<p>I have added public profiles following an answer on this stack exchange and it works great, the problem arises when adding a "User Profile Form" which allows users to update their own settings. The problem is that currently, anyone can edit anyone's profile if they were to hardcode the URL to another person profile.</p>

<p>So I'm trying to safeguard it by making sure the profile belongs to the currentUser. This is my setup:</p>

<p><strong>_layout.html</strong></p>

<pre><code>{% set users = craft.users %}
</code></pre>

<p><strong>_profile.html</strong></p>

<pre><code>{% extends "_layout" %}

{% block content %}

  {% set user = craft.users.username( craft.request.segment(2) ).first() %}
  {{ user.username }}


{% endblock %}
</code></pre>

<p><strong>account.html</strong></p>

<pre><code>{% extends "_layout" %}

{% block content %}

  {% if currentUser.username == user.username %}
    &lt;form method="post" accept-charset="UTF-8"&gt;
      {{ getCsrfInput() }}
      &lt;input type="hidden" name="action" value="users/saveUser"&gt;
      &lt;input type="hidden" name="redirect" value="users/{{ currentUser.username }}"&gt;
      &lt;input type="hidden" name="userId" value="{{ currentUser.id }}"&gt;

      &lt;label for="location"&gt;Location&lt;/label&gt;

      &lt;label for="bio"&gt;Bio&lt;/label&gt;

      &lt;input type="submit" value="Save Profile"&gt;
    &lt;/form&gt;
  {% endif %}

{% endblock %}
</code></pre>

<p>Right now I'm getting <code>Variable "user" does not exist.</code> but I'm unsure what's the best way to go about safe guarding this?</p>

CC BY-SA 4.0
2018-11-09T14:04:29.440Z
Why do you give them the permission to edit other profiles and want to remove that/secure it afterwards? I would just not grant them the permission to edit other users in the first place
Robin Schambach
CC BY-SA 4.0
2018-11-13T23:13:13.067Z
I agree with @RobinSchambach, this could be better handled with proper permissions set.

But, to answer your question, why not just try `{% if currentUser.username == craft.request.segment(2) %}`

The reason variable "user" does not exist is that it's being defined in _profile.html but you're trying to refer to it in account.html.
Mike Pierce
<templating><users>
Only allowing users to change their own profiles
# Only allowing users to change their own profiles

(Asked by: username_0 on 2018-11-08)

I have added public profiles following an answer on this stack exchange and it works great, the problem arises when adding a "User Profile Form" which allows users to update their own settings. The problem is that currently, anyone can edit anyone's profile if they were to hardcode the URL to another person profile.
So I'm trying to safeguard it by making sure the profile belongs to the currentUser. This is my setup:
_layout.html
{% set users = craft.users %}

_profile.html
{% extends "_layout" %}

{% block content %}

  {% set user = craft.users.username( craft.request.segment(2) ).first() %}
  {{ user.username }}


{% endblock %}

account.html
{% extends "_layout" %}

{% block content %}

  {% if currentUser.username == user.username %}
    
      {{ getCsrfInput() }}
      
      
      

      Location

      Bio

      
    
  {% endif %}

{% endblock %}

Right now I'm getting Variable "user" does not exist. but I'm unsure what's the best way to go about safe guarding this?

**Tags:** templating, users
> **Comments:**
> **username_1**: Why do you give them the permission to edit other profiles and want to remove that/secure it afterwards? I would just not grant them the permission to edit other users in the first place  
> **username_2**: I agree with @RobinSchambach, this could be better handled with proper permissions set.  But, to answer your question, why not just try `{% if currentUser.username == craft.request.segment(2) %}`  The reason variable "user" does not exist is that it's being defined in _profile.html but you're trying to refer to it in account.html.  

---

## 0 answers

