#22121 closed defect (bug) (fixed)
Toolbar: username vs user_nicename in My Account dropdown
| Reported by: |
|
Owned by: |
|
|---|---|---|---|
| Priority: | normal | Milestone: | 3.6 |
| Component: | Toolbar | Version: | 3.4 |
| Severity: | normal | Keywords: | has-patch commit |
| Cc: | juliobosk@… |
Description
Per a discussion in the forums, there is some confusion about the presentation of user_nicename in the My Account Toolbar menu, specifically in the context of email address-like usernames. As it is now, the Display Name is in bold with the nicename below. See here: http://cl.ly/image/2y423k441F0j
Either:
A) The span class of username is incorrect because we're displaying the user_nicename (and you can't login with the nicename)
B) The span class is correct and we should be displaying the username.
Attachments (1)
Change History (8)
SergeyBiryukov — 8 months ago
comment:1
SergeyBiryukov — 8 months ago
- Component changed from General to Toolbar
- Keywords has-patch added
comment:2
SergeyBiryukov — 5 months ago
- Milestone changed from Awaiting Review to 3.6
comment:3
SergeyBiryukov — 4 months ago
- Keywords commit added; 2nd-opinion removed
comment:4
SergeyBiryukov — 4 months ago
- Owner set to SergeyBiryukov
- Resolution set to fixed
- Status changed from new to closed
In 23360:
- Cc juliobosk@… added
I do not agree with this decision. Most of people take screenshots to show something on a plugin setting page, on dashboard, to explain some problem, to illustrate a tutorial.
So, now we will see their login ? Wow, strange and not secure.
Can we discuss about this ?
comment:6
in reply to:
↑ 5
SergeyBiryukov — 4 months ago
Replying to juliobox:
So, now we will see their login ?
Only if they open the "My Account" menu when taking a screenshot: http://cl.ly/image/2y423k441F0j.
Wow, strange and not secure.
user_nicename is a URL-friendly version of the username. Most of the time they are the same anyway, so I don't think displaying user_nicename was more secure. It just make less sense outside of URL context. Moreover, we don't consider this information disclosure, see #3708.

Introduced in [18776]. I guess it should be username there.