A user assigned a role with the administer users permission but not the access user profiles will upon submitting the edit form receive an Access denied screen although the changes have been saved. Instead of directing the user to user/uid, which he isn't allowed to see, the User module should direct the user to admin/user.

These are the steps to reproduce the bug:

  • Download and instal Drupal 4.7.5.
  • Login as user 1.
  • Create the role roleA with the administer users permission only.
  • Create the user userA with the role roleA.
  • Login as user A.
  • Go to user/2/edit (the userA account settings page) and press Submit.

Comments

cburschka’s picture

Version: 4.7.5 » 5.x-dev
Status: Active » Fixed

Fixed in 5.x; I just tested it. Editing from the admin panel passes ?destination=admin/user/user to the form, causing it to be redirected properly.

Anonymous’s picture

Status: Fixed » Closed (fixed)