Contrib.social

Impossible to use "Bulk update" without "Administer users" permission

Open on Drupal.org →
Created on 19 August 2019, over 5 years ago
Updated 22 June 2023, over 1 year ago

Problem/Motivation

In situations when we don't want to allow certain roles to "Administer users", but still want to delegate roles assignment to them, we can build a custom view similar to "People". However using user_add_role_action & user_remove_role_action is still impossible because access check in those actions requires "Administer users" permission.

Proposed resolution

Create a class that would extend access check for those actions to check also for field "role_change" update access.

RoSk0 is happy to provide patch if proposed approach would be accepted by maintainers.

Remaining tasks

  1. Agree on approach
  2. Create patch
  4. Review
  5. Commit

User interface changes

API changes

Data model changes

Release notes snippet

🐛 Bug report
Status

Fixed

Version

1.2

Component

Code

Created by

🇳🇿New Zealand RoSk0 Wellington

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024