Users without 'Delete users' permission can delete themselves

[leevigraham]

Description

Users who do not have the 'delete users' permission can delete themselves. I'm not sure if theis is a bug or feature. A new 'can delete self' permission might be required.

Steps to reproduce

1. Create a new user
2. Login as user
3. Delete user from 'my account'

Additional info

• Craft version: 3.5.beta.2
• PHP version:
• Database driver & version:
• Plugins & versions:

[leevigraham]

It's expected behaviour:

[brandonkelly]

It’s expected behavior.

[michaelrog]

Just out of curiosity... Why is it preferable for Users to be able to delete themselves, even if they don't have Delete User permission?

[andris-sevcenko]

Just out of curiosity... Why is it preferable for Users to be able to delete themselves, even if they don't have Delete User permission?

I swear there's an amendment for that...

Sorry. I'll show myself out.

[brandonkelly]

Because it’s their own account, they can do what they want with it.

[michaelrog]

What about situations where deleting a User could cause a rippling deletion of other content? By deleting themselves, a User could accidentally break site functionality, expunge necessary records, etc. (Theoretically, they could even do this from the front-end by sending a properly formed request, without any explicit UI provided.)

[brandonkelly]

That’s a risk, yeah. I’ll go ahead and reopen and label this as an enhancement request, for a new user permission.

[leevigraham]

What about situations where deleting a User could cause a rippling deletion of other content? By deleting themselves, a User could accidentally break site functionality, expunge necessary records, etc. (Theoretically, they could even do this from the front-end by sending a properly formed request, without any explicit UI provided.)

Another potential issue which I don't think is covered is an admin deleting themselves if they are the last admin.

[michaelrog]

Avatar II: The Last Admin