How to hide a custom user field in user profile?

Question

In Drupal 7, what is the best way to prevent any non-administrative user from changing a custom user profile field?

Use case: I've created a user field called "Customer ID" that I do not want the user (any of my actual customers) to change. The field exists for my own reference and for programmatic usage in other modules. I don't mind the user seeing Customer ID, but they should not be able to edit it.

Should I override the page template for the user profile page? If so, how is the template changed to make a field read-only or invisible?

Thank you very much for your help!

Chris

Answer 1

I think Field Permissions is what you are looking for. Here is a quote about it (from the module's project page):

... allows site administrators to set field-level permissions to edit, view and create fields on any entity.

Features:

• Enable field permissions on any entity, not just nodes.
• Role-based field permissions allowing different viewing patterned based on what access the user has.
• Author-level permissions allow viewing and editing of fields based on who the entity owner is.
• Permissions for each field are not enabled by default. Instead, administrators can enable these permissions explicitly for the fields where this feature is needed.
• Field permissions overview

Answer 2

To hide the field from the user profile form you can set the #access property of a field to FALSE using hook_form_FORMID_alter.

The following snippet hides the field field_organisation from the user profile form for non-admins:

function YOURCUSTOMMODULE_form_user_profile_form_alter(&$form, &$form_state, $form_id) {
  $current_user = user_uid_optional_load();
  if($current_user->uid != 1) {
    $form['field_organisation']['#access'] = FALSE;
  }
}

See also this similar question on drupalanswers

You can also hide the field from the user profile page (not the form) using template_preprocess_user_profile

The following snippet hides the field field_organisation from the user page for non-admins:

function YOURCUSTOMMODULE_preprocess_user_profile(&$vars) {
  $current_user = user_uid_optional_load();
  if($current_user->uid != 1) {
    unset($vars['user_profile']['field_organisation']);
  }
}

Answer 3

Seems to be there is a module called http://drupal.org/project/user_readonly "The module allows an administrator to prevent modification of user account/profile fields. The administrator can select which fields will be disallowed, or which fields will be allowed."

Answer 4

hook_form_alter will work for Drupal 8/9 as well, we can hide other custom fields in User profile using #access attribute of form elements:

use Drupal\Core\Form\FormStateInterface;

hook_form_alter(&$form, FormStateInterface $form_state, $form_id) {
{
    // Disable form fields based on User Roles
    if ($form_id == 'user_form') { 
      $roles = \Drupal::currentUser()->getRoles();
      if (!in_array('administrator', $roles)){
        // Do something if user has no role administrator;
        $form['account']['roles']['#access'] = FALSE;
        $form['field_organizations_reference']['#access'] = FALSE;
      }
      if (in_array('administrator', $roles)){
         // Do something if user has role administrator;
         $form['account']['roles']['#access'] = TRUE;
         $form['field_organizations_reference']['#access'] = TRUE;
      }
      // Do other stuff for your other roles 
    }
}