Related to Issue #599342: document security threat of permission 'administer users ' and regarding this text:

Beware: Granting the 'administer users' permission to users will allow them to modify admin passwords or email addresses or even delete the site administrator account. The User Protect module can prevent this.

I was happy to find that, in addition to a fix in core that prohibits the deletion of user 1, Role Assign now offers some added protection for this account by making fields 'name', 'email' and 'pass' uneditable.

Should the README be updated to reflect this?

Great module! Thanks a lot!

Comments

salvis’s picture

Status: Active » Fixed

Thank you for your feedback and analysis.

I've updated README.txt for D7. I don't think it's worth the trouble for D6 anymore.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.