6

This may be a really stupid question, but we can't see how to make it work.

We have a Drupal 7 site with several different rôles and one of them should not be able to see the user profiles of the others. Now I thought that would be simple, by unchecking the "View user profiles" permission in the People admin.

But that prevents them accessing their own profiles as well. From what I can gather, there isn't a simple way of making this be the case, so I'm looking for any sensible suggestions on how I can make it happen -- code edits, modules, whatever.

Thanks everyone! (And let me know if I need to provide more information about our configuration or Modules we have installed.)

Improve this question

3 Answers 3

Reset to default
4

You could do this with a custom rule, as follows:

{ "rules_users_view_own_profile_only" : { "LABEL" : "Users View Own Profile Only", "PLUGIN" : "reaction rule", "REQUIRES" : [ "rules" ], "ON" : [ "user_view" ], "IF" : [ { "NOT user_has_role" : { "account" : [ "site:current-user" ], "roles" : { "value" : { "3" : "3" } } } }, { "AND" : [] }, { "NOT data_is" : { "data" : [ "site:current-user:uid" ], "value" : [ "account:uid" ] } } ], "DO" : [ { "redirect" : { "url" : "http:\/\/www.yourdomain.com\/denied" } } ] } }

That basically checks to make sure the user isn't an admin or on his own account page before directing to yourdomain.com. If you use the CustomError module, you can redirect to an access denied page.

You might also want to check out the Edit own user account permission module - you might be able to enable that and disable "View user profiles" and get the results you want, although I haven't tried that.

Improve this answer
3
  • I asked the same thing of our developer (who's no longer with the company) and the suggestion he came back with is almost identical to this. Thanks, Benjamin; I'm gonna go give it a try now and, hopefully, I'll be able to come back and give you a big green tick.# Commented Jan 19, 2012 at 11:25
  • And indeed that's exactly what I needed. Thanks again! Commented Jan 19, 2012 at 11:38
  • Happy to help. Cheers! Commented Jan 20, 2012 at 1:50
2

For this trick you can use chain_menu_access module. Code below.

/** * Implements hook_menu_alter(). */ function hook_menu_alter(&$items) { chain_menu_access_chain($items, 'user/%user', '_mymodule_check_permission'); } function _mymodule_check_permission() { global $user; $own_profile = $user->uid == arg(1); $has_access = user_access('administer users'); return (!$has_access && !$own_profile) ? FALSE : TRUE; }

In your case, you can use different permission instead 'administer users'.

Improve this answer
0

You can accomplish this with Page Manager. You basically create different variants for the "User profile template" under: admin/structure/pages/edit/user_view ( /user/%user ) and there you give the access permissions through "selection rules". For example: choose from the context drop down: "User: compare" and set it to "User being viewed is Logged in user". You can do the same for a plethora of contexts and therefore also roles, so you can combine them and create your access permissions like that. Finally, I advise you to create a variant that redirects if someone wants to view another user's profile page or instead of adding custom content in your "content" tab on the variant, set a response code "403 Access Denied" for example to be safe. Now you have full control of which fields show and which don't and what happens when visitors or users access their own or other users' profile pages.

Improve this answer

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.