1

We would like to create a role that can reset passwords for accounts but only for authenticated users, for security purposes, we do not want this role to change passwords to administrators or other roles.

I created a new role called user-admin and provided access just to:

  • administer users
  • view user profiles

When I login with this role and go to /admin/people, the role works fine except that it can change ANY profile including administrators.

I thought that changing the order of the roles would take care of this but that is not the case.

I am debating if I should create a View and filter the users on the view to only authenticated users with a link to edit the user, or if it would be better to use hooks limiting the results for the user on the /admin/people

Thanks in advance

  • The view idea sounds dangerious as technically they could still change admin passwords if they navigated to the right url. – AdamG May 18 '17 at 1:18
  • I think that you should create a custom module to do this. – Adrian Cid Almaguer May 18 '17 at 4:05
  • One thing to note is that all users (except the anonymous user) are authenticated users. Even admins. – Jaypan May 18 '17 at 8:38
  • I came across the user protect (drupal.org/project/userprotect) module, will try that first and comment back soon – aspagarino May 19 '17 at 20:40
  • Did this module help you? I also need my lowest level staff user to be able to modify account information and passwords for website users, but don't want them to be able to assign themselves as admins or be able to change passwords for higher privileged users. – Christia Jun 22 '17 at 22:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.