I was modifying a 2fa module for restricting users to access other account's page (user/%/2fa) which is working.
function custom_2fa_menu() {
$items['user/%/2fa'] = [
'title' => t('2FA Settings'),
'type' => MENU_LOCAL_TASK,
'file' => 'inc/user.inc',
'page callback' => 'drupal_get_form',
'page arguments' => ['custom_2fa_settings_form', 1],
'access callback' => 'custom_2fa_extra_settings_access',
'access arguments' => [1]
];
return $items;
}
function custom_2fa_extra_settings_access($account) {
$uid = is_object($account) ? $account->uid : (int) $account;
// Never allow access to view the anonymous user account.
if ($uid) {
// Admins can view all, users can view own profiles at all times.
if ($GLOBALS['user']->uid == $uid || user_access('administer users')) {
return TRUE;
}
elseif (user_access('access user profiles')) {
// At this point, load the complete account object.
if (!is_object($account)) {
$account = user_load($uid);
}
return (is_object($account) && $account->status);
}
}
return FALSE;
}
But is there a way to restrict user from access all the pages except (register, login, user change password, user/%/2fa) base from a database table's enabled column as well?
The db table custom_2fa_settings
below:
+-----+------------------------------------------------------------------+---------+
| uid | secret | enabled |
+-----+------------------------------------------------------------------+---------+
| 50 | TGP4DCVOGPCWBHYCW7MLR5EN3VZNNC2JXOYN5DXVKJK5BVMI5YV4O5HPJME | 1 |
| 1 | ODNYTJPL52JRXQYVKDTKI7FH3TWIXAFRCKYMCCUZB2DY4S5HPC7OG3DSINH | 0 |
| 32 | RUUKOVZIF3ECOPR33YNSZJBCANSTS6FMUZWHSXQZOLLZE6YCYS7KFIJ4LQV | 0 |