1

A plain Drupal 8 installation set the following input formats for the administrator role it creates:

  • Basic HTML
  • Restricted HTML
  • Full HTML

The first one is assigned to authenticated users; so, I guess it would be automatically allowed to the administrator role. The second one is assigned to anonymous users too.

Is there a way to assign the Restricted HTML input format only to anonymous users? I tried editing it to remove the administrator role from it, but when I edit that input format again, I see it is still assigned to the administrator role.

To make the question more understandable, I am referring to the settings in admin/config/content/formats/manage/basic_html.

screenshot

I can unselect Administrator from the Roles list, but that change will not be keep after saving. Differently, I can take off the permission to use the Basic HTML format from the Authenticated user role, select it in admin/config/content/formats/manage/basic_html, and the selection will be kept.

Improve this question
5
  • AFAIK, if you select a role to be the administrator role, it will automatically get access to everything, even when you set different permissions. You might be able to achieve this if you don't make your role to be the administrative role on /admin/config/people/accounts. Can you explain why do you want to remove the restricted HTML for admins? There might be other ways to achieve what you're after.
    – Aram Boyajyan
    Commented Mar 16, 2016 at 8:32
  • I know I can use a different role, but I don't want to create a role just for user #1. I need to remove it from the list of input formats the administrator role can use, since I am not going to use it for that role.
    – avpaderno ♦
    Commented Mar 16, 2016 at 8:42
  • Got it; I'm not aware of any hooks you can use there though. If it's only for your purposes, you could remove that option via JS. It won't be nice, but will work and is pretty straightforward to implement.
    – Aram Boyajyan
    Commented Mar 16, 2016 at 9:12
  • @AramBoyajyan Funny fact: I removed the permission to use the Basic HTML format from the Authenticated user role, but in admin/config/content/formats/manage/basic_html I can still set that role to use it. So, in one case the input format settings take the precedence over the user permissions, but it is not so for the Administrator role.
    – avpaderno ♦
    Commented Mar 16, 2016 at 10:02
  • Hah :D I remember seeing a few of quirky edge cases in D7 and administrator role (not to mention adminrole for D6) on larger sites, but in the end it would usually override other permissions, no matter what is saved in the DB. I haven't played with it in D8 though, but sounds as if some of those things might be present as well.
    – Aram Boyajyan
    Commented Mar 16, 2016 at 10:10

1 Answer 1

Reset to default
2

User #1 is a special user that gets all permissions, always. Its access privileges are not controlled by the administrator rule. You can read more about this on Securing user #1.

I haven't tried this, but the following should work.

You could create a new admin user with the administrator role, and give it access to Full HTML only. If you want you can then disable user #1 completely.
Before you disable user #1, make sure the administrator role really does have all permissions. I don't know about Drupal 8, but in Drupal 7 the administrator does not automatically get all permissions when contributed modules are installed.

Improve this answer
5
  • It's not a matter of user #1, but of Administrator role. I cannot take off an input format from the Administrator role. Funny fact: I can take off the permission to use the Basic HTML format from the Authenticated user role and still be able to assign the Basic HTML format to Authenticated user in admin/config/content/formats/manage/basic_html.
    – avpaderno ♦
    Commented Mar 16, 2016 at 9:57
  • The Administrator role is assigned to the user #1 during installation, but the same role can be assigned to other users. So, Administrator role doesn't mean the user is user #1.
    – avpaderno ♦
    Commented Mar 16, 2016 at 9:59
  • Thanks for clarifying. I've been digging around and it looks like the administrator role is treated as a special role that always has all privileges. In core config the admin role is flagged with is_admin=true in core/profiles/standard/config/install/user.role.administrator.yml and that setting trumps any permissions you try to set. It looks like you can't revoke any privileges from the administrator role that's created at install time.
    – Peacog
    Commented Mar 16, 2016 at 11:09
  • 1
    You can by not having an administrator role but just a role with almost all but not all permissions. The downside is that you have to manually grant that role all new permissions. Drupal 7 had it implemented like that, but it didn't work well because there are dynamic permissions that never properly worked.
    – Berdir
    Commented Mar 16, 2016 at 22:23
  • I didn't find other way to achieve what I wanted.
    – avpaderno ♦
    Commented Dec 19, 2021 at 16:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.