3

I'm trying to set a password for a user account while logged in without Site Admin permissions (the user does however have 'Edit Users+Administrate users+Assign Groups and Permissions + Remove User permissions all enabled). - Despite this they still can't change a password for a current user or even create a new user with a set password that can login to the system.

This is partially problematic as 'Verify email address' is not something the company is interested in so I'm looking for a solution to create a user on the backend that can login once their account is created without verifying or really receiving any email and without having to give full administrative access to my client just to set passwords? Seems like something that should be achievable especially with the permission 'Administrate Users' enabled.

Cheers.

Improve this question
5
  • Can you share the template code you're using to create the user?
    – Brad Bell
    Aug 15 '14 at 16:59
  • Hi Brad, my users are just using the control panel page... They can create a new user but have no way to set a password or reset a password for user already in the system.
    – Darren
    Aug 18 '14 at 13:03
  • Ahh, thought it was from the front-end of the site. Will add an answer.
    – Brad Bell
    Aug 18 '14 at 18:15
  • Are there any plans to change this do we know? It basically makes it impossible to give my client the ability to create users in the CMS without giving them full access to my sections and schemas as well (they could do anything!). Surely it's not any more dangerous from a security pov than giving them the ability to set access permissions / the ability to delete users?
    – Darren
    Aug 19 '14 at 21:59
  • Entirely possible... we've had a handful of people run into what you're seeing.
    – Brad Bell
    Aug 19 '14 at 23:28
1

Currently there isn't a way to do what you're looking for from the control panel, even if a user has "Administrate Users" permissions.

In the control panel, only current administrators can change an existing user's email or password and they must supply their existing administrator password to do so. And even administrators can't set an initial password for a user from the control panel.

On the front-end, if you're running Craft Pro and you've enabled public registration, a user can set an initial password from the public registration form.

Improve this answer
1
  • 1
    Dealing with this issue right now. Sendmail and PHP Mail will send the test email. Public registration is enabled. On the admin login form, there is no option for setting a password, and the password reset email does not send. Ideas? Really seems like an admin should be able to set a default password for non-admin users.
    – idahotallpaul
    Jul 23 '15 at 17:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.