Do we really even need the 'custom Gravatar email' field? Why isn't just using the user's account e-mail field good enough? Gravatar accounts support more than one e-mail address per Gravatar. There hasn't been an feature request issued for it, so is anyone really using it? This seems like another feature that can be removed if there is no objection.

Comments

Narno’s picture

I think it is interesting for administrators using an email address like "admin@mysite.com." But yes it is duplicate option what offers Gravatar.com

TheRec’s picture

Since it is already implemented, maybe it would be easier to create an access right to determin if users with a certain role are allowed to assign a custom e-mail for their Gravatar their Drupal account (of course, UID-1 would always have this access right... and to be honest I also feel that this feature is kinda a duplicate of what Gravatar allows with multiple e-mail). That right would come in addition of the "use gravatar" right.

Allowing the use of this feature to anyone is not a great idea, because let's imagine you force the e-mail verification of your members on signup to ensure they own the e-mail they provided and then let them use any e-mail, without verification, for their Gravatar, they could then use the Gravatar of anyone (providing they know the related e-mail address)... I know it is just an avatar, but this might become misleading with "bad" users.

Narno’s picture

Indeed, I did not think about the malicious use of this feature ... Gravatar.com responsible for checking email address and users trust it: let him hand in this case. ok?

dave reid’s picture

So do we agree to remove this option?

TheRec’s picture

Well I find it useful in some cases as I explained... for trusted users. I'd vote to restrict the access to this feature with an access right, I hate to remove features from a program when it is working, when I found a use to it once and when it's not using that much ressources ;)

As it comes to verifying e-mail, it is not on Gravatar's end that the problem lies, but on your site... there is not any authetication required and you can "try" to use any e-mail as "account name" and thus use the Gravatar of someone else... it's not a big deal, it is just an image, but it can just be misleading for other user... if you allow only trusted user to define a custom e-mail for Gravatar and for other users verify e-mail at signup you ensure that the latter can use only their e-mail.

Narno’s picture

In this case the solution to allow this option only for users with adequate access seems to me good, like "use other email".

TheRec’s picture

Indeed, "use other email", "use custom e-mail" or "can override gravatar" (as I read it in #334609: Users should still be able to upload a user picture and override Gravatar from dragonwize ... this is not the exact same thing... but might be related if the maintainers decide to add an access right for this too). I like the second one, but it doesn't matter as long as it's clear :)

budda’s picture

I'm for just ditching the functionality from the Drupal end. No need. Adding more permissions just adds more bloat to the permissions admin page too.

dave reid’s picture

Status: Active » Fixed

For now, I have revised and commented-out the alternate e-mail setting. If there's a desire for users to bring it back, it can be uncommented.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.