Fixed Change username request without permissions

[daimpa]

Affected version

2.2.1

Hello,
even if I've set to "never" the change permission request for the user group "registered", I've received two username change requests.
How can this be possible?

 

[Mr Lucky]

Something seems wrong as you should not even need never.

What does it show in analyse permissions for a relevant user? (Assuming no addons are affecting this)

 

[daimpa]

Something seems wrong as you should not even need never.

What does it show in analyse permissions for a relevant user? (Assuming no addons are affecting this)

I've something like 0 addons... Analyse permissions seems correct.

 

[beerForo]

Double check what group the users are in. If they are indeed in Registered it could be a bug.

 

[daimpa]

Double check what group the users are in. If they are indeed in Registered it could be a bug.

Yes, only Registered...

 

[Paul B]

Were the requests received before they verified their accounts?

What is the change username permission set to in the unregistered / unconfirmed user group?

 

[daimpa]

Were the requests received before they verified their accounts?

What is the change username permission set to in the unregistered / unconfirmed user group?

Hi Brogan, member is registered from 2015.

But looking at the changelog, I see this:



Setting for Unregistered/unconfirmed:

Maybe that he went in the unconfirmed status when he changed the email address, and used this moment to change the nickname?

 

[daimpa]

But, I've also another username change request, and from the changelog it seems that he didn't changed the email..

 

[ENF]

But, I've also another username change request, and from the changelog it seems that he didn't changed the email..

I ran a few tests on a vanilla XF 2.2.1 install (no addons) and found that... a regular user could not request a name change with the user permissions settings as "No" for the main "Registered" user group.

They could make the change if the account was not in a valid status and the Unregistered/Unconfirmed group was allowed to change their name (Yes).

At least it does not appear to be a bug in the default XF 2.2.1 (and concurrently tested at XF 2.2.9 with same result). I'd suggest creating a test user and reproducing the same conditions to pinpoint where the issue is.

 

[Paul B]

Maybe that he went in the unconfirmed status when he changed the email address, and used this moment to change the nickname?

That is most likely.

 

[XF Bug Bot]

Thank you for reporting this issue, it has now been resolved. We are aiming to include any changes that have been made in a future XF release (2.2.12).

Change log:

Ensure only valid users are able to change their username.

There may be a delay before changes are rolled out to the XenForo Community.