<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=US-ASCII">
<META content="MSHTML 6.00.2800.1498" name=GENERATOR></HEAD>
<BODY id=role_body style="FONT-SIZE: 10pt; COLOR: #000000; FONT-FAMILY: Arial"
bottomMargin=7 leftMargin=7 topMargin=7 rightMargin=7><FONT id=role_document
face=Arial color=#000000 size=2>
<DIV>We wanted the ability to create a new user and give them access to
create/edit/disable users. I did not want to give this user SuperUser
access, so I gave them the following rights:</DIV>
<DIV> </DIV>
<DIV> AdminUsers</DIV>
<DIV> ShowConfigTab</DIV>
<DIV> </DIV>
<DIV>However, more menu options displayed than I wanted, plus I noticed that
this user could change the password for *ANY* user, including root, which I
didn't care for.</DIV>
<DIV> </DIV>
<DIV>So I put together this patch (consisting of 3 files) which will do the
following:</DIV>
<DIV> </DIV>
<DIV> If a user has ShowConfigTab, but does NOT have
SuperUser rights, the only menu option that will be displayed will be User</DIV>
<DIV> </DIV>
<DIV> When the user list of priviledged users comes up,
users with SuperUser right will NOT be displayed.</DIV>
<DIV> </DIV>
<DIV>Just thought I'd share this with everyone in case others need this
functionality. I looked around and had not seen anything like this posted
already. Hopefully someone will find this handy.</DIV>
<DIV> </DIV>
<DIV>-----</DIV>
<DIV> </DIV>
<DIV>--- share/html/Admin/index.html Wed Jun 1 18:36:55 2005<BR>+++
local/html/Admin/index.html Tue Sep 6 17:32:34 2005<BR>@@ -55,45
+55,53 @@<BR> </ul><BR> <%init><BR> <BR>-<BR>-<BR>-my
$tabs = {<BR>- A =>
{<BR>-
title =>
loc('Users'),<BR>-
path =>
'Admin/Users/index.html',<BR>-
description => loc('Manage users and passwords'),<BR>-
},<BR>- B =>
{<BR>- title =>
loc('Groups'),<BR>- path =>
'Admin/Groups/index.html',<BR>-
description => loc('Manage groups and group
membership'),<BR>- },<BR>- C =>
{<BR>-
title =>
loc('Queues'),<BR>-
path =>
'Admin/Queues/index.html',<BR>-
description => loc('Manage queues and queue-specific
properties'),<BR>- },<BR>- D =>
{<BR>- 'title'
=> loc('Custom Fields'),<BR>-
description => loc('Manage custom fields and custom field
values'),<BR>-
path =>
'Admin/CustomFields/index.html',<BR>-
},<BR>- E =>
{<BR>- 'title'
=> loc('Global'),<BR>-
path =>
'Admin/Global/index.html',<BR>-
description =><BR>-
loc('Manage properties and configuration which apply to all
queues'),<BR>- },<BR>- F =>
{<BR>- 'title'
=> loc('Tools'),<BR>-
path =>
'Admin/Tools/index.html',<BR>-
description => loc('Use other RT administrative
tools')<BR>- },<BR>-};<BR>+my ($tabs, $superuser,
$amisuperuser);<BR>+$superuser=new
RT::User($session{'CurrentUser'});<BR>+$amisuperuser=$superuser->CurrentUserHasRight('SuperUser');<BR>+<BR>+if
($amisuperuser) {<BR>+ $tabs =
{<BR>+ A =>
{<BR>+
title =>
loc('Users'),<BR>+
path =>
'Admin/Users/index.html',<BR>+
description => loc('Manage users and
passwords'),<BR>+
},<BR>+ B =>
{<BR>+ title
=>
loc('Groups'),<BR>+
path =>
'Admin/Groups/index.html',<BR>+
description => loc('Manage groups and group
membership'),<BR>+
},<BR>+ C =>
{<BR>+
title =>
loc('Queues'),<BR>+
path =>
'Admin/Queues/index.html',<BR>+
description => loc('Manage queues and queue-specific
properties'),<BR>+
},<BR>+ D =>
{<BR>+
'title' => loc('Custom
Fields'),<BR>+
description => loc('Manage custom fields and custom field
values'),<BR>+
path =>
'Admin/CustomFields/index.html',<BR>+
},<BR>+ E =>
{<BR>+
'title' =>
loc('Global'),<BR>+
path =>
'Admin/Global/index.html',<BR>+
description => loc('Manage properties and configuration which apply to all
queues'),<BR>+
},<BR>+ F =>
{<BR>+
'title' =>
loc('Tools'),<BR>+
path =>
'Admin/Tools/index.html',<BR>+
description => loc('Use other RT administrative
tools')<BR>+ },<BR>+
}<BR>+} else {<BR>+ $tabs =
{<BR>+ A =>
{<BR>+
title =>
loc('Users'),<BR>+
path =>
'Admin/Users/index.html',<BR>+
description => loc('Manage users and
passwords'),<BR>+
},<BR>+ }<BR>+}<BR> <BR>
$m->comp('/Elements/Callback', tabs => $tabs,
%ARGS);<BR> <BR>-<BR>-<BR>-<BR> </%init><BR></DIV>
<DIV>--- share/html/Admin/Users/index.html Sun Apr 17 21:43:44 2005<BR>+++
local/html/Admin/Users/index.html Tue Sep 6 17:25:13 2005<BR>@@ -56,8
+56,10 @@<BR> % }<BR> %my @ids;<BR> %while ( $user =
$users->Next) {<BR>-% push @ids,
$user->Id;<BR>+% if
(($amisuperuser)||((!$amisuperuser)&&(!$user->HasRight(Object=>$RT::System,Right=>'SuperUser'))))
{<BR>+% push @ids,
$user->Id;<BR> <LI><A
HREF="Modify.html?id=<%$user->id%>"><%$user->Name || loc('(no
name listed)')%></a></LI><BR>+%
}<BR> %}<BR> </UL><BR> %if (my $ids = join(',', @ids))
{<BR>@@ -74,7 +76,7
@@<BR> </FORM><BR> <BR> <%INIT><BR>-my ($user,
$caption);<BR>+my ($user, $caption, $superuser, $amisuperuser);<BR> my
$users = new RT::Users($session{'CurrentUser'});<BR> <BR> if
($FindDisabledUsers) {<BR>@@ -102,6 +104,8 @@<BR>
$caption = loc("Privileged users");<BR>
$users->LimitToPrivileged;<BR> }<BR>+$superuser=new
RT::User($session{'CurrentUser'});<BR>+$amisuperuser=$superuser->CurrentUserHasRight('SuperUser');<BR> </%INIT><BR> <%ARGS><BR> $UserString
=> undef<BR></DIV>
<DIV>--- share/html/Admin/Elements/Tabs Tue Feb 1 09:20:40
2005<BR>+++ local/html/Admin/Elements/Tabs Tue Sep 6 17:37:05
2005<BR>@@ -50,7 +50,12 @@<BR> Title => $Title
&><BR> <BR> <%INIT><BR>- my $tabs = { A => {
title => loc('Users'),<BR>+my ($tabs, $superuser,
$amisuperuser);<BR>+$superuser=new
RT::User($session{'CurrentUser'});<BR>+$amisuperuser=$superuser->CurrentUserHasRight('SuperUser');<BR>+<BR>+if
($amisuperuser) {<BR>+ $tabs = { A => { title =>
loc('Users'),<BR> path =>
'Admin/Users/',<BR> },<BR>
B => { title => loc('Groups'),<BR>@@ -69,6 +74,12
@@<BR> path =>
'Admin/Tools/',<BR>
},<BR> };<BR>+} else {<BR>+ $tabs = {
A => { title => loc('Users'),<BR>+ path =>
'Admin/Users/',<BR>+ },<BR>+
};<BR>+}<BR> <BR> # Now let callbacks add their extra
tabs<BR> $m->comp('/Elements/Callback', tabs => $tabs,
%ARGS);<BR></DIV></FONT></BODY></HTML>