Separate ability to reference blocked users from 'administer users' permission.

+1 on 8.1.7

Moving to right component

Can you provide the exact steps to reproduce and when/how it "fails"?

According to \Drupal\user\Plugin\EntityReferenceSelection\UserSelection::buildEntityQuery(), disabled users are only excluded for non-admins. And \Drupal\user\UserAccessControlHandler::checkAccess() also allows unlimited access with that permission except for the anon user.

Also moving to user.module, as the bug has to be somewhere there I think.

Its not really a bug since we explicitly require a user to have 'administer users' permission in order to reference blocked users. So I'm inverting this issue to a feature request.

\Drupal\user\Plugin\EntityReferenceSelection\UserSelection:

if (!$this->currentUser->hasPermission('administer users')) {
  $query->condition('status', 1);
}

Despite the above comment, I don't necessarily approve this feature request.

Separate permission does make sense in this context because the ability to reference the blocked users does not look like an admin task but then the 'reference blocked users' permission is a very user selection plugin specific. There is a way around that, we can always user hook_query_TAG_alter with EFQ. IMO this is a won't fix.

While not quite the same as this request, I've added #2849620: Add filter option to UserSelection to exclude blocked users.

I've encountered this issue on a project recently. A bunch of users were created for editors to create a whole bunch of content (nodes). Then they left and their user accounts were blocked. Now, when a non-admin wants to edit those nodes, they can't and are prompted with a error message:

This entity (user: id) cannot be referenced.

and the authored by field is outline in red in the node.

Step to reproduce:

1. Create a user with non-admin role
2. Create nodes with that user
3. Block the user
4. A second user (who is non-admin) edits the node and tries to save it.
5. The second user gets a “This entity (user:id) cannot be referenced” error, where the id corresponds to the blocked user that created the node.

Another place where I believe this same issue is coming up... A client has users listed in a directory but some of those users aren't actually able to access the site and to achieve that we blocked their accounts. The knock on effect however is that anyone without administer users (most users) can now no longer see those users when performing a user search.

Unless I'm missing something this would seem to be a bug. If I block a user I'm only saying that user can no longer login, I'm not saying anything about whether or not they can be viewed by other users? Or have I missed something? It certainly doesn't say anything else on the edit user form where you set their status.

I had the same problem as @letrotteur. +1

I have also the same problem as @letrotteur. We're facing this problem on multiple sites.

Experiencing same issue. Workaround on our site is to delete the blocked user from the entity reference field. This is not ideal for business reasons.

Created a simple patch to add a "reference users" permission to replace the "administer users" conditional logic in

/user/Plugin/EntityReferenceSelection/UserSelection.php

Before:

 if (!$this->currentUser->hasPermission('administer users')) {
       $query->condition('status', 1);
     }

After:

if (!$this->currentUser->hasPermission('reference users')) {
       $query->condition('status', 1);
     }

Patch #27 works for me.

Updating the patch @ #27 to include administer users permission as well.

The previous patch has a typo. Uploading new patch.

I tested this again, but there is no error anymore. Should we close it as outdated?

The "This entity (user: id) cannot be referenced." error described in #13 is no longer reproducible in Drupal 11(11.0-dev). However, the original issue ('Users without 'administer users' permission not able to reference blocked users in entity autocomplete form') is still reproducible. That issue is being discussed in #2849620: Add filter option to UserSelection to exclude blocked users, so I am closing this issue as a duplicate.