Avoid admin users editing other admin users

Question

I'm in a Drupal 7 installation, trying to find a way to avoid admin-users to edit other admin-user's account.

I've created a role for 'content administrators' and this users tasks involve user administration, but I don't want them to be able to edit other content administrators or admin accounts.

I wasn't able to find an option for this or a module providing the functionality and I'm a bit lost about how this can be achieved.

In D6 I guess could use hook_user() to catch an edit and check the target role in order to allow that edit or not, but this hook is gone on D7. The closest thing is hook_user_alter(), but this is called after the edit, so I can't use it.

Any pointers?

Answer 1

Just use the User Protect module.

This module provides various editing protection for users. The protections can be specific to a user, or applied to all users in a role.

Note: User Protect has a complicated configuration -- please take the time to read the very extensive module help before using it!

The following protections are supported:

username
e-mail address
password
status changes
roles
deletion
OpenID identities
all edits (any accessed via user/X/edit)

When a protection is enabled for a specified user (or the protection is enabled because the user belongs to a role that has the protection), it prevents the editing operation in question that anyone might try to perform on the user--unless an administrator who is permitted to bypass the protection is editing the specified user. The module will protect fields by disabling them at user/X/edit.

User administrators may be configured to bypass specified protections, on either a global or per-administrator basis.

These protections are valid both when trying to edit the user directly from their user/X/edit page, or using the mass user editing operations.

The module also provides protection at the paths user/X/edit and user/X/delete, should anyone try to visit those paths directly.