If a user is logged into a Facebook account that does not match the one linked to their Drupal account, it is very surprising to see a set of friends that doesn't match the Drupal account's friends. It led one of our users to perceive a security problem, thinking that somehow another Drupal user had gotten access to all of their friends.

It would be less surprising to show the user's friends in the Facebook block only if they are logged into Facebook and have their accounts linked. If they are logged into Facebook but accounts aren't linked, they should be prompted to link accounts. If they are not logged into Facebook, they should be prompted to log in. If they are already linked to one Facebook account and are logged into another Facebook account, we should recommend they log into the right Facebook account.

An added bonus of this is that users have a reminder in the fbconnect block when their accounts aren't linked to a Facebook account, encouraging them to link up.

This patch implements the changes described above.

It also removes the username from the fbconnect block. Since they are cached only by fbuid, caching something related to the currently logged-in user is unwise, and causes problems if the Facebook account becomes linked to a different Drupal account while they block is still cached.

CommentFileSizeAuthor
fbconnect-block.patch1.64 KBscottgifford

Comments

gobinathm’s picture

Issue summary: View changes
Status: Needs review » Closed (outdated)

Closing the issue. It was inactive for a long time & it's related to a Drupal Version which is not supported anymore