DDEV is the official local development tool of Drupal. And like Drupal, DDEV depends on the support of the open source community.Problem/Motivation
The permission to see a user's profile is labeled "View user information." This is misleading, the label should reflect the permissions being granted which in this case is "Access Any User Profile."
The phrase "View user information" implies that those words are used to describe user data somewhere, and that is not the case. It was entirely unclear to me what data this permission allowed a user to view until I viewed the user.permissions.yml file.
The related issue says this change was to prevent confusion around contrib profile modules. I think renaming core labels to reduce confusion with contrib modules is a bad precedence. The responsibility should fall on contrib to not introduce confusion, rather than on core to change.
Steps to reproduce
Install Drupal, look at /admin/people/permissions and the label "View user information"
Proposed resolution
Rename the label for this permission to the more accurate "Access Any User Profile" or "View user profiles"
Add a description to this permission clarifying that this gives access only to viewing the Drupal user entity. And that users without this permission will not be able to access the users profile provided by the core profiles module.
Remaining tasks
Change line 13 on user.permissions.yml to the new label language. https://git.drupalcode.org/project/drupal/-/blob/10.3.x/core/modules/use...
User interface changes
The label for the "access user profiles" permission changes to a less misleading phrase more aligned with the permissions being granted.
API changes
Data model changes
Release notes snippet
Issue fork drupal-3427427
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
changes
Comments
Comment #2
cilefen CreditAttribution: cilefen commentedThanks to
git log -Sthere is a pointer to the original issue, which is #658148: The "access user profiles" permission is poorly named. Have the conditions that led to the current naming changed? It has been fifteen years.Comment #5
sandeep sanwale CreditAttribution: sandeep sanwale at OpenSense Labs for DrupalFit commentedchanged the label of access user profiles from View user information to access user profiles in user.permissions.yml .
Comment #6
smustgrave CreditAttribution: smustgrave at Mobomo commentedHas test failures.
Comment #7
cilefen CreditAttribution: cilefen commentedThe issue summary must be edited to include why this reversal of a prior decision is appropriate.
Comment #8
jhuebsch CreditAttribution: jhuebsch commentedI have updated the Issue summary with a response to the related issue as well as an alternative proposed resolution of including a description for this permission.
Comment #9
jhuebsch CreditAttribution: jhuebsch commentedComment #10
sandeep sanwale CreditAttribution: sandeep sanwale at OpenSense Labs for DrupalFit commentedI have added the description for the Access User Profiles permission . please review this .
Comment #11
smustgrave CreditAttribution: smustgrave at Mobomo commentedNow the solution goes against the issue summary. Proposed solution should match
Comment #13
binoli lalani CreditAttribution: binoli lalani at QED42 for Drupal India Association commentedHello,
I updated the permission description as per Proposed resolution and fixed unit testcase errors. Please review latest commit.
Thank you
Comment #14
smustgrave CreditAttribution: smustgrave at Mobomo commentedLeft a comment but if read out loud doesn't sound correct. "With this permission can do this. And without this permission you can't do this" is kinda how I'm reading this. Left a comment
Still appears to have test failures.
Comment #15
demonde CreditAttribution: demonde commentedIt would be better to call this "Access Any User Profile" instead of "Access User Profiles", so it is clear this does not mean that users can access their own profile.
Comment #17
sakthi_dev CreditAttribution: sakthi_dev at Specbee for Drupal India Association commentedUpdated the title/name of the permission. Also updated the IS.
Comment #19
quietone CreditAttribution: quietone at PreviousNext commentedChanges are made on on 11.x (our main development branch) first, and are then back ported as needed according to our policies.
Comment #20
niranjan_panem CreditAttribution: niranjan_panem at Material commentedView user information:
This is a direct and clear statement about accessing data. It implies a reading or looking at the information, not necessarily manipulating it.
Access any user profile:
This phrase is broader. It could refer to viewing the profile, but it could also imply editing, modifying, or taking other actions within the profile.