Commit 6f555e54 authored by Remco Kranenburg's avatar Remco Kranenburg Committed by Tim Graham
Browse files

[1.8.x] Refs #23559 -- warned about consequences of letting users edit User model in admin.

Backport of f6b09a7f from master
parent 06085024
Loading
Loading
Loading
Loading
+5 −0
Original line number Diff line number Diff line
@@ -1427,6 +1427,11 @@ have the power to create superusers, which can then, in turn, change other
users. So Django requires add *and* change permissions as a slight security
measure.

Be thoughtful about how you allow users to manage permissions. If you give a
non-superuser the ability to edit users, this is ultimately the same as giving
them superuser status because they will be able to elevate permissions of
users including themselves!

Changing Passwords
------------------