We would like to create a role that can reset passwords for accounts but only for authenticated users, for security purposes, we do not want this role to change passwords to administrators or other roles.
I created a new role called user-admin and provided access just to:
- administer users
- view user profiles
When I login with this role and go to /admin/people, the role works fine except that it can change ANY profile including administrators.
I thought that changing the order of the roles would take care of this but that is not the case.
I am debating if I should create a View and filter the users on the view to only authenticated users with a link to edit the user, or if it would be better to use hooks limiting the results for the user on the /admin/people
Thanks in advance