What is the best way to disable access to the user's profile for viewing and editing? Basically users can create an account but won't be able to edit or view their own or other users' profiles.
Add this to a custom module:
This will put the user profile view under 'View user profiles' permission and edit under 'Administer users'.
Instead of creating a module for that you could simply create a rule.
Here's a how-to:
step 1: create a rule that acts on this event: "User account page is viewed"
step 2: set a condition, something like: "NOT User has role(s) Parameter: User: [account], Roles: administrator"
step 3: create an action: "Page redirect Parameter: URL: toboggan/denied" (in case you are using login toboggan but any page url should work here so you could create a page especially for that saying something like: "We're very sorry but at this moment you can't access your profile page."
step 4: make this rule active for example in case you wanted to get the latest version of your production site, download a sql backup, fiddle around with it locally and then be sure to upload it again without disappointing any users who might wanted to update their profile in the mean time.
additionally you could also add another condition to check if the user is viewing another user's profile page or their own so that you make two different rules, one which shows a page saying that they temporarily can't update their profile and another rule which shows a page that states why they can't view a particular user's profile.
I've tested this and added this condition: "Data comparison Parameter: Data to compare: [account], Data value: [site:current-user]" What this does is only deny access to view their own account and then show the correct page you created for this denied access. I think this makes more sense.