How to restrict users from accessing other users profiles and profile data

Help / Discuss
1

I’m working on a wiki that is public so I do expect some privacy problems which I want to avoid. I’m finding some good information which is helping with progress but I’m also finding little things that I need help with.

  1. Can I configure in a simple way that forces all registered users or by group not to be able to see any other users profile page and thus personal data? I want admins, certain groups to be able to view other users profile page/data and edit it but I also don’t want registered users to see other peoples personal data.

  2. I only want the user to be able to view and edit their own profile page, is there a simple way to do this? Maybe in the config files or do I have to write code?

  3. Also is there a way to disable certain fields for users profile settings so they can’t be changed? I want to set the defaults and disable some users/groups from changing these fields this way the experience is standardized.

Thank you.

2

Hi. Yes you can achieve what you want by customizing the User Profile Sheet page. See http://www.xwiki.org/xwiki/bin/view/FAQ/HowToModifyUserProfileBehavior

3

Like Vincent is telling you can do most of what you want by modifying the page that is used to display the user data, but this requires Coding (it is Velocity)

Note that the data of each user contains a username and a password (and/or other data required to login); which is stored in the same object as the rest of your user data. This means you can not fully block access to the user data. It needs to be read just before you login in order to check if the username and password is correct.

We have the same challenge, so we decided to to create a second user-profile which we store in a secure space, so our default XWiki User only contains limited data (like uName and uPassword) and we used the suggestion of Vincent to not show the other data. So each user has two user-objects, one to allow login and allow the admin to add the user to groups etcetera (the default XWiki.XWikiUser object) and one object where we store the more privat data.

4

It’s been almost 3 years since the OP has asked this question but is it still relevant for version 12.2.1?
Following the link posted by @vmassol, how do I actually edit XWiki.XWikiUserProfileSheet?
Is this a file on disk? I can’t seems to figure out where should this code go.

5

See You're invited to talk on Matrix

6

I’m adding for the record a link to this snippet which was published in the meantime and which allows to restrict access to user profiles automatically on user creation.