dev/core#3467 - Drupal 8 - Skip requirement for password when changing your own civi contact's email

[CsarRamos]

Overview

Modifying your own email from civi does not modify it in drupal, but you can modify any email of any contact and its sync fine. It works fine in D7.

This is happening in both Drupal 8 and 9.

I found this validation when contact is updated and Symfony throws the error:

Your current password is missing or incorrect; it's required to change the %name.

Source: https://github.com/civicrm/civicrm-core/blob/5.45.1/CRM/Utils/System/Drupal8.php#L117

Before

The logged in user cannot update his own email in drupal from CiviCRM.

After

The logged in user can update his own email in drupal from CiviCRM.

Technical Details

I found this parameter $user->_skipProtectedUserFieldConstraint = TRUE; that allows to skip the validation or at least does not ask for the password, I have doubts if this can cause any unwanted behavior.

Comments

issue: https://lab.civicrm.org/dev/core/-/issues/3467

Tested with D9 with CiviCRM 5.45

Thanks!

[civibot]

(Standard links)

• If this is your first pull-request for CiviCRM, please browse CONTRIBUTING.md for information about the development and testing processes.
• If you are reviewing this pull-request, you may wish to consult the test sites and the Review Standards (long template, short template).

[demeritcowboy]

This seems ok I'm just a little confused how it allows changing other emails without requiring a password but then needs a password for your own account, so just want to take a closer look at that.

The way the form works even just on the drupal side without civi is weird this way - if you have administer users you can change other users' emails but it wants a password for your own. So maybe this is just a drupal weirdness.

[demeritcowboy]

This seems fine just the code comment is describing the opposite of what it's doing - @CsarRamos are you able to update the comment to something like "skip requirement for password when changing the current user fields"?

[CsarRamos]

This seems fine just the code comment is describing the opposite of what it's doing - @CsarRamos are you able to update the comment to something like "skip requirement for password when changing the current user fields"?

Done! thanks for your help.

[demeritcowboy]

Great, thanks!