restrict profile field to module and admin in drupal 6

Question

I am using profile for storing some more information for users. but I want one field of profile be only editable by administrator and my own module code and viewable by own user and administrator.

I guess I have to set visibility of field to ' Hidden profile field, only accessible by administrators, modules and themes. '

but I don't know if it is right or not.

Thank you.

Answer 1

Yep, you got it right.

Inside the profile.module's profile_view_profile() function, it uses the following logic when modifying $user to include the additional fields for viewing...

// Show private fields to administrators and people viewing their own account.
if (user_access('administer users') || $GLOBALS['user']->uid == $user->uid) {
  $result = db_query('SELECT * FROM {profile_fields} WHERE visibility != %d ORDER BY category, weight', PROFILE_HIDDEN);
}
else {
  $result = db_query('SELECT * FROM {profile_fields} WHERE visibility != %d AND visibility != %d ORDER BY category, weight', PROFILE_PRIVATE, PROFILE_HIDDEN);
}

...so yes, settings fields to PROFILE_HIDDEN will show them only to users with the administer users permission and/or to the user who is viewing his/her own account.

When editing a user, the module calls upon the _profile_get_fields() function to present the fields to be edited on the resulting form, and there, it uses the logic...

if (!user_access('administer users')) {
  $filters[] = 'visibility != %d';
  $args[] = PROFILE_HIDDEN;
}

...to restrict the editing of these fields to just users with the administer users permission by filtering out those fields from users without that permission.

And, of course, if your module or theme wants to edit anything in the database directly, there is nothing to really stop it.