By gte451f on

Does anyone find it odd that I can create a role and enable the "administer users" check box. Then anyone with that ability can now edit the "Super User" (You know the first account created) and change their password and other fun stuff.

It seems to me that that account should be off limits. In fact, does anyone know how I can make that particular account off limits to editing when a role includes "administer users"?

JIm

⋅ Categories: Drupal 4.7.x

Comments

tclineks’s picture

tclineks commented

Hmm.

Either an exception for uid 1 or a seperate permission would be more appropriate IMO.

OTOH this may be so seldom used that a little manual uid check addition is what to expect.

gte451f’s picture

gte451f commented

I ran into somthine else that seems odd for permissions. As far as I can tell, giving a role the permission "administer users" means that role can modify access control.

Access Control is like giving away the keys to the kingdom, now said role can go and give themeseves every role they might not have already had. I interpret "administer users" as being able to modify users not access control. There should be somthing like ....

administer users
administer roles

Steve Simms’s picture

Steve Simms commented

I just submitted a patch that should solve the problem:
http://drupal.org/node/48286

It's a simple change to prevent everyone except UID 1 from editing UID 1.