Roles being stripped from users when saved

Unexpected role changes are a major issue, especially if you do not notice this change. Updating priority.

I am going to jump on the me too boat here, but mine might be a different use case. We are actually seeing any users with the `assign XXX role` permission lose all their roles upon logging in. We do have simplesamlphp_auth, which I believe saves the user on each login.

The only odd thing is, about a year+ ago when we first updated the module, we found if we cleared the cache and regranted users the deleted roles they would keep them for a period of time until they got removed again. We were updating to 9.4 and bumped all modules and could not reproduce in dev, so we only updated what was needed. We found that we needed a certain amount of user traffic logging in before it would remove the roles. I assumed it might have been a memcache issue or something in Simplesamlphp_auth.

Patch from #3263782-12: Roles being stripped from users when saved → still works well.

Hmm actually neither of these work properly it seems:

• Patch in #12 does not actually allow any changes to be made as it just re-pulls the roles from the user entity ignoring any form submission
• MR 3263782-roles-being-stripped does not consider cases where there are multiple form modes, so if a form mode for the user does not contain the role field, yet the user has access to the role delegation permission, it removes the roles

So I created 3263782-roles-being-stripped-request-check which just adds a check that the current presave is triggered by a form that has the role change in the request. If it is missing, the change to roles is skipped and roles are left as is. The checks for what roles the user is allowed to change are untouched.

scott_euser → changed the visibility of the branch 3263782-roles-being-stripped to hidden.

Hid the other two for now, but feel free to unhide if you disagree. Setting to NR

Can this and 🐛 Roles being stripped from users when saved if user has no access to roles field Needs work be combined? They look like duplicate issues.

Aha good spot, yep duplicate

Thanks! I think the solution over there is a little cleaner too.