I am on Drupal 7. When users log into a Drupal website, they aren't allowed to see the register form anymore. That is the regular behavior and I understand the reason why Drupal behaves like that.

But I have a specific situation in my website. I need users in a specific role to register new users. I will create an invisible field in my form that will tie these new users with the UserId of the "parent" user creating them. Maybe I will use the User Reference module. There is no problem here, I can do that.

The question is: how can I get the register form to be displayed to logged in users in a specific Role without giving them the "Administer users" rights? I don't trust these guys to give them that much access.

Thank you!


The access check is made in the user_register_form() function itself:

$admin = user_access('administer users');


// If we aren't admin but already logged on, go to the user page instead.
if (!$admin && $user->uid) {
  drupal_goto('user/' . $user->uid);

As you can see the check for the administer users permission is hard-coded. That said, I think you've got 2 options:

  1. Grant the appropriate permission to that user role (obviously undesirable as you've mentioned).
  2. Re-implement the user registration form in a custom module, changing the access check to a more appropriate one for your situation. You should be able to use pretty much all of the code from user_register_form() and piggyback off the validation/submit handlers, so there shouldn't be much coding involved at all really.
| improve this answer | |
  • Thanks, Clive for the workaround options. I would like to go with the second option. My question is, how would I re-implement the user_register_form function? Is it enough to declare a function like MYMODULE_register_form(&$form, &$form_state)? – Елин Й. Aug 26 '13 at 7:04

In my case I could solve the problem with the following approach. Actually, I have a very site specific and more complex configuration, but I'll try to simplify.

I have set a new permission called 'create users'. Then, just before the actual callback function, added the following lines, which check if the user have the 'create users' permission, and give him temporarily for that page callback the 'administer users' permission:

global $user;

if (user_access('create users')) {
  $static = &drupal_static('user_access');
  $static[$user->uid]['administer users'] = TRUE;

I am actually using the Administer Users by Role module with this patch. The patch is posted by me and it is an enhanced version of a previously posted patch. This module with the mentioned patch works most of the cases. If you have AJAX-enabled fields in the user registration form, then you should use some custom callback paths (which I had to do) and add the above lines before the actual callback function.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.