How can I hide the main administration account from authenticated users? I have created a new role and created a new admin account.
5 Answers
You can implement hook_menu_alter() in a module to alter the access callback used for the "user/%user" path.
The code I would use is the following one, which is generic enough not to take assumptions about the access callback already set, and the arguments passed to that access callback. This means the code will work even if there is another module that alters the access callback for the same path.
The same code would work for Drupal 6, once you replace any occurrence of user/%user with user/%user_uid_optional.
function mymodule_menu_alter(&$items) {
if (isset($items['user/%user'])) {
array_unshift($items['user/%user']['access arguments'], $items['user/%user']['access callback']);
array_unshift($items['user/%user']['access arguments'], 1);
$items['user/%user']['access callback'] = 'mymodule_user_view_access';
}
}
function mymodule_user_view_access($account, $callback) {
$args = func_get_args();
// Remove $account and $callback from the arguments.
unset($args[0], $args[1]);
$uid = is_object($account) ? $account->uid : (int) $account;
// 1
if ($uid == 1) {
// The user ID is 1; only that user can view that user account.
return ($GLOBALS['user']->uid == 1);
}
// 1
// Let the previously set access callback decide who has access to the user account.
return call_user_func_array($callback, $args);
}
The code would not allow any user to access the super user account, except to the super user. If you want to allow the users with the permission to administer users to see that user account, you can replace the control statement commented with // 1
with the following one.
if ($uid == 1) {
// The user ID is 1; only that user can view that user account.
return user_access('administer users');
}
-
I implemented this solution and works perfect, thanks, but also I would like to hide in URL user/1->[name] with maybe a redirect with rules when url is [site:url]/user/[admin:name] to [site:url], please help how to implement it.– pinueveOct 17, 2015 at 19:22
The User One module looks like it may provide what you are looking for:
Since Drupal 7 is more restrictive in allowing multiple failed logins, using different names (in 6.x version) is not needed any longer. These are the features of 7.x version:
- User one account is protected from viewing and editing. Users -- even with 'Administer users' permission -- will be denied access.
- ...
You can make hook_menu_alter to this menu to change permission
function hook_menu_alter(&$items) {
$items['user/%user']['access callback'] = 'my_function';
}
function my_function()
{
}
-
1It's important to understand that the above will do altering on all user profiles. You need to add user 1 specific logic, and then fall back to the normal functionality or no user profiles will be available. Apr 1, 2012 at 15:33
-
-
-
You should be able to use Rules' "User is going to view a page" trigger to do this if you don't want to write your own module hook as well.
The easiest way to do that is to create a hook_FORM_ID_alter
function legal_form_user_admin_account_alter(&$form, &$form_state, $form_id){
global $user;
if($user->uid != 1){
unset($form['accounts']['#options']['1']);
}
}
-
1All that code does is hide the row for user 1 in the main admin accounts page. It doesn't stop you visiting user/1 or user/1/edit to view/edit the account. I hope you aren't using that as a security feature in any production websites as it won't work :)– Clive ♦Jan 29, 2013 at 12:51
-
Thank you Clive for your comments. I didn't realize that feature, so I'll take care using that code. Feb 5, 2013 at 9:15