User reference fields can reference anonymous users even when they are configured not to

Created on 6 April 2016, about 8 years ago
Updated 19 July 2023, 12 months ago

When configuring an entity reference field for users, you can choose to disallow anonymous user selection. However, this only works when providing the list of autocomplete values, but is completely ignored during validation. It seems that this bug even allows you to bypass the "required" flag of the field.

You can see this bug by:

  1. Using any user reference field with the autocomplete widget
  2. Configuring it to disallow anonymous users
  3. Manually typing in "Anonymous (0)" or really "Anything foo bar (0)", as long as it ends with "(0)"
  4. Saving the content

Expected behavior:
The entity reference autocomplete widget should throw a validation error saying "Foo bar (0)" is invalid, just like it would with "Foo bar".

When showing radio buttons, people with 'administer users' are shown Anonymous as an option because of some logic in UserSelection not setting any condition and thus selecting all users (including UID 0) from the {users} table.

πŸ› Bug report
Status

Needs work

Version

11.0 πŸ”₯

Component
EntityΒ  β†’

Last updated about 20 hours ago

Created by

πŸ‡§πŸ‡ͺBelgium kristiaanvandeneynde Antwerp, Belgium

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.69.0 2024