The main concern is: Nobody (anonymous/authenticated) has the permission to see the profile of any registered user on the site, so I have UNCHECKED the View user information permission for all roles.
On my site, I have the below roles:
- Role A
- Role B
- Administrator (Default)
I have a content type (Task) with many fields in addition to an "Entity reference" field (field_task_manager) referencing all the users on the site excluding "administrator" role.
I have created a view page display accessed only by "Role A" which will display some field in addition to the user id (UID) of the (field_task_manager)... so:
- Create a view of page display and table format of fields.
- Filter the view to show: content type (Task)
- add all required fields.
- add the field_task_manager field to the view
- under the field settings, change the formatter to Entity ID
If logged in as super user (user:1), all seems good for me!
But if I logged in as a user of Role A and try to access the above view, I cannot see the User ID of the (field_task_manager).
but if I go ahead and CHECK again the View user information permission for all Role A, I can see now the User ID of the (field_task_manager).
However, with the View user information permission CHECKED for Role A, Now Role A can access any user account by simply going to: /user/uid and this what I don't want to happen.
REMEMBER The main concern is: Nobody (anonymous/authenticated) has the permission to see the profile of any registered user on the site.
How can I give the Role A a back end access to user information such as name, email, uid... but without giving him the ability to actually SEE the user profile page of any user ?
Or maybe I am doing something wrong here!
any user has the permission to see his own profile only and not the profiles of others as well.
There is indeed a user profile for every registered user and very well configured and on that profile there is some private fields such as phone number, ID security code* and many other... so I need only the user owner to see his own profile without have the access to see the others user profiles.
I cannot just remove the pathes of the user profiles because I need them to have every user to access his/her own profile.