greggles did a nice summary:

In core if you have "administer users" then you can block/unblock/edit a user on admin/people or on their user/UID/edit page. And if you have "administer permissions" then you can grant roles on admin/people or on their user/UID/edit page.

In admin_views you can grant new roles on admin/people even if you don't have a role with the "administer permissions" permission.

Since it's VBO which doesn't check any permissions the only thing i can imagine is removing the role change? Any other ideas?

Comments

drupov’s picture

drupov commented

As far as I understand you don't have the Actions permission module enabled, which is a part of VBO.

Using that you can show/hide what actions are being allowed on each admin view per role.

Hope that helps.

drupov’s picture

drupov commented
Issue summary: View changes
Priority: Major » Normal
Status: Active » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.