Administering invitations permission is way too permissive.
Eric_A - October 29, 2009 - 10:49
| Project: | Invite |
| Version: | 6.x-2.x-dev |
| Component: | Code |
| Category: | bug report |
| Priority: | normal |
| Assigned: | Unassigned |
| Status: | active |
Description
I need some of my admins to access admin/user/invite*, without letting them access 40+ other admin paths from core modules, as is the case now. I'm inclined to consider this a bug, although this is debatable of course.
Invite 6.x-2.0-alpha1 (recommendend for 6.x) and 2.x-dev use “administer site configuration” a couple of times. People who read a bit of code might be tempted to simply grant this permission to a certain role, not realizing the global impact.
Even “administer users” would be a better idea, but still too much to my taste…