5

This may be a really stupid question, but we can't see how to make it work.

We have a Drupal 7 site with several different rôles and one of them should not be able to see the user profiles of the others. Now I thought that would be simple, by unchecking the "View user profiles" permission in the People admin.

But that prevents them accessing their own profiles as well. From what I can gather, there isn't a simple way of making this be the case, so I'm looking for any sensible suggestions on how I can make it happen -- code edits, modules, whatever.

Thanks everyone! (And let me know if I need to provide more information about our configuration or Modules we have installed.)

4

You could do this with a custom rule, as follows:

{ "rules_users_view_own_profile_only" : {
    "LABEL" : "Users View Own Profile Only",
    "PLUGIN" : "reaction rule",
    "REQUIRES" : [ "rules" ],
    "ON" : [ "user_view" ],
    "IF" : [
        { "NOT user_has_role" : { "account" : [ "site:current-user" ], "roles" : { "value" : { "3" : "3" } } } },
        { "AND" : [] },
        { "NOT data_is" : { "data" : [ "site:current-user:uid" ], "value" : [ "account:uid" ] } }
    ],
    "DO" : [ { "redirect" : { "url" : "http:\/\/www.yourdomain.com\/denied" } } ]
    }
}

That basically checks to make sure the user isn't an admin or on his own account page before directing to yourdomain.com. If you use the CustomError module, you can redirect to an access denied page.

You might also want to check out the Edit own user account permission module - you might be able to enable that and disable "View user profiles" and get the results you want, although I haven't tried that.

  • I asked the same thing of our developer (who's no longer with the company) and the suggestion he came back with is almost identical to this. Thanks, Benjamin; I'm gonna go give it a try now and, hopefully, I'll be able to come back and give you a big green tick.# – Owen Blacker Jan 19 '12 at 11:25
  • And indeed that's exactly what I needed. Thanks again! – Owen Blacker Jan 19 '12 at 11:38
  • Happy to help. Cheers! – BenjaminRH Jan 20 '12 at 1:50
2

For this trick you can use chain_menu_access module. Code below.

/**
 * Implements hook_menu_alter().
 */
function hook_menu_alter(&$items) {
  chain_menu_access_chain($items, 'user/%user', '_mymodule_check_permission');
}

function _mymodule_check_permission() {
  global $user;

  $own_profile = $user->uid == arg(1);
  $has_access = user_access('administer users');

  return (!$has_access && !$own_profile) ? FALSE : TRUE;
}

In your case, you can use different permission instead 'administer users'.

0

You can accomplish this with Page Manager. You basically create different variants for the "User profile template" under: admin/structure/pages/edit/user_view ( /user/%user ) and there you give the access permissions through "selection rules". For example: choose from the context drop down: "User: compare" and set it to "User being viewed is Logged in user". You can do the same for a plethora of contexts and therefore also roles, so you can combine them and create your access permissions like that. Finally, I advise you to create a variant that redirects if someone wants to view another user's profile page or instead of adding custom content in your "content" tab on the variant, set a response code "403 Access Denied" for example to be safe. Now you have full control of which fields show and which don't and what happens when visitors or users access their own or other users' profile pages.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.