6

My users have custom fields for their user account that can contain some sensitive information. To protect against privilege escalation vulnerabilities, I'd like to make these fields only readable and editable after users enters their password.

Is there a module available for this?

Improve this question
7
  • possible duplicate of Is there a module that can force a user to relogin when they got to a specific section (like admin)?
    – Laxman13
    Commented Feb 22, 2012 at 17:53
  • 2
    It's not a duplicate. That question is focused on page-level security. I'm talking about field-level.
    – maxedison
    Commented Feb 22, 2012 at 18:17
  • I agree with @Laxman13 - the answer for the mentioned question fits this use case almost exactly. Use Persistent Login and forget the user session when they reach the profile page.
    – Chapabu
    Commented Feb 22, 2012 at 18:52
  • 1
    @Chapabu If you agree with Laxman13, you can flag the question to be closed. The number of closing votes, and flags for closing a question are considered, when closing a question. I personally don't think it's a duplicate as the topic is different; if the answer is the same, that doesn't automatically means the question is a duplicate.
    – avpaderno ♦
    Commented Feb 22, 2012 at 19:19
  • 1
    I apologise..I've re-read the question and perhaps Field Permissions may be of some use to you (not marking it as an answer as it may very well not suit)? Perhaps you could temporarily elevate the user role and allow permission for a certain user role and then remove said role after editing is complete?
    – Chapabu
    Commented Feb 23, 2012 at 9:47

2 Answers 2

Reset to default
1

Most likely this/these fields appear on a certain page/form so you can use the securepages module to define the node/id or page path to assure that only logged in/authenticated users can access it. If not, then the login page will display. You could also use the loginlogout to return to the calling page upon successful login.

Improve this answer
1

On the per-Form-level:

If you just want certain forms to be submitted with a password, you may extend the form with a password field and use hook_form_validate

  1. add a password field to the form
  2. implement hook_form_validate: only accept the submit if the password matches the users password.
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.