0

I am using profile for storing some more information for users. but I want one field of profile be only editable by administrator and my own module code and viewable by own user and administrator.

I guess I have to set visibility of field to ' Hidden profile field, only accessible by administrators, modules and themes. '

but I don't know if it is right or not.

Thank you.

1 Answer 1

0

Yep, you got it right.

Inside the profile.module's profile_view_profile() function, it uses the following logic when modifying $user to include the additional fields for viewing...

// Show private fields to administrators and people viewing their own account.
if (user_access('administer users') || $GLOBALS['user']->uid == $user->uid) {
  $result = db_query('SELECT * FROM {profile_fields} WHERE visibility != %d ORDER BY category, weight', PROFILE_HIDDEN);
}
else {
  $result = db_query('SELECT * FROM {profile_fields} WHERE visibility != %d AND visibility != %d ORDER BY category, weight', PROFILE_PRIVATE, PROFILE_HIDDEN);
}

...so yes, settings fields to PROFILE_HIDDEN will show them only to users with the administer users permission and/or to the user who is viewing his/her own account.

When editing a user, the module calls upon the _profile_get_fields() function to present the fields to be edited on the resulting form, and there, it uses the logic...

if (!user_access('administer users')) {
  $filters[] = 'visibility != %d';
  $args[] = PROFILE_HIDDEN;
}

...to restrict the editing of these fields to just users with the administer users permission by filtering out those fields from users without that permission.

And, of course, if your module or theme wants to edit anything in the database directly, there is nothing to really stop it.

2
  • If I want to change the hidden value by module when user is not logged in I have to change it directly in database?
    – hd.
    May 14, 2013 at 4:07
  • the only users that can edit/change a PROFILE_HIDDEN via the form are ones with administer users permission; a or your module should be able to change anything it wants programatically.
    – Jimajamma
    May 14, 2013 at 11:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.