Posted by sime on October 26, 2009 at 6:53am
| Project: | Paranoia |
| Version: | 6.x-1.x-dev |
| Component: | Code |
| Category: | feature request |
| Priority: | normal |
| Assigned: | Unassigned |
| Status: | closed (fixed) |
Issue Summary
The attached patch prevents editing email & password fields on user/1/edit for everybody except user/1.
"Administer Users" is a very useful permission, but unfortunately provides users with an opportunity to become the superuser. I would like to re-implement the D5 feature of paranoia.
It is recognised that contrib modules regularly implement extra php permissions. Becoming user/1 gives the user the ability to execute php via these modules.
Comments
#1
#2
#3
Applied this to drupal.hu and it works fine.
#4
Thanks, patch applied.
#5
Automatically closed -- issue fixed for 2 weeks with no activity.