2

Does anyone know if there is there a way to lock down certain member groups in the CP so other members can’t delete member accounts belonging to those member groups?

I have a specific member group, let's call them 'Administrators' which need to be able to create members and delete members in another member group, called 'Customers'. But I don't want the 'Administrators' to be able to delete members in other member groups.

Does that make sense. Any ideas?

| improve this question | | | | |
  • Do you mean you don't want Admins to be able to delete the actual member groups? If that is the case then you're in good shape. Only Superadmins can create or delete member groups. Or are you instead interested in preventing deletion of the individual member accounts in certain member groups? – Alex Kendrick Jan 6 '14 at 15:39
  • What I need to do, is restrict any members of one member group 'Administrators' so they can only delete members from another specific member group 'Customers'. Does that make sense? – richardpixel Jan 7 '14 at 9:01
  • Yes, that makes sense. Unfortunately it seems that giving a member group the "Can delete members" permission gives them permission to delete any member! Unless I am missing something I think you will need a custom extension to handle this. – Alex Kendrick Jan 7 '14 at 15:33
  • Yep, what I thought sadly. Do you know of any extensions that would make this possible? – richardpixel Jan 8 '14 at 18:14
  • 1
    Alex, found a candidate in member model, hook member_delete – GDmac Jan 8 '14 at 18:46
4

As Alex mentions, when a user has "Can delete members" rights, he/she can delete any member.

A different approach would be to, not allow to delete members, but to only allow users to be moved to a member group with no (login) rights at all. You can restrict to which group a member can be assigned by setting the group to "locked". If needed, the restricted member group could regularly be purged by a super-admin.

| improve this answer | | | | |
  • Thanks GDmac, that makes sense and could be a reasonable workaround. – richardpixel Jan 8 '14 at 18:16
1

I think GDmac's answer is the way to go. But I thought it would be fun to start on an extension....

This seems to do the trick, though it is pretty bare-bones (no settings, not much detail in the message shown to the user).

Using the member_delete hook:

public function member_delete($member_ids)
{

    // Array of member group_ids for which to restrict delete permissions
    $supervised_member_groups = array('7');

    // Array of member group_ids for wich deletion is disallowed
    $protected_member_groups = array('5','6');

    // The group_id of the current admin
    $current_admin_group_id = ee()->session->userdata('group_id');

    // Check if the current admin is in the supervised member group
    if (in_array($current_admin_group_id, $supervised_member_groups))
    {
        // Generate an array of group_ids to which the deleted member(s) belong(s)
        $member_groups = array();
        $query = ee()->db->select('group_id')->where_in('member_id', $member_ids)->get('members');
        foreach ($query->result() as $row) 
        {
            array_push($member_groups, $row->group_id);
        }

        // Check if the deleted member belongs to one of the protected member groups 
        // and if so throw an error
        $overlap = count(array_intersect($protected_member_groups, $member_groups));            
        if ($overlap) show_error('You are attempting to delete a member from a protected group. Please adjust your selection.');
    }

    return $member_ids;
}

Gist with full extension

| improve this answer | | | | |
  • 1
    for ee 2.7+ you probably need to restore_xid(), otherwise, the xid of the form will probably be invalid. nice idea for an add-on with settings screen etc. – GDmac Jan 9 '14 at 22:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.