Login.UpdateProfile should be used to allow users to update their own profile if logged in.
I do however need something to enable a manager to edit other registered users' profiles. (in the front end)
Can this be done by say, passing a user id to the edit profile form?
-
☆ A M B ☆
- 222 Posts
I don't think it is that simple, since the updateprofile.php most likely authenticates the logged int user id with the profile id key.
I would imagine the only way to allow an admin to do updates from the frontend is through a custom snippet (or extending updateprofile.php) that would have a managerial override in it, but this would open a security hole.
Administering other users profiles is more secure if done through the manager, instead of a front in form
I could be wrong, but I think UpdateProfile will update any user. The current user has to be logged in to the current context, but I don't think they have to be the user being updated.
The user's ID or username has to be set in $scriptProperties['user'].
As Jason says, there are security implications, but OTOH, letting users into the Manager has them too and you'd have to do extensive customization of the Manager to simplify and harden it.
I have exactly the same problem and i want to manage the details of my all the user from front end (Not manager).
Will please give me some more details how to make it feasible. I am using login extra in my site.
Arkalp.com