User can ban themselves with actions in Drupal 8

in vienna working on this one

I reproduced this one - blocked myself as administrator, and could not log back in (drush user-unblock solved it)
i guess the best (and easiest) solution is to stop ANY user from blocking themselves

I'm at DrupalCon Vienna, reviewing this now

@jholding I'm a first time sprinter, mind if I tag along? :)

Having to jump out of this, currently deep into another issue.

Feel free @joum, I'm a first time sprinter too :)

did a new patch - forgot to delete some dev code

Looks good to me.

Interesting! First of all if you can edit your account, you may be able to individually ban yourself there.

I think you meant this as a mass-ban side effect? I am not sure this is the right way to solve that problem. The action may be wired into some moderation flow which explicitly intends to block the user in question. Making that output a message to the end user that they cannot block themselves (when they did not even intend to run an action like this) could be odd. So it would be nice to get some feedback if this was an "intentional feature" or not.

Other than that displaying a message may also be a problem if the action is run programmatically, because that request will emit the message but nothing will be logged.

Finally, if just looking at the code as-is, there are a few code style issues:

1. +++ b/core/modules/user/src/Plugin/Action/BlockUser.php
   @@ -18,15 +18,23 @@ class BlockUser extends ActionBase {
       * {@inheritdoc}
   +   *
   

   Extra line should not be added.

2. +++ b/core/modules/user/src/Plugin/Action/BlockUser.php
   @@ -18,15 +18,23 @@ class BlockUser extends ActionBase {
   +      if($account->id() === \Drupal::currentUser()->id()) {
   

   Code style requires this to have a space after "if".

3. +++ b/core/modules/user/src/Plugin/Action/BlockUser.php
   @@ -18,15 +18,23 @@ class BlockUser extends ActionBase {
   +        drupal_set_message(t('You may not block your own account'),'warning');
   

   $this->t() is available on this class already. Also code style dictates a space after the comma.

Ps. I also updated the issue title. You are not dealing with Drupal 7 here for example.

Solved suggested code style issue in the current code here. Patch and interdiff attached.

Actually a user can cancel their own account. It prevents deleting user 1 but any other administrator can cancel their own account. In order to do this it will send you an email where you have to click on a link for it to work. And there is a problem because not all accounts have email addresses - and in this instance cancelling does not work but that is a separate bug. I'm not sure the issue outlined in the issue summary is actually a bug at all. There are valid use cases for blocking user 1 and preventing log in as that user. It is one of the simplest ways of making your site more secure.

      case 'delete':
        // Users with 'cancel account' permission can cancel their own account.
        return AccessResult::allowedIf($account->id() == $entity->id() && $account->hasPermission('cancel account'))->cachePerPermissions()->cachePerUser();

From core/modules/user/src/UserAccessControlHandler.php

As for the disgruntled employee issue - the issue here is with the company's security policies - if they've granted someone that level access then they need to be aware of that and rescind it if they feel that that authority is likely to be abused.

So is that closed works as designed on the basis of #14?

@TheKLF99, thanks for bringing up this issue.

I have read the issue and agree with #13.

Cheers,