I'm trying to delete an account as a non admin user without sending a confirm e-mail to the target user. Though there is no setting in the general account form, there is one in user.settings.yml called cancel_confirm. Unfortunately this setting has no effect. I'm not able to delete the account without a confirm e-mail.

What are the steps required to reproduce the bug?
1. Update user.settings.yml and set cancel_confirm to false

notify:
  cancel_confirm: false

2. Import the configuration.
3. Try to cancel an account as a non admin user.

What behavior were you expecting?
The account should be deleted/canceled immediately without a confirmation by the target user.

What happened instead?
Confirmation e-mail has been send and the account has not been deleted or disabled.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

pminf created an issue. See original summary.

sourabh.singhal’s picture

Hi pminf,

I am not sure why you are going for this settings through code as I can already reproduce the exact scenario through UI:
I have created a user with some role other than admin. I have provided that role all the permissions required to delete users from site.
I logged in with that user and go to "admin/people" page, here I have selected a random user to cancel the account, after that I have selected "Cancel the selected user account(s)" from the drop down select list, click on apply button.
I am redirected to a page where I have multiple options related to user account cancellation and there I got the option to select whether required to send mail confirmation or not.

Here I got this option and it works as expected, If I am not on right track please provide exact scenario for the same.

Thanks
Sourdrup

prash_98’s picture

So I guess this may not be a issue if the above steps are followed through the UI right ?
Am I right or do we need to reproduce the bug? Please suggest.

sourabh.singhal’s picture

Yes prash_98, this is not an issue, if you followed the steps mentioned in my above comment #2.

prash_98’s picture

So we could close this issue right?

pminf’s picture

Please do not close this ticket. I will have a closer look and check if sourdrup's scenario differs from mine. I will reply soon.

prash_98’s picture

Ok .

pminf’s picture

@sourdrup: You are right with your conclusion, that you only need the permission "administer users" to be able to choose if the user should be notified. But if you don't have this permission, but are able to delete an account (e.g. with module Administer Users by Role), the default setting should be used (analog to account canceled notification mail). Unfortunately setting user.settings > notify.cancel_confirm to false has no effect.

This patch should fix that.

pminf’s picture

Munavijayalakshmi’s picture

Assigned: Unassigned » Munavijayalakshmi
Status: Needs review » Needs work
+++ b/core/modules/user/src/Form/UserCancelForm.php
@@ -82,14 +82,15 @@ public function buildForm(array $form, FormStateInterface $form_state) {
+    // mail (by default) if enabled, as long as they do not attempt to cancel their own

Line exceeding 80 characters

Munavijayalakshmi’s picture

Assigned: Munavijayalakshmi » Unassigned
Status: Needs work » Needs review
FileSize
1.36 KB
781 bytes

Version: 8.4.x-dev » 8.5.x-dev

Drupal 8.4.0-alpha1 will be released the week of July 31, 2017, which means new developments and disruptive changes should now be targeted against the 8.5.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.5.x-dev » 8.6.x-dev

Drupal 8.5.0-alpha1 will be released the week of January 17, 2018, which means new developments and disruptive changes should now be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.6.x-dev » 8.7.x-dev

Drupal 8.6.0-alpha1 will be released the week of July 16, 2018, which means new developments and disruptive changes should now be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Peter Majmesku’s picture

Hi,

I could reproduce #1. May I clarify the steps to reproduce that issue a bit.

1., Give authenticated users the permission "Cancel own user account"
2., Afterwards login as an authenticated user (no admin privileges)
3., Then cancel the account via submitting the form at /user/USER-ID/cancel
4., Result: your authenticated user will receive a confirmation email to cancel the account

Then I changed the config setting in file config/sync/user.settings.yml:

From

notify:
  cancel_confirm: true

To

notify:
  cancel_confirm: false

Then I have imported the configuration. Afterwards I tried to cancel my account as an authenticated user again. Result: The confirmation email was NOT sent and I got a message, that the confirmation mail has been sent. What is wrong. So I am waiting for a confirmation email, which will never be send.

Instead the account should be deleted immediately, if cancel_confirm is set to false.

Peter Majmesku’s picture

Status: Needs review » Needs work
pminf’s picture

Status: Needs work » Closed (outdated)

This issue has been partly solved by https://www.drupal.org/project/drupal/issues/2854252. You are now able to choose if a confirm e-mail should be send without having the permission "administer users".

@peter-majmesku: The option for cancel notification is only available if it's not your own account. I think this is OK to prevent accidentally deletion of your own account.

But there still exists a user setting named notify.cancel_confirm which is has no effect at all. I opened a follow up issue (https://www.drupal.org/project/drupal/issues/3028634) and close this one here.

pminf’s picture

Status: Closed (outdated) » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.