Completely block other user's profile page from being accessed?

Site Operators
1

Hi,

Is there a way to make it so that a regular user cannot access another user’s profile page ?

2

@jacobo as maintainer of frontend-app-profile, do you have any thoughts?

3

@mboisson I am curious exactly what you’re looking for. On the profile page it says,

Your learner records information is only visible to you. Only your username and profile image are visible to others on [site-name].

I think this may tie into the discussions MFE - whatever you put as your username & profile image will be visible to others within the forums:

image
image368×146 12.7 KB

5

I cant recall in an out of the box way to achieve this from the profile mfe perspective but there are some fields on the openedx-platform that can be used to set which profile fields are visible: openedx-platform/lms/envs/common.py at b627417498ab3c89b5c2b838c7644f2bc3063cb5 · openedx/openedx-platform · GitHub.

ACCOUNT_VISIBILITY_CONFIGURATION = {
    "default_visibility": "private",
    "public_fields": ["username"],
    "bulk_shareable_fields": [...],
    "admin_fields": [...],
}

Or also could implement some custom django middleware injected via a Tutor plugin to redirect 404s the profile URLs (/u/<username>) and account APIs (/api/user/v1/accounts|preferences/*) unless the requester is staff or the target user themselves

6

Thanks. I believe the issue I’ve had is with the `PROFILE_EXTENSION_FORM` and custom extra fields. Would I be able to define visibility of those through the same `ACCOUNT_VISIBILITY_CONFIGURATION` configuration ?

7

Looks like it can.