This will have to be addressed in working copy yet, but generally speaking, any user (moderator) who's not an admin should not be able to assign access mask that has higher privileges then his own (minus moderate permission). I've done this on my forum and you reminded me to port it to 1.9.3.
If you want to change it in earlier version then 1.9.3, you'll have to rewrite some portions of code. I don't have the time to dig it right now, but in case you want to do it yourself, write me a PM (PM so I don't forget...) and I'll find some time to post needed code here.
Edited by user
14 years ago
| Reason: Not specified
When I post FP:Ederon in a topic, I'm leaving my footprint there so I can track it once I get into coding/supporting.