Body: <p>I have added public profiles following an answer on this stack exchange and it works great, the problem arises when adding a "User Profile Form" which allows users to update their own settings. The problem is that currently, anyone can edit anyone's profile if they were to hardcode the URL to another person profile.</p>
  
  <p>So I'm trying to safeguard it by making sure the profile belongs to the currentUser. This is my setup:</p>
  
  <p><strong>_layout.html</strong></p>
  
  <pre><code>{% set users = craft.users %}
  </code></pre>
  
  <p><strong>_profile.html</strong></p>
  
  <pre><code>{% extends "_layout" %}
  
  {% block content %}
  
    {% set user = craft.users.username( craft.request.segment(2) ).first() %}
    {{ user.username }}
  
  
  {% endblock %}
  </code></pre>
  
  <p><strong>account.html</strong></p>
  
  <pre><code>{% extends "_layout" %}
  
  {% block content %}
  
    {% if currentUser.username == user.username %}
      &lt;form method="post" accept-charset="UTF-8"&gt;
        {{ getCsrfInput() }}
        &lt;input type="hidden" name="action" value="users/saveUser"&gt;
        &lt;input type="hidden" name="redirect" value="users/{{ currentUser.username }}"&gt;
        &lt;input type="hidden" name="userId" value="{{ currentUser.id }}"&gt;
  
        &lt;label for="location"&gt;Location&lt;/label&gt;
  
        &lt;label for="bio"&gt;Bio&lt;/label&gt;
  
        &lt;input type="submit" value="Save Profile"&gt;
      &lt;/form&gt;
    {% endif %}
  
  {% endblock %}
  </code></pre>
  
  <p>Right now I'm getting <code>Variable "user" does not exist.</code> but I'm unsure what's the best way to go about safe guarding this?</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2018-11-09T14:04:29.440Z
Comments.Text: Why do you give them the permission to edit other profiles and want to remove that/secure it afterwards? I would just not grant them the permission to edit other users in the first place
Comments.UserDisplayName: Robin Schambach
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2018-11-13T23:13:13.067Z
Comments.Text: I agree with @RobinSchambach, this could be better handled with proper permissions set.
  
  But, to answer your question, why not just try `{% if currentUser.username == craft.request.segment(2) %}`
  
  The reason variable "user" does not exist is that it's being defined in _profile.html but you're trying to refer to it in account.html.
Comments.UserDisplayName: Mike Pierce
Tags: <templating><users>
Title: Only allowing users to change their own profiles
ThreadText: # Only allowing users to change their own profiles
  
  (Asked by: username_0 on 2018-11-08)
  
  I have added public profiles following an answer on this stack exchange and it works great, the problem arises when adding a "User Profile Form" which allows users to update their own settings. The problem is that currently, anyone can edit anyone's profile if they were to hardcode the URL to another person profile.
  
  So I'm trying to safeguard it by making sure the profile belongs to the currentUser. This is my setup:
  
  **\_layout.html**
  
  ```
  {% set users = craft.users %}
  
  ```
  
  **\_profile.html**
  
  ```
  {% extends "_layout" %}
  
  {% block content %}
  
    {% set user = craft.users.username( craft.request.segment(2) ).first() %}
    {{ user.username }}
  
  {% endblock %}
  
  ```
  
  **account.html**
  
  ```
  {% extends "_layout" %}
  
  {% block content %}
  
    {% if currentUser.username == user.username %}
      <form method="post" accept-charset="UTF-8">
        {{ getCsrfInput() }}
        <input type="hidden" name="action" value="users/saveUser">
        <input type="hidden" name="redirect" value="users/{{ currentUser.username }}">
        <input type="hidden" name="userId" value="{{ currentUser.id }}">
  
        <label for="location">Location</label>
  
        <label for="bio">Bio</label>
  
        <input type="submit" value="Save Profile">
      </form>
    {% endif %}
  
  {% endblock %}
  
  ```
  
  Right now I'm getting `Variable "user" does not exist.` but I'm unsure what's the best way to go about safe guarding this?
  
  **Tags:** templating, users
  
  > **Comments:**
  > **username_1**: Why do you give them the permission to edit other profiles and want to remove that/secure it afterwards? I would just not grant them the permission to edit other users in the first place  
  > **username_2**: I agree with @username_1, this could be better handled with proper permissions set.  But, to answer your question, why not just try `{% if currentUser.username == craft.request.segment(2) %}`  The reason variable "user" does not exist is that it's being defined in _profile.html but you're trying to refer to it in account.html.  
  
  ---
  
  ## 0 answers
  
  