I have a multi-node Drupal-6 installation containing sites from different clients.
Each site has an administrator role, which primarily includes a client account. We want to grant as many rights as possible to this privileged user, but this can lead to security leaks using only the Drupal Core permission management system.
The main thing to avoid is that the client account can run PHP code on the server (this would be similar to registering on the server, since the www-data .. user sounds very bad).
To avoid this, it is not enough to refuse to evaluate the PHP code for this role. Since the administrator role must have permissions to manage users, he can also change the password of user No. 1 and enter the site as a superadmin.
The second goal would be to deny also some “confusing” administrative pages (such as module selection), but not others (for example, setting up information about sites, choosing a theme, etc.).
I found a User One module that seems to fix the first problem, but I have no idea how to solve the second. I found several modules, but no one seems to fit. It seems that most ACLs are believed to protect content , not the site itself, as if the site administrator always had the server itself.
source share