User account form has inaccurate descriptions for username and email

[swampopus]

Description of the bug

On the user_account_form() in user.module, the hard-coded descriptions for "name" and "mail" are inaccurate or misleading.

• The "name" field claims the only punctuation you can have is space, period, hyphen, apostrophe, and underscore. In fact, you can also have @ and +.

• The email address description states that the email address will not be made public and will only be used for new passwords or to receive news & notifications by mail. We can't really promise this, because who knows how the site will be used.

Steps To Reproduce

To reproduce the behavior:

1. Go to User Accounts -> Add new user

Expected behavior

I think the username description should simply state what is allowed.
Ex:

Username *
[____________________]
Letters, numbers, spaces, and certain symbols allowed (@+.-_).

The email address field doesn't really need any description at all.
Ex:

Email address *
[________________________________________]

Additional information

• Backdrop CMS version: 1.34.3

[avpaderno]

The email address is not made public means the value of the email address entity field is not shown on user profile pages. That is correct for a plain Backdrop installation. People with the administer users permissions can see email addresses associated with accounts when they edit accounts, but that should not count as making an email address public.

only be used if you wish to receive a new password or wish to receive certain news or notifications by email is true for a plain Backdrop installation. If there is a module which, for example, makes an email address visible to everybody, that module should change the description given for that form element.

[avpaderno]

The description for the username says punctuation is not allowed except for periods, hyphens, apostrophes, and underscores. It is saying which punctuation is allowed, not all the characters that are allowed. As such, that part is correct.

The description for the username is kept short on purpose, I think. It does not say that a username cannot start with a space, cannot end with a space, cannot contain multiple spaces in a row, cannot contain characters matching /[^\x{80}-\x{F7} a-z0-9@+_.\'-]/i nor other characters which match another regular expression, or even that there is a length limit for the username. (All those restrictions are applied from user_validate_name().)

[avpaderno]

The Email address form element should have a description which at least says in which cases the email address is used.
What the description does not say is that the email address can be used by user administrators when they need to contact the person who has access to the account, whenever that is done as requested by that person or not.

[avpaderno]

Drupal 11 uses the following descriptions, for email address and username form elements.

The email address is not made public. It will only be used if you need to be contacted about your account or for opted-in notifications.

Several special characters are allowed, including space, period (.), hyphen (-), apostrophe ('), underscore (_), and the @ sign.

The first description is more generic; you need to be contacted about your account could mean the person using the account forgot the password and clicked on the link to get a password reset, but also that an admin needs to contact that person because a comment posted using that account, for example.

The second description should make clearer that the list of allowed special characters is not exhaustive; it also explicitly says that the @ sign is allowed.
I am not sure I would use Several special characters are allowed instead of Several characters are allowed; special in this case could be misunderstood, or there could be different opinions about what a special character in a username is. I would probably use the following description.

Several characters are allowed, including space, period (.), hyphen (-), apostrophe ('), underscore (_), the + sign, and the @ sign.

[swampopus]

The Email address form element should have a description which at least says in which cases the email address is used.

When I sign up for most other sites (eg: github, linode, pizzahut, bestbuy to name some random sites I just tried) the email field doesn't have any kind of description. I think most people don't need to be reassured about email usage in a hard-coded string. A privacy policy is usually what I see linked somewhere on the signup page.

...only be used if you wish to receive a new password or wish to receive certain news or notifications by email is true for a plain Backdrop installation...

Is it though? Average users don't receive "news" about the plain backdrop site. Admins might if they turn that on. And even if it's true for the "plain" Backdrop installation, it seems weird that we're hard-coding privacy promises into the user form. Just showing nothing is cleaner and doesn't potentially make any false or misleading statements.

If leaving off the description is too dramatic, then I'd argue it should be a config setting that's easily changed from the UI. But again, I think it just isn't necessary

username....

I could also see just leaving off any description of username too. I mean, you get a validation error if you do enter something that's not allowed. And at this point, I think most people generally understand what's allowed in a username.

[swampopus]

The description for the username says punctuation is not allowed except for periods, hyphens, apostrophes, and underscores. It is saying which punctuation is allowed, not all the characters that are allowed. As such, that part is correct.

If we're going to be pedantic, an underscore is not technically "punctuation".

[avpaderno]

I am strict on what I call punctuation but, apparently, punctuation mark includes more characters than I would include. That does not change that the subject in punctuation is not allowed except for periods, hyphens, apostrophes, and underscores is punctuaction, so that phrase cannot be understood as the only allowed characters are [list of allowed characters].

Anyway, that can be easily resolved by avoiding to use punctuation in that phrase, in a phrase similar to the one used in Drupal 11, for example.

[swampopus]

Well, that's why I created this issue-- I'm curious for others to weigh in on their thoughts. My vote: get rid of both descriptions.

[olafgrabienski]

I'm curious for others to weigh in on their thoughts. My vote: get rid of both descriptions.

The idea sounds really appealing as it would lead to a much cleaner form. I agree regarding Email address, and I kind of agree regarding Username. There is however one information for the latter that many people don't expect: Spaces are allowed. I'd rather leave that information.

[bugfolder]

Different sites might desire different levels of specificity on the help messages, particularly for the email usage. Could the help text be set in config? Then whatever we come up with, site builders could tweak as desired. (Also, we could then change our mind in the future for the defaults without affecting existing sites.)

[swampopus]

I could imagine some extra form fields on the Account Settings config page: admin/config/people/settings. Maybe in the "Registration and cancellation" fieldset.

Eg:

Instructions for username:
[________________________________]
(#description is the original hard-coded description)

Instructions for password:
[________________________________]
(#description is the original hard-coded description)

[avpaderno]

Instead of a description that tries to be valid for every site, or remove it, I much prefer @bugfolder's solution.

[swampopus]

Well, it should be a pretty basic PR to make it work the way I describe in my previous comment (I really wish github numbered comments so I could refer back to it more easily).

Anyway-- before I actually write any code, I'll wait a little while longer and see if anyone else wants to weigh in.