Administrator users that don't have the "change own username" permission checked, can change their own username.

To replicate this bug, make a new role entitled "Administrator". Create a new user of this role. In the access control, check "administer users" checkbox, and make sure the "change own username" is not checked. Click save and log in as your new user.

Edit your account and you'll see that you can change your own username, even though you don't have the permission to. This could be considered a bug.

Comments

robloach’s picture

robloach
he/him
commented
Version: 5.x-dev » 6.x-dev

Moving to 6.

ericg’s picture

ericg commented

I do not consider this a bug.

Being able to change a user's username is an explicit part of being able to administer users.

What you're asking for is to give someone the ability to administer all users but their own user account. something I don't see as being a common need amongst drupal sites/users.

If you are giving user admin power to someone and you don't want them to change their own name, I'd hope that could be done by simply having a policy that admin users don't change their own names. I would assume that anyone given admin user rights is highly trusted and this is not an issue.

webernet’s picture

webernet commented
Status: Active » Closed (won't fix)

Administer users grants all user permissions. Same as administer content does with content.