.x-dev

Drupal 9.5.0-beta2 and Drupal 10.0.0-beta2 were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

mxr576’s picture

Adding #3241232: [policy] Treat username enumerations as security bugs that require Security Advisories as related because username can be only protected if it is consistently used by Drupal core and contribs.

smustgrave’s picture

Status: Needs review » Needs work
Issue tags: +Needs Review Queue Initiative, +Needs issue summary update

This issue is being reviewed by the kind folks in Slack, #need-reveiw-queue. We are working to keep the size of Needs Review queue [2700+ issues] to around 200, following Review a patch or merge require as a guide.

Sending back to NW for
1. Subsystem maintainer review
2. 10.1 patch
3. IS update. This may not be needed but after 3 years some things may have changed, better safe than sorry.

_utsavsharma’s picture

Tried to address point 2 of #228.
Please review.

_utsavsharma’s picture

Status: Needs work » Needs review
smustgrave’s picture

Status: Needs review » Needs work

I have not reviewed the reroll but sending back for the other things to be addressed

mxr576’s picture

The "raw" username is also exposed in \Drupal\node\NodeForm, so there is definitely more work to be done here.

Berdir’s picture

That's true, and probably makes sense to convert.

> so there is definitely more work to be done here.

We'll need to figure out how to set the scope here, if we aim to replace everything then this issue might never be good enough. Maybe make it a meta so we can commit the improvements we have? We still need test coverage, though. But we have existing tests for display name, so we need to visit those UI's in that/those test(s).

mxr576’s picture

Maybe make it a meta so we can commit the improvements we have?

Maybe this should be converted to a meta...? Because I can already see that several issues are references to this. Like this is an existing "subtask" for "The "raw" username is also exposed in \Drupal\node\NodeForm" in #3183509

AaronMcHale’s picture

Agree, smaller well scoped issues will be much easier to get done, and so converting this to a meta makes a lot of sense. In my experience if one change starts touching multiple different sub-systems that's a good indication that splitting it up will make it easier to scope and get done.

For example, with the recent generic Revision UI, we did the "core" implementation in one issue, then have separate issues for each core module. A similar approach here would probably work well.

Version: 10.1.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch, which currently accepts only minor-version allowed changes. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.