Users without 'Delete users' permission can delete themselves #8834
Replies: 9 comments
-
It's expected behaviour: |
Beta Was this translation helpful? Give feedback.
-
It’s expected behavior. |
Beta Was this translation helpful? Give feedback.
-
Just out of curiosity... Why is it preferable for Users to be able to delete themselves, even if they don't have Delete User permission? |
Beta Was this translation helpful? Give feedback.
-
I swear there's an amendment for that... Sorry. I'll show myself out. |
Beta Was this translation helpful? Give feedback.
-
Because it’s their own account, they can do what they want with it. |
Beta Was this translation helpful? Give feedback.
-
What about situations where deleting a User could cause a rippling deletion of other content? By deleting themselves, a User could accidentally break site functionality, expunge necessary records, etc. (Theoretically, they could even do this from the front-end by sending a properly formed request, without any explicit UI provided.) |
Beta Was this translation helpful? Give feedback.
-
That’s a risk, yeah. I’ll go ahead and reopen and label this as an enhancement request, for a new user permission. |
Beta Was this translation helpful? Give feedback.
-
Another potential issue which I don't think is covered is an admin deleting themselves if they are the last admin. |
Beta Was this translation helpful? Give feedback.
-
Avatar II: The Last Admin |
Beta Was this translation helpful? Give feedback.
-
Description
Users who do not have the 'delete users' permission can delete themselves. I'm not sure if theis is a bug or feature. A new 'can delete self' permission might be required.
Steps to reproduce
Additional info
Beta Was this translation helpful? Give feedback.
All reactions