Details
-
Type:
New Feature
-
Status:
Open
-
Priority:
Minor
-
Resolution: Unresolved
-
Affects Version/s: 1.9.3
-
Fix Version/s: None
-
Component/s: Administration
-
Labels:None
-
Affected Branches:MOODLE_19_STABLE
Description
This came out of a conversation over lots of pasta with Skodak.....
In order to recover lost administration rights, implement something similar to Gallery. The outline is as follows...
- Create a "hidden" (but documented) script in the admin folder..... recoveradmin.php or somesuch
- It invites you to create a file in the moodle root with a given name and a randomly generated key therein and then refresh the page
- The rest of the process is locked out until this file is found to be correct - obviously, this needs to be locked down properly (I'll look/steal what Gallery does)
- Once you're in there it will do this...
-
- Allow a new manual user to be created and assigned to the administrator role
- Reset the administrator role (and assignment rights) to default
- Reset the User Policy settings to default (a source of locked out admins)
-
- The above should be options probably
- The Moodle site will NOT run with the key file in place as an additional security feature.
Issue Links
| This issue has been marked as being related by: | ||||
| MDL-16549 | Should not be able to remove moodle/site:doanything from the Administrator Role, or add it to other roles |
|
|
|
MDL-16549will help prevent people screwing up the definition of the admin role.Moodle 1.6 prevented admins from unassigning the admin role form themself. We should reinstate that feature (
MDL-17067), it stops a number of screw-ups:However, I don't think we can completely eliminate the need for what is proposed here, so go for it.
MDL-16549will help prevent people screwing up the definition of the admin role. Moodle 1.6 prevented admins from unassigning the admin role form themself. We should reinstate that feature (MDL-17067), it stops a number of screw-ups:- It means that there is always at least one admin
- It means you cannot hand over admin responsibility to someone else until you have shown them at least how to unassign the admin role from yourself.
However, I don't think we can completely eliminate the need for what is proposed here, so go for it.