950019 - Administrators should not see profile management buttons on other profiles belonging to other people

Status: RESOLVED FIXED

(developer.mozilla.org Graveyard :: Design, defect, P2)

Description

[Jean-Yves Perrier [:teoli]]

Attachment: Screen Shot 2013-12-13 at 14.08.29.png

Go to someone's else MDN Profile page (Here SJW insetad of teoli).

There are buttons for: "Manage API Keys", "Edit profile" and "Submit a demo" that will not apply to this user (as I'm a different user).

They should appear on my own profile, but not on someone's else profile.

Comment 1

[David Walsh :davidwalsh]

Interesting.  FYI, you can only see that because you're an admin (who can edit other profiles) -- we don't have a massive security hole for all users.

Comment 2

[Jean-Yves Perrier [:teoli]]

Note that the e-mail address that appear when trying to edit another profile is mine which is strange.

Comment 3

[John Karahalis [:openjck]]

Jean-Yves, do you still think we should change this behavior, even for administrators?

Comment 4

[Jean-Yves Perrier [:teoli]]

I think the behavior should be the following:

On another person profile, when NOT administrator.
'Submit Demo' — should not be shown
'Manage API Keys' — should not be shown
'Edit Profile' — should not be shown
'Ban User' — should not be shown.

On another person profile, when administrator.
'Submit Demo' — should not be shown (we cannot submit a demo for the other person anyway)
'Manage API Keys' — should not be shown (these are _my_ keys not the other person keys)
'Edit Profile' — should be shown (but see *)
'Ban User' — should be shown

*: the edit profile for another account is strange. The e-mail address is mine and not the one of the other user. The 'change' link next to it go to a persona page that clearly apply to my account.

So we should: 1) See the other user e-mail
2) Have a change link next to it only if the administrator can change the e-mail by following it.

Comment 5

[[github robot]]

Commits pushed to master at https://github.com/mozilla/kuma

https://github.com/mozilla/kuma/commit/3a9378ead05853196e112dd3e1cd63aa6f6b0f1a
fix bug 950019 - Hide management commands from admins

https://github.com/mozilla/kuma/commit/2036c8d9cd2b53420649defd739cf547c2073dea
Merge pull request #2146 from darkwing/profile-management-950019

fix bug 950019 - Hide management commands from admins