I have a Drupal 7 site that has additional fields added to the user profile page, to capture additional information (with these fields then displayed on the public-facing profile).
Only administrators should be able to edit non-admin profiles.
However, I am using !login_url (one time login) functionality in email confirmations to allow new users to set their own password and I need to retain this feature.
I have installed the User Protect module, but unless I enable the 'Edit own user account' permission, the one time login link returns a 'You are not authorized to access this page' message and the password cannot be entered.
Is there a way via User Protect, another module, or via custom code for me to retain the Change Password option, but remove access to all other fields that have been added to build a more complete profile?