Loris: [User account] I am able to edit my own 'Pending Approval' status

[nicolasbrossard]

As the title says. This does not really make sense...You should only be able to edit another user's 'Pending Approval' or 'Active' status IMHO.

[driusan]

How would you log in in order to edit your Pending Approval flag if your account was pending?

[nicolasbrossard]

@driusan What I am saying is that (provided your account has been approved) you can log in, go into 'My Preferences' and set your 'Pending Approval' status to 'Yes'. When you log out, you won't be able to log back in...

[driusan]

That makes sense, then.. it's less severe than I thought since it's not a privilege escalation

[ridz1208]

@nicolasbrossard I think they call that natural selection

[nicolasbrossard]

@ridz1208 LOL!!! Indeed :)

[nicolasbrossard]

@driusan So I got your OK to remove the 'Pending Approval' section from the 'My preferences' page?

[driusan]

Wait, this is in My Preferences or this is in edit account when accessing your own account? If My Preferences, definitely, I don't know why it would be there in the first place..

[nicolasbrossard]

@driusan This is in 'My Preferences'. I think that section should not be there so as to protect people from LORIS suicide. I think we should also disable that section on the edit user page when someone is editing his/her own user account. Agreed?

[driusan]

I definitely think "My account is approved" isn't a preference, so go ahead and remove it from there. We should probably eventually remove it from the edit_user page of your own account, but I think doing so now adds unnecessary complexity for a bug that's not critical or likely to happen in reality (and has existed this long without being triggered to the best of our knowledge), so maybe wait until after the release and do that in a minor release

[nicolasbrossard]

@driusan My bad: the 'Pending Approval' is not on 'My Preferences'. So no fix to do on that page. Since you want me to punt the fix for the edit user page to another release, should I remove the '21.0.0 testing' label?

[driusan]

yeah, I just removed it.