I might be missing some crucial setting somewhere. But how to prevent a user from editing own profile and thereby giving him/her self "extra" access rights?

Let say we have a vocabulary Departements, with two terms (Human Ressource, General Management). Attaching terms to nodes and users works as expecting, but a user only intended to be able to view General Management, could by editing user account assign the term Human Ressource to him/her self.

What should prevent this?

Comments

adooo’s picture

adooo commented

I think you are looking for something like this: http://drupal.org/project/field_permissions.

adooo’s picture

adooo commented
Status: Active » Closed (fixed)
fenda’s picture

fenda commented
Status: Closed (fixed) » Needs work

Sorry to re-open this, but I had a question on this topic.

@adooo If users are able to change their own taxonomy terms on their user profile, what is the point of this module?

adooo’s picture

adooo commented
Assigned: Unassigned » adooo
Category: support » feature
Status: Needs work » Active

In combination with a module like field_permissions you can prevent them from editing the field on their own.

However, I do like the idea of the possibility to control field permissions for abt fields in the same module... so I'll look at some alternatives to handle this without a second module :)

adooo’s picture

adooo commented
Status: Active » Closed (fixed)

There you go :)

You can now hide/show the abt field on the user account page as well as on the node page. Have a look at the permissions page for this.