Ways method to protect members profile edit pages?

Question

Just looking at finding the best ways ways to protect member profile editing pages.

I have members profiles set up under a template structure such as

members/profile/{member_id}/sub-page

Thats is fine, all these pages are public. I do however show, on the members own profile page, a link to edit their details. This is displayed via the conditional

{if segment_3 == logged_in_member_id}                   
   <a href="{path='members/account/{member_id}/profile'}">Edit Your Account</a>
{/if}

I then have the account edit pages such as (this is actually one template using switchee)

members/account/{member_id}/profile
members/account/{member_id}/password
members/account/{member_id}/avatar
members/account/{member_id}/notifications

But these pages should only be viewed by the logged in member, which at the moment is easily bypassed via just changing the member_id in the URL.

So what would be the best way to protect these pages, so if someone did try and change the member_id in the URL, they would not be able to access other users pages.

Thanks!

(And whilst I'm on this subject, is is possible to use the username in the URL as opposed to the member_id ?

Many thanks!

Answer 1

Option 1: Use Conditionals

In your members/account/{member_id}/profile template (or portion of your template, since you're using Switchee), you can wrap the profile-editing form and other content in a conditional to make sure the user can only edit their own profile. All other users can be shown alternate content (an error message in this example):

{if segment_3 == logged_in_member_id}                   
   {!-- Profile-editing template stuff here --}
{/if}

{if segment_3 != logged_in_member_id}                   
   <div class="error">You are not authorized to access this page.</div>
{/if}

Option 2: Avoid segment variables and rely on your add-on(s)

Another option, since you are using User and/or FreeMember, is to rely on their profile editing tags to take care of locking down the forms so that users cannot edit other user's profiles.

The FreeMember update_profile tag is automatically tied to the currently logged in user.

Or with User's edit tag you should be able to specify the member_id parameter to be {logged_in_member_id} to limit the edit form only to the currently logged in user.

With either of these two add-on-specific methods you don't need to rely on the member_id being in the URL and so you avoid the issue entirely.

Answer 2

By far the simplest way is to use a conditional to check the logged in member ID against the member id in the url. As mentioned in Alex Kendrick's answer.

{if logged_in_member_id == segment_3}
    stuff only visible to member
{/if}