up vote 5 down vote favorite
share [g+] share [fb]

My users have custom fields for their user account that can contain some sensitive information. To protect against privilege escalation vulnerabilities, I'd like to make these fields only readable and editable after the user enters their password.

Is there a module available for this?

link|improve this question
60% accept rate
2  
It's not a duplicate. That question is focused on page-level security. I'm talking about field-level. – maxedison Feb 22 at 18:17
I agree with @Laxman13 - the answer for the mentioned question fits this use case almost exactly. Use Persistent Login and forget the user session when they reach the profile page. – Chapabu Feb 22 at 18:52
1  
@Chapabu If you agree with Laxman13, you can flag the question to be closed. The number of closing votes, and flags for closing a question are considered, when closing a question. I personally don't think it's a duplicate as the topic is different; if the answer is the same, that doesn't automatically means the question is a duplicate. – kiamlaluno♦ Feb 22 at 19:19
1  
I apologise..I've re-read the question and perhaps Field Permissions may be of some use to you (not marking it as an answer as it may very well not suit)? Perhaps you could temporarily elevate the user role and allow permission for a certain user role and then remove said role after editing is complete? – Chapabu Feb 23 at 9:47
show 1 more comment
feedback

2 Answers

up vote 1 down vote

Most likely this/these fields appear on a certain page/form so you can use the securepages module to define the node/id or page path to assure that only logged in/authenticated users can access it. If not, then the login page will display. You could also use the loginlogout to return to the calling page upon successful login.

link|improve this answer
feedback
up vote 1 down vote

*On a per-Form-level: * If you just want certain forms to be submitted with a password, you may extend the form with a password field and user hook_form_validate

  1. add a password field to the form
  2. implement hook_form_validate: only accept the submit if the password matches the users password.
link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.