I have added public profiles following an answer on this stack exchange and it works great, the problem arises when adding a "User Profile Form" which allows users to update their own settings. The problem is that currently, anyone can edit anyone's profile if they were to hardcode the URL to another person profile.

So I'm trying to safeguard it by making sure the profile belongs to the currentUser. This is my setup:

_layout.html

{% set users = craft.users %}

_profile.html

{% extends "_layout" %}

{% block content %}

  {% set user = craft.users.username( craft.request.segment(2) ).first() %}
  {{ user.username }}


{% endblock %}

account.html

{% extends "_layout" %}

{% block content %}

  {% if currentUser.username == user.username %}
    <form method="post" accept-charset="UTF-8">
      {{ getCsrfInput() }}
      <input type="hidden" name="action" value="users/saveUser">
      <input type="hidden" name="redirect" value="users/{{ currentUser.username }}">
      <input type="hidden" name="userId" value="{{ currentUser.id }}">

      <label for="location">Location</label>

      <label for="bio">Bio</label>

      <input type="submit" value="Save Profile">
    </form>
  {% endif %}

{% endblock %}

Right now I'm getting Variable "user" does not exist. but I'm unsure what's the best way to go about safe guarding this?

  • 1
    Why do you give them the permission to edit other profiles and want to remove that/secure it afterwards? I would just not grant them the permission to edit other users in the first place – Robin Schambach Nov 9 at 14:04
  • I agree with @RobinSchambach, this could be better handled with proper permissions set. But, to answer your question, why not just try {% if currentUser.username == craft.request.segment(2) %} The reason variable "user" does not exist is that it's being defined in _profile.html but you're trying to refer to it in account.html. – Mike Pierce 2 days ago

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.