6

My users have custom fields for their user account that can contain some sensitive information. To protect against privilege escalation vulnerabilities, I'd like to make these fields only readable and editable after the user enters their password.

Is there a module available for this?

  • 2
    It's not a duplicate. That question is focused on page-level security. I'm talking about field-level. – maxedison Feb 22 '12 at 18:17
  • I agree with @Laxman13 - the answer for the mentioned question fits this use case almost exactly. Use Persistent Login and forget the user session when they reach the profile page. – Chapabu Feb 22 '12 at 18:52
  • 1
    @Chapabu If you agree with Laxman13, you can flag the question to be closed. The number of closing votes, and flags for closing a question are considered, when closing a question. I personally don't think it's a duplicate as the topic is different; if the answer is the same, that doesn't automatically means the question is a duplicate. – kiamlaluno Feb 22 '12 at 19:19
  • 1
    I apologise..I've re-read the question and perhaps Field Permissions may be of some use to you (not marking it as an answer as it may very well not suit)? Perhaps you could temporarily elevate the user role and allow permission for a certain user role and then remove said role after editing is complete? – Chapabu Feb 23 '12 at 9:47
1

Most likely this/these fields appear on a certain page/form so you can use the securepages module to define the node/id or page path to assure that only logged in/authenticated users can access it. If not, then the login page will display. You could also use the loginlogout to return to the calling page upon successful login.

1

*On a per-Form-level: * If you just want certain forms to be submitted with a password, you may extend the form with a password field and user hook_form_validate

  1. add a password field to the form
  2. implement hook_form_validate: only accept the submit if the password matches the users password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.