Answers.Body: <p>I’ve built a plugin to allow control over what user groups can allocate permissions.</p>
  
  <p><a href="https://github.com/joshuabaker/Sanction" rel="nofollow">https://github.com/joshuabaker/Sanction</a></p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-08-22T15:11:37.887Z
Answers.LastActivityDate: 2014-08-22T15:11:37.887Z
Answers.UserDisplayName: Joshua Baker
Answers.Body: <p>At the moment, you can't separate those two permissions issues. However, feel free to put in a feature request to support@buildwithcraft.com or the <a href="https://plus.google.com/u/0/communities/106505340287442511226" rel="nofollow">Google+ community</a>.</p>
  
  <p>As a workaround, here's what I have done... <strong>You can automatically assign a user to a group upon registration.</strong></p>
  
  <p>Change the permissions of your main user group to lock them out of all "Users" management permissions. Add a business logic plugin to your site (if you don't have one already).</p>
  
  <p>Put this into the <strong>init</strong> method of your plugin's main class...</p>
  
  <pre class="lang-php prettyprint-override"><code>public function init() {
      parent::init();
      craft()-&gt;on('users.saveUser', function(Event $event) {
  
          $targetGroupId = 1;
  
          // If new user
          if ($event-&gt;params['isNewUser']) {
  
              // If "groups" is in POST
              if (isset($_POST['groups'])) {
  
                  // If not an array, it's an empty string
                  if (!is_array($_POST['groups'])) {
                      // Set it to an array with the user group ID
                      $_POST['groups'] = array($targetGroupId);
                  } else {
                      // Merge in the user group ID with any existing ones.
                      $_POST['groups'] = array_merge($_POST['groups'], array($targetGroupId));
                  }
  
              }
  
          }
  
      });
  }
  </code></pre>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-08-22T15:10:17.477Z
Answers.Text: Thanks for the response, Lindsey. Ideally I need users to have control over this.
Answers.UserDisplayName: Joshua Baker
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-08-18T16:42:08.573Z
Answers.LastActivityDate: 2014-08-18T16:42:08.573Z
Answers.UserDisplayName: Lindsey D
Body: <p>I want to control what users are able to do. For example, prevent access to the CP when the system is off.</p>
  
  <p>How can I <strong>prevent users for assigning extra permissions</strong> but still allow them to assign users to User Groups?</p>
  
  <p>At present, it would appear that anyone able to assign User Groups is also able to assign whatever permissions they want.</p>
  
Tags: <users><security><user-groups>
Title: Prevent users for assigning permissions
ThreadText: # Prevent users for assigning permissions
  
  (Asked by: username_0 on 2014-08-18)
  
  I want to control what users are able to do. For example, prevent access to the CP when the system is off.
  
  How can I **prevent users for assigning extra permissions** but still allow them to assign users to User Groups?
  
  At present, it would appear that anyone able to assign User Groups is also able to assign whatever permissions they want.
  
  **Tags:** users, security, user-groups
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_0 on 2014-08-22. Score: 2 | Accepted answer
  
  I’ve built a plugin to allow control over what user groups can allocate permissions.
  
  <https://github.com/username_0/Sanction>
  
  
  ---
  
  ### Answer by username_1 on 2014-08-18. Score: 1
  
  At the moment, you can't separate those two permissions issues. However, feel free to put in a feature request to support@buildwithcraft.com or the [Google+ community](https://plus.google.com/u/0/communities/106505340287442511226).
  
  As a workaround, here's what I have done... **You can automatically assign a user to a group upon registration.**
  
  Change the permissions of your main user group to lock them out of all "Users" management permissions. Add a business logic plugin to your site (if you don't have one already).
  
  Put this into the **init** method of your plugin's main class...
  
  ```php
  public function init() {
      parent::init();
      craft()->on('users.saveUser', function(Event $event) {
  
          $targetGroupId = 1;
  
          // If new user
          if ($event->params['isNewUser']) {
  
              // If "groups" is in POST
              if (isset($_POST['groups'])) {
  
                  // If not an array, it's an empty string
                  if (!is_array($_POST['groups'])) {
                      // Set it to an array with the user group ID
                      $_POST['groups'] = array($targetGroupId);
                  } else {
                      // Merge in the user group ID with any existing ones.
                      $_POST['groups'] = array_merge($_POST['groups'], array($targetGroupId));
                  }
  
              }
  
          }
  
      });
  }
  
  ```
  
  > **Comments:**
  > **username_0**: Thanks for the response, username_1. Ideally I need users to have control over this.  
  
  ---
  
  