1

We would like to create a role that can reset passwords for accounts but only for authenticated users, for security purposes, we do not want this role to change passwords to administrators or other roles.

I created a new role called user-admin and provided access just to:

  • administer users
  • view user profiles

When I login with this role and go to /admin/people, the role works fine except that it can change ANY profile including administrators.

I thought that changing the order of the roles would take care of this but that is not the case.

I am debating if I should create a View and filter the users on the view to only authenticated users with a link to edit the user, or if it would be better to use hooks limiting the results for the user on the /admin/people

Thanks in advance

Improve this question
5
  • The view idea sounds dangerious as technically they could still change admin passwords if they navigated to the right url.
    – AdamG
    May 18, 2017 at 1:18
  • I think that you should create a custom module to do this.
    – Adrian Cid Almaguer
    May 18, 2017 at 4:05
  • One thing to note is that all users (except the anonymous user) are authenticated users. Even admins.
    – Jaypan
    May 18, 2017 at 8:38
  • I came across the user protect (drupal.org/project/userprotect) module, will try that first and comment back soon
    – aspagarino
    May 19, 2017 at 20:40
  • Did this module help you? I also need my lowest level staff user to be able to modify account information and passwords for website users, but don't want them to be able to assign themselves as admins or be able to change passwords for higher privileged users.
    – Christia
    Jun 22, 2017 at 22:41

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.