# User can change his own role in panel when changeRole is turned off **URL:** \ **Category:** Questions\ **Tags:** v3\ **Created:** [January 22, 2019, 9:41am UTC](https://forum.getkirby.com/t/user-can-change-his-own-role-in-panel-when-changerole-is-turned-off/12341 "2019-01-22T09:41:50Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![kaloja](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/kaloja/32/3470_2.png) [@kaloja](https://forum.getkirby.com/u/kaloja)\ **Post date:** [January 22, 2019, 9:41am UTC](https://forum.getkirby.com/t/user-can-change-his-own-role-in-panel-when-changerole-is-turned-off/12341/1 "2019-01-22T09:41:50Z")
I think this is a critical bug for the user roles system. The user can change his own role in panel from “Your account” even when changeRole: false is set in the user blueprint. My blueprint: ```auto title: Reviewer permissions: access: panel: true users: false site: true site: update: false users: false ``` I also tested this: ```auto title: Reviewer permissions: access: panel: true users: false site: true site: update: false users: create: false createAvatar: false deleteAvatar: false changeName: false changeEmail: false changePassword: false changeRole: false delete: false update: false ``` ---
**Author:** ![jimbobrjames](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/jimbobrjames/32/5802_2.png) [@jimbobrjames](https://forum.getkirby.com/u/jimbobrjames)\ **Post date:** [January 22, 2019, 9:43am UTC](https://forum.getkirby.com/t/user-can-change-his-own-role-in-panel-when-changerole-is-turned-off/12341/2 "2019-01-22T09:43:28Z")
Could you post the whole blueprint please? ---
**Author:** ![kaloja](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/kaloja/32/3470_2.png) [@kaloja](https://forum.getkirby.com/u/kaloja)\ **Post date:** [January 22, 2019, 9:47am UTC](https://forum.getkirby.com/t/user-can-change-his-own-role-in-panel-when-changerole-is-turned-off/12341/3 "2019-01-22T09:47:00Z")
Yes, updated my post. See above. ---
**Author:** ![jimbobrjames](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/jimbobrjames/32/5802_2.png) [@jimbobrjames](https://forum.getkirby.com/u/jimbobrjames)\ **Post date:** [January 22, 2019, 10:15am UTC](https://forum.getkirby.com/t/user-can-change-his-own-role-in-panel-when-changerole-is-turned-off/12341/4 "2019-01-22T10:15:33Z")
Yes, I think you are right. I’m getting some issues too. With your blue print in place, I can still change the role when logged in as a Reviewer. If I log into the reviewer account and log out again, this happens… ![warning](https://europe1.discourse-cdn.com/flex017/uploads/getkirby/original/2X/0/0e6bf14b9014d40ed3617d36dcfba9b75f2df01c.jpeg) Looking at your blueprint against the documentation I cant see any issues with it. I’m sure one of the support team will see this shortly. **Edit:** The role setting seems to work if you log out, clear the cache and log in again. You shouldnt have to do that though, I dont think. ---
**Author:** ![texnixe](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/texnixe/32/5754_2.png) [@texnixe](https://forum.getkirby.com/u/texnixe)\ **Post date:** [January 22, 2019, 10:27am UTC](https://forum.getkirby.com/t/user-can-change-his-own-role-in-panel-when-changerole-is-turned-off/12341/5 "2019-01-22T10:27:31Z")
As an admin, I created a new user with the reviewer role. Then logged in as this reviewer. Result: The reviewer cannot access the user section with this setting at all with the first blueprint. ---
**Author:** ![kaloja](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/kaloja/32/3470_2.png) [@kaloja](https://forum.getkirby.com/u/kaloja)\ **Post date:** [January 22, 2019, 10:28am UTC](https://forum.getkirby.com/t/user-can-change-his-own-role-in-panel-when-changerole-is-turned-off/12341/6 "2019-01-22T10:28:50Z")
@texnixe The bug is when you click on “Your account” and then on the role. ---
**Author:** ![jimbobrjames](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/jimbobrjames/32/5802_2.png) [@jimbobrjames](https://forum.getkirby.com/u/jimbobrjames)\ **Post date:** [January 22, 2019, 10:30am UTC](https://forum.getkirby.com/t/user-can-change-his-own-role-in-panel-when-changerole-is-turned-off/12341/7 "2019-01-22T10:30:54Z")
> [@texnixe](#): > > The reviewer cannot access the user section with this setting at all with the first blueprint. Yes that worked for me too, its the second blue print that seems to have issues. ---
**Author:** ![kaloja](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/kaloja/32/3470_2.png) [@kaloja](https://forum.getkirby.com/u/kaloja)\ **Post date:** [January 22, 2019, 10:33am UTC](https://forum.getkirby.com/t/user-can-change-his-own-role-in-panel-when-changerole-is-turned-off/12341/8 "2019-01-22T10:33:10Z")
Screenshots taken with this blueprint: ```auto title: Redaktör fields: name: label: Namn type: text permissions: access: panel: true users: false site: true site: update: false pages: delete: false users: false ``` 1. Click your account 2. Click on the role line ![28](https://europe1.discourse-cdn.com/flex017/uploads/getkirby/original/2X/a/ab8603f880d39995226b1056bb6617628d8d068e.png) 3. Popup modal with option to change your role ---
**Author:** ![texnixe](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/texnixe/32/5754_2.png) [@texnixe](https://forum.getkirby.com/u/texnixe)\ **Post date:** [January 22, 2019, 10:55am UTC](https://forum.getkirby.com/t/user-can-change-his-own-role-in-panel-when-changerole-is-turned-off/12341/9 "2019-01-22T10:55:38Z")
I think the problem is that you use the wrong setting. There is a `users` setting and a `user` setting and to deny access to a single user or to restrict what the user can do, you need the `user` setting. ---
**Author:** ![jimbobrjames](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/jimbobrjames/32/5802_2.png) [@jimbobrjames](https://forum.getkirby.com/u/jimbobrjames)\ **Post date:** [January 22, 2019, 10:57am UTC](https://forum.getkirby.com/t/user-can-change-his-own-role-in-panel-when-changerole-is-turned-off/12341/10 "2019-01-22T10:57:28Z")
> [@texnixe](#): > > There is a `users` setting and a `user` setting That isn’t detailed in [the docs](https://getkirby.com/docs/guide/users/permissions), only settings for `users` is. ---
**Author:** ![texnixe](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/texnixe/32/5754_2.png) [@texnixe](https://forum.getkirby.com/u/texnixe)\ **Post date:** [January 22, 2019, 10:58am UTC](https://forum.getkirby.com/t/user-can-change-his-own-role-in-panel-when-changerole-is-turned-off/12341/11 "2019-01-22T10:58:15Z")
![53](https://europe1.discourse-cdn.com/flex017/uploads/getkirby/original/2X/d/daa7797569f6cad4b6dd0c232c54c6dd29c2357c.png) > **[User blueprint](https://getkirby.com/docs/reference/panel/blueprints/user#permissions)** > > User blueprints are located in /site/blueprints/users and control the Panel setup, form fields and permissions for a user role. But yes, in the guide, that seems to be an error. The blueprint should look like this: ```auto title: Reviewer permissions: access: panel: true users: false site: true site: update: false user: changeRole: false ``` I.e. with access \> users \> false, and then just the single user settings. ---
**Author:** ![texnixe](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/texnixe/32/5754_2.png) [@texnixe](https://forum.getkirby.com/u/texnixe)\ **Post date:** [January 22, 2019, 11:03am UTC](https://forum.getkirby.com/t/user-can-change-his-own-role-in-panel-when-changerole-is-turned-off/12341/12 "2019-01-22T11:03:58Z")
I created an issue to fix this. ---
**Author:** ![kaloja](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/kaloja/32/3470_2.png) [@kaloja](https://forum.getkirby.com/u/kaloja)\ **Post date:** [January 22, 2019, 11:04am UTC](https://forum.getkirby.com/t/user-can-change-his-own-role-in-panel-when-changerole-is-turned-off/12341/13 "2019-01-22T11:04:59Z")
That works. Superb help @texnixe ---
**Author:** ![texnixe](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/texnixe/32/5754_2.png) [@texnixe](https://forum.getkirby.com/u/texnixe)\ **Post date:** [January 22, 2019, 11:06am UTC](https://forum.getkirby.com/t/user-can-change-his-own-role-in-panel-when-changerole-is-turned-off/12341/14 "2019-01-22T11:06:53Z")
@kaloja Sorry for the trouble caused by incorrect documentation. ---
**Author:** ![sennah](https://avatars.discourse-cdn.com/v4/letter/s/9fc348/32.png) [@sennah](https://forum.getkirby.com/u/sennah)\ **Post date:** [January 28, 2019, 11:53am UTC](https://forum.getkirby.com/t/user-can-change-his-own-role-in-panel-when-changerole-is-turned-off/12341/15 "2019-01-28T11:53:33Z")
Just to add this: In the docs, “user blueprint permissions” seem to be a bit inconsistent between the guide (usres \> permissions) and the reference (panel \> blueprints \> user blueprint). Some options are missing in the reference; and “access \> settings” seems not to be documented at all.