PR https://github.com/mantisbt/mantisbt/pull/911

I didn't look at the PR, but do we really want to allow users to remove their email address ? A lot of functionality relies on being able to send emails (e.g. password reset).

do we really want to allow users to remove their email address ?

not complete sure, but is it that bad?

• changing to a wrong e-mail address (e.g. because of a typo) is even worse as it happens unintentional
• removing the e-mail address is an easy way to (temporarely) deactivate all notifications.
• removing the e-mail address is already possible for admins when using the manage user page.

changing to a wrong e-mail address (e.g. because of a typo) is even worse as it happens unintentional

That has always bothered me actually. IMO, we should ideally enforce a valid address, by only allowing the change after an activation e-mail has been actioned by the user (similar to new user account validation). But I guess that's outside the scope of this change.

I still feel it's conceptually wrong to set the email to blank (whether it's done by admin or user, makes no difference).

Using that as a trick to deactivate notifications, is also wrong. If this is a valid use case, then we should offer a "mute all notifications" option in the user profile, or something similar.

Changed description and updated PR to deal just with real name.

I still feel it's conceptually wrong to set the email to blank (whether it's done by admin or user, makes no difference).

Changing by admin is still possible and not changed in this PR as it's outside the scope of the change

I still feel it's conceptually wrong to set the email to blank (whether it's done by admin or user, makes no difference).

There are a couple of reasons where it makes sense for an admin to remove their email address:

1. The emails are bouncing to such user affecting the reputation of the sending service or causing returned emails.

2. System accounts that are used to report issues or add notes, but do not need email notifications.

The admin should have the power to do this for whatever reason. At the end of the day, if a user wants to reset their password and their email is blank, they will contact the admin to help them.

do we really want to allow users to remove their email address ?

I think that users should be able to change their email address, however, to handle this properly we need to have the concept of email vs. pending_email (or a token for storing pending email). When user modifies their email address, we have it as pending until the user verifies it, and then it gets set as email.