User's being able to change their Account Names

Am I the only one who is having this problem?

In testing out my site, I have found that when I log in as another user, not the Admin, I can click "Settings" and go to Your Name, I can change the name on the account. When I click "Save" and go to the profile, the name is indeed changed.That will cause problems with people who are up to no good trying to imitate someone else, take someone's identity.

I have searched all over Elgg and the Elgg group on google and haven't found any help. Any ideas as to why this is happening and how to prevent users from changing their Account Name????

Any help would be greatly appreciated!!!!!

  • Make sure your other user doesnt have admin access, somehow you must have set up your new user as an admin.

  • chambo67,

    Thanks for the reply. I appreciate it!

    But these users are me registering as if I was just another user. This problem is happening "right out of the gate." Is there a master file or setting that I can change or comment out? When I go to the "User Admin", and click on any random user, the "Make Admin" link is still there. There is NO ONE that I would ever make an Admin but me. There must be a piece of code somewhere that is making people "Admins" by default if that is indeed the problem.

    Thanks again Chambo67

  • Will someone check and see if their "test users" can change their account names? I'd appreciate knowing if it is just me or it's an ELGG safety/security problem!


  • slowsoulz:

    There is no way in Elgg for anyone (even the admin) to change his or her username.

    People can change their display names, however. This seems quite reasonable because after all people do change their names (in some cultures after marrying, for example).

    I actually changed my display name on this site when another Kevin registered, to make my own identity clearer.

    Since in the real world multiple people can have the same name, Elgg does not require that display names be unique.

    Keep in mind that people can choose any display name they like when registering their account to begin with.

    Having said all this, I did over-ride the settings form for one client to restrict the ability to change names to admins only. However, this was a site that did not have open registration -all accounts were created by the admins.

    This kind of over-ride requires coding a plugin. There is no admin option for it in standard Elgg.

  • Kevin,

    You are the  M. A. N. !!!

    Thank you for at least giving a somewhat plausible reason to allow people to change their display names. I still see it as a safety/security issue for the reasons that I stated above. If someone were up to "no good" they could cause chaos then change their name. Not good in my opinion!

    Is there anyway that you I can do that plugin? I'd be willing to pay for it. The name changing thing really bothers me. If Admins have the ability to change names then cool. But to have people "willy nilly" changing their names isn't "the business" in my opinion!

    Thanks again for filling in a missing piece for me!!!



  • if you are good with phpmy admin a simple query can easily change the username imho ... ive tried it and it works with no issues...

    as for causing chaos the display name change is reflected throughout the site .. so they really cant hide..

  • Madshark,

    Expand on what you mean by: "as for causing chaos the display name change is reflected throughout the site .. so they really cant hide." Maybe it is late or I'm tired but I'm not sure what you mean.

    P.S. I'm not good with php myadmin but that may be my next project!

  • well when you write something on the site it uses your display name. for example wire post by you would show slowsoulz . if you changed that to Slow.S it would get updated site wide and any activity you have been up to will show the new display name and not the old one.

  • I have to agree with Slowsoulz... If I add a certain friend with the name "Tee Bingham" ... and he later changes his name to "Terry B"...

    I wouldnt know who that was...


    My conclusion is to have their Real name (which they can change as much times as possible) show only on their profile .... But have their usernames display on wireposts and discussions etc....

    Its a good thing having a "real name" field in the profile.. but to repalce the username with the Display name on things like the wire and other things is really really backwards.

    The worst case scenario is as slowsoulz said, that a user can imitate another user.. as well have the potential of changing their Display name every 5 minutes, it would be the most annoying thing on the site, everybody would get annoyed.


  • well that would just depend on how well you run your site in the end,...the ban option is there for a reason