Allows any edit/block/delete [#270852]

user/*/delete and user/*/edit work as expected
but
admin/user/user page, section "Update options"
gives access to edit/block/delete any user, even user/1

Comment	File	Size	Author
#4	AdministerUsersByRole-EditDenied.png	40.37 KB	smokris

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

Rafał Ch CreditAttribution: Rafał Ch commented 15 June 2008 at 17:31

Title:

Allow any edit/block/delete

» Allows any edit/block/delete

Comment #2

smokris

Athens, Ohio, USA

CreditAttribution: smokris commented 27 January 2009 at 21:02

Assigned:

Unassigned

» smokris

Bulk deletion of users from the admin/user/user page is fixed in 6.x-0.9.

I'll backport this to the 5.x version.

Comment #3

smokris

Athens, Ohio, USA

CreditAttribution: smokris commented 27 January 2009 at 21:51

Bulk deletion of users from the admin/user/user page is fixed in 5.x-1.0.

Comment #4

smokris

Athens, Ohio, USA

CreditAttribution: smokris commented 27 January 2009 at 23:00

File	Size
AdministerUsersByRole-EditDenied.png	40.37 KB

Regarding editing: On the admin/user/user page, "edit" links are still shown, but if you click the "edit" link, it should give an error message saying "You do not have permission to edit user x." (See attachment.)

Regarding blocking/unblocking: Yes, this is a problem. I'm working on a fix for it.