I need to do this in a Drupal 6 installation, with the Organic Groups module:

The user that has administrator rights within a group can edit all members default profiles.

I just want the admin of an OG to be able to change each user´s email address, but the line above reflects the generic use case.

Any thoughts on how to complete that task?



2 Answers 2


As mentioned in my other answer, user profile access does not have any kind of ACL system, which requires more hackish workarounds.

Instead of the hook_menu_alter() approach I described, you could instead embed the same form in a second menu path, this one at something like og/%node/user/%user/edit. At this path, the group context is active, which means you could simply use og_is_group_admin() as the menu access callback and the form should work.

By placing the same form in this second location, all modules that tweak the form should apply unless they are misusing the path to get user id arguments. You could also use some kind of trick in a hook_form_alter() to recognize that a given instance of the form is generated at your special path, and use that to remove form elements you do not want to share with group administrators.


User Profile Access does not have elaborate access control in the fashion of nodes, so the answer is a custom module that takes over the profile edit page's menu access callback.

Use hook_menu_alter() on user/%user/edit and set 'access callback' to custom_user_edit_access. In that function, run the original access logic to preserve normal behavior, but then add another layer that checks to see if the current user is an administrator in the group and if the active user profile's user is in the group.

For D6, you can either check the user data structure directly, or use the API functions og_is_group_member() and og_is_group_admin().

If you want to special-case the email field to a specific permission once the user has access to the form, that's a case for hook_form_alter() and changing the email field's #access element to use a new permission or an access callback with logic of it's own.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.