<p>I’ve built a plugin to allow control over what user groups can allocate permissions.</p>

<p><a href="https://github.com/joshuabaker/Sanction" rel="nofollow">https://github.com/joshuabaker/Sanction</a></p>

CC BY-SA 3.0
2014-08-22T15:11:37.887Z
2014-08-22T15:11:37.887Z
Joshua Baker
<p>At the moment, you can't separate those two permissions issues. However, feel free to put in a feature request to support@buildwithcraft.com or the <a href="https://plus.google.com/u/0/communities/106505340287442511226" rel="nofollow">Google+ community</a>.</p>

<p>As a workaround, here's what I have done... <strong>You can automatically assign a user to a group upon registration.</strong></p>

<p>Change the permissions of your main user group to lock them out of all "Users" management permissions. Add a business logic plugin to your site (if you don't have one already).</p>

<p>Put this into the <strong>init</strong> method of your plugin's main class...</p>

<pre class="lang-php prettyprint-override"><code>public function init() {
    parent::init();
    craft()-&gt;on('users.saveUser', function(Event $event) {

        $targetGroupId = 1;

        // If new user
        if ($event-&gt;params['isNewUser']) {

            // If "groups" is in POST
            if (isset($_POST['groups'])) {

                // If not an array, it's an empty string
                if (!is_array($_POST['groups'])) {
                    // Set it to an array with the user group ID
                    $_POST['groups'] = array($targetGroupId);
                } else {
                    // Merge in the user group ID with any existing ones.
                    $_POST['groups'] = array_merge($_POST['groups'], array($targetGroupId));
                }

            }

        }

    });
}
</code></pre>

CC BY-SA 3.0
2014-08-22T15:10:17.477Z
Thanks for the response, Lindsey. Ideally I need users to have control over this.
Joshua Baker
CC BY-SA 3.0
2014-08-18T16:42:08.573Z
2014-08-18T16:42:08.573Z
Lindsey D
<p>I want to control what users are able to do. For example, prevent access to the CP when the system is off.</p>

<p>How can I <strong>prevent users for assigning extra permissions</strong> but still allow them to assign users to User Groups?</p>

<p>At present, it would appear that anyone able to assign User Groups is also able to assign whatever permissions they want.</p>

<users><security><user-groups>
Prevent users for assigning permissions
# Prevent users for assigning permissions

(Asked by: username_0 on 2014-08-18)

I want to control what users are able to do. For example, prevent access to the CP when the system is off.

How can I **prevent users for assigning extra permissions** but still allow them to assign users to User Groups?

At present, it would appear that anyone able to assign User Groups is also able to assign whatever permissions they want.

**Tags:** users, security, user-groups


---

## 2 answers

### Answer by username_0 on 2014-08-22. Score: 2 | Accepted answer

I’ve built a plugin to allow control over what user groups can allocate permissions.

<https://github.com/joshuabaker/Sanction>


---

### Answer by username_1 on 2014-08-18. Score: 1

At the moment, you can't separate those two permissions issues. However, feel free to put in a feature request to support@buildwithcraft.com or the Google+ community.
As a workaround, here's what I have done... You can automatically assign a user to a group upon registration.
Change the permissions of your main user group to lock them out of all "Users" management permissions. Add a business logic plugin to your site (if you don't have one already).
Put this into the init method of your plugin's main class...
public function init() {
    parent::init();
    craft()->on('users.saveUser', function(Event $event) {

        $targetGroupId = 1;

        // If new user
        if ($event->params['isNewUser']) {

            // If "groups" is in POST
            if (isset($_POST['groups'])) {

                // If not an array, it's an empty string
                if (!is_array($_POST['groups'])) {
                    // Set it to an array with the user group ID
                    $_POST['groups'] = array($targetGroupId);
                } else {
                    // Merge in the user group ID with any existing ones.
                    $_POST['groups'] = array_merge($_POST['groups'], array($targetGroupId));
                }

            }

        }

    });
}

> **Comments:**
> **username_0**: Thanks for the response, Lindsey. Ideally I need users to have control over this.  

---

