Drupal Usability Meeting 2023-05-05

The group is actively tracking progress on:

• 🌱 [meta] Reorganize Block items in the administration menu Active

Issues brought forward from the previous meeting:

• ✨ [Meta] Appearance page is too long and confusing Active
• 📌 [PP-3] Figure out what to do with the install/uninstall modules page Postponed with notes:
  • #3307567: Drupal Usability Meeting 2022-09-09 → : started discussing the proposed options but ran out of time, possibly splitting the confirm form into its own issue (we may want to look at that for both modules and themes, standard pattern, consider implications of project browser), worth considering parity with Drush (and other extension/package managers).
  • #3310096: Drupal Usability Meeting 2022-09-23 → : @simohell presented the various proposals, but we again ran out of time to have a in-depth discussion, using the drop-button pattern on the module page for the existing links + Uninstall was suggested.
• 🐛 Placement of batch progress messages Active with notes:
  • #3322499: Drupal Usability Meeting 2022-11-25 → : We started looking at the issue but ran out of time.
• ✨ Allow media items to be edited in a modal when using the field widget Postponed with notes:
  • @AaronMcHale: Issue could use some guidance.
    In comment #109 the issue was marked as postponed for needing input from UX, accessibility and media initiative. Apparently there are some outstanding UX/accessibility questions (but I'm not sure what they are). This was echoed in comment #111.
    Comment #144 is asking what is needed to move the issue along (the postponed state seems to be causing some delays/confusion as to how to proceed).
    Perhaps we can at least take a look at what the issue is doing and provide some recommendations/guidance on how it could be implemented.
• ✨ Allow blocks to be configured to show/hide on 200/403/404 response pages Fixed : see comment #3335028-6: Drupal Usability Meeting 2023-01-27 → for more details on what a review should address.
• 🐛 Password suggestions are hidden from screenreaders Active
• 🌱 [Policy] Remove tour module from core Fixed with notes:
  • @xjm tagged for review and sign off from the usability group before it can go ahead, noting that Tour is seen as a usability module and the core committers were not able to reach a consensus.
• 📌 Creating a new workspace should also switch to it Needs work
• 📌 Content translation overview should add destination query parameter Needs work raised in Slack by @smustgrave
• ✨ Provide Drupal root path on file system admin form Needs work
• 📌 Improve search settings help text Fixed
• 📌 Add image preload option to help boost actual and perceived performance Needs work
• 🐛 UX: Hide entity ID in autocomplete widget Needs work
• 🐛 Wrong message on cancelling account with e-mail confirmation request Needs work with notes:
  • Reviewed at #3244123: Drupal Usability Meeting 2021-10-22 → and we made a recommendation (in comment #13), but there was a good point made in comment #17 so in #18 I tagged it again for review.
• 📌 Remove "Please" from the codebase Fixed

I would like to discuss the changes to password hashing in Drupal 10.1.0. I fear that some site owners will find themselves locked out of their sites.

From Slack (private channel):

I am ... worried about ... a site administrator who

• uninstalls phpass for whatever reason
• uninstalls it from a config import
• neglects to execute database updates

Or maybe

• Some update function throws an exception and phpass is never enabled.

References:

1. Password Compatibility module → (new core module)
2. Password hashing was changed → (change record)
3. 📌 Notify users that they need to reset their password when it matches an unsupported hash type Active

Follow-up to #3: here is another scenario.

As a site admin, I check the available updates. I see that 10.1.0 has been released and I decide to upgrade the next day. I log out and get a good night's sleep.

The next day, I update the code and log in so that I can run updates ... except that my password is rejected.

Possible solutions:

1. Get a one-time login link from Drush or the UI.
2. Set $settings['update_free_access'] in settings.php.
3. Downgrade to 10.0.9.

Are there other options? How do we communicate them?

Added comment to 📌 Remove "Please" from the codebase Fixed and referenced 🐛 Fix incorrect message after resetting password Needs review .

Need to add list of participants to the comment.

benjifisher → credited simohell → .

I am adding a link to the recording and a rough transcript. I am also adding a link to 🐛 Users cannot log in if Password Compatibility module is not enabled Fixed , which I created after the meeting. I am adding credits to this issue.

We previously linked to the other issues we discussed, and AaronMcHale commented on those issues.

This issue is done.

benjifisher → credited rkoller → .

Automatically closed - issue fixed for 2 weeks with no activity.

Added participants list to comment on 🐛 Fix incorrect message after resetting password Needs review .