Just looking at finding the best ways ways to protect member profile editing pages.
I have members profiles set up under a template structure such as
members/profile/{member_id}/sub-page
Thats is fine, all these pages are public. I do however show, on the members own profile page, a link to edit their details. This is displayed via the conditional
{if segment_3 == logged_in_member_id}
<a href="{path='members/account/{member_id}/profile'}">Edit Your Account</a>
{/if}
I then have the account edit pages such as (this is actually one template using switchee)
members/account/{member_id}/profile
members/account/{member_id}/password
members/account/{member_id}/avatar
members/account/{member_id}/notifications
But these pages should only be viewed by the logged in member, which at the moment is easily bypassed via just changing the member_id
in the URL.
So what would be the best way to protect these pages, so if someone did try and change the member_id
in the URL, they would not be able to access other users pages.
Thanks!
(And whilst I'm on this subject, is is possible to use the username
in the URL as opposed to the member_id
?
Many thanks!