1

Just looking at finding the best ways ways to protect member profile editing pages.

I have members profiles set up under a template structure such as

members/profile/{member_id}/sub-page

Thats is fine, all these pages are public. I do however show, on the members own profile page, a link to edit their details. This is displayed via the conditional

{if segment_3 == logged_in_member_id}                   
   <a href="{path='members/account/{member_id}/profile'}">Edit Your Account</a>
{/if}

I then have the account edit pages such as (this is actually one template using switchee)

members/account/{member_id}/profile
members/account/{member_id}/password
members/account/{member_id}/avatar
members/account/{member_id}/notifications

But these pages should only be viewed by the logged in member, which at the moment is easily bypassed via just changing the member_id in the URL.

So what would be the best way to protect these pages, so if someone did try and change the member_id in the URL, they would not be able to access other users pages.

Thanks!

(And whilst I'm on this subject, is is possible to use the username in the URL as opposed to the member_id ?

Many thanks!

  • What add-on are you using to allow editing of member profiles in templates? – Alex Kendrick Feb 1 '13 at 18:24
  • A mix of User and Freemember. – shorn Feb 1 '13 at 20:21
  • I updated my answer with a second option that is specific to those add-ons. – Alex Kendrick Feb 2 '13 at 16:20
5

Option 1: Use Conditionals

In your members/account/{member_id}/profile template (or portion of your template, since you're using Switchee), you can wrap the profile-editing form and other content in a conditional to make sure the user can only edit their own profile. All other users can be shown alternate content (an error message in this example):

{if segment_3 == logged_in_member_id}                   
   {!-- Profile-editing template stuff here --}
{/if}

{if segment_3 != logged_in_member_id}                   
   <div class="error">You are not authorized to access this page.</div>
{/if}

Option 2: Avoid segment variables and rely on your add-on(s)

Another option, since you are using User and/or FreeMember, is to rely on their profile editing tags to take care of locking down the forms so that users cannot edit other user's profiles.

The FreeMember update_profile tag is automatically tied to the currently logged in user.

Or with User's edit tag you should be able to specify the member_id parameter to be {logged_in_member_id} to limit the edit form only to the currently logged in user.

With either of these two add-on-specific methods you don't need to rely on the member_id being in the URL and so you avoid the issue entirely.

  • 2
    You could just use the second conditional like so. {if segment_3 != logged_in_member_id}{redirect="unauthorized"}{/if} – Jason Varga Feb 1 '13 at 18:31
  • Thanks for these suggestions, I was thinking of something along these lines, but wasn't sure if there was a better / method. Will give it a go! – shorn Feb 1 '13 at 20:23
  • Thanks for the update with option two. This is what I have working now, and it seems pretty robust. Every time I change a member I'd in the URL, it just stays on my edit pages! Thumbs up! Great stuff. Just what I wanted and no extra mark up! Cheers! – shorn Feb 2 '13 at 18:32
0

By far the simplest way is to use a conditional to check the logged in member ID against the member id in the url. As mentioned in Alex Kendrick's answer.

{if logged_in_member_id == segment_3}
    stuff only visible to member
{/if}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.