1

I've installed the user protect module on a site to allow another user to have complete admin access to the site, without the ability to edit my own administrator account. The problem with this it, they need to be able to access pretty much absolutely everything else, except for the ability to circumvent user protect. At the moment, it is set up to stop them from editing my user, which works fine, unfortunately they are easily able to simply disable user protect.

What can I do to let them do almost everything except lock me out? So they shouldn't be able to disable that module, and they shouldn't be able to change their own permissions to be able to access that module.

0

I don't think there's an existing module to do that (might be wrong though), but if you're ok to write a small custom module it would be fairly straightforward.

The two things you need to do are:

  • Alter the module list form and disable the checkbox for the User Protect module
  • Alter the permissions form to disable the checkboxes for the administer userprotect permission (and any others you might want to disable access for, see the userprotect_permission() function in the userprotect.module file for a full list).

The code would look something like this:

function MYMODULE_form_alter(&$form, &$form_state, $form_id) {
  // We only need to do this for a non super-user
  global $user;
  if ($user->uid == 1) {
    return;
  }

  // User permissions form
  if ($form_id == 'user_admin_permissions') {
    // Choose the permissions to hide
    $permissions = array(
      'administer userprotect'
    );

    // Disable the checkbox for each permission for each role
    foreach (element_children($form['checkboxes']) as $key) {
      // Loop through each permission and disable
      foreach ($permissions as $perm) {
        $form['checkboxes'][$key][$perm]['#disabled'] = TRUE;
      }
    }
  }

  // Module list page
  else if ($form_id == 'system_modules') {
    // The group the module lives in (User Protect is in 'Other' by default).
    $group = 'Other';

    // Disable the checkbox
    $form['modules'][$group]['userprotect']['enable']['#disabled'] = TRUE;
  }
}

Now the checkboxes for both will be disabled unless you access the forms logged in as user 1.

  • I've been playing around with this for a while and after a small change (edit waiting for peer review) it is running on both pages (tested using echo), but it isn't actually disabling the checkboxes. – Tim Rosser Feb 24 '12 at 3:02
  • Okay, scratch that, got it working on the permissions page (I broke one part while testing), now just a tiny bit to go! Thanks for the help! – Tim Rosser Feb 24 '12 at 3:05
  • "user_admin_perm" is the form ID for Drupal 6; the form ID for Drupal 7 is "user_admin_permissions." The code reported by Clive is for Drupal 7; eventually the code needs to be adjusted to be used on Drupal 6. – kiamlaluno Feb 24 '12 at 5:43
  • Wouldn't this be susceptible to DOM manipulation or POST tampering? I only ask because I'm facing a kind of similar issue on my site. I think a custom form validation may also be necessary to be fully protected. – arkz Feb 24 '12 at 9:35
  • @arkz Yes it would, I think that's a separate issue though :) – Clive Feb 24 '12 at 10:39
1

Create another custom role, and add all of the permissions they will need, to that role. Leaving out the ability to administer user roles, and such.

It probably sounds tedious, considering you'll be adding back almost all of the same permissions that admin has. But, that "almost" is important and makes all the world of a difference with regard to security of your website.

  • 1
    That's the problem, this person needs to be able to do everything (including administer roles) except edit my admin user (this is only to prevent them locking me out). I've already made a custom role for them, I'm just struggling to give them the access that they need while still keeping myself safe. – Tim Rosser Feb 24 '12 at 0:13
-1

"Hide the Administrator role selection in admin/config/people/accounts unless the user has the 'administer permissions'"

http://drupal.org/node/1356964 (roleassign module)

http://drupal.org/project/fixcore

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.