Separate permission for forcing individual users to change their passwords

Created on 8 May 2017, almost 8 years ago
Updated 10 January 2025, 3 months ago

Problem Description

Currently this module assumes that any user that would need to force password changes can do so globally on all user accounts. There are some usecases where a site will delegate user management to non-administrative users via modules such as administerusersbyrole → .

In this scenario, you would not want to grant these lower privilege users the "administer force password change" permission as that may allow a lower privileged user to force an administrative user to change their password.

Proposed Solution

  • Create a separate permission for forcing password changes on the user edit screen.
  • Modify the hook_form_alter() implementation in the .module file to allow triggering a password change if the current user has either permission.
  • Add an action plugin to allow bulk triggering password changes on multiple user accounts.

Patch will be submitted shortly to support this.

✨ Feature request
Status

Needs work

Version

2.0

Component

Code

Created by

🇺🇸United States shawn_smiley

Live updates comments and jobs are added and updated live.
  • Needs reroll

    The patch will have to be re-rolled with new suggestions/changes described in the comments in the issue.

Sign in to follow issues

Merge Requests

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024