User Profile Field Privacy

After lots of Googling for the best way of applying privacy settings to user profile fields like Public, Private and Friends, I came up with a custom development for this.

Our need was to provide options for a user to decide their privacy setting for each profile field, whether it is Public (can be seen by anyone), Private (no one can see this except user), and Friends (can only be seen by friends of user and himself). Let's start with some code snipets in this module. First, define some constants for your settings.

/**
 * Privacy level: Public.
 * Field can be viewed by all.
 */
define('CORE_SECURITY_PRIVACY_PUBLIC', 0);
 
/**
 * Privacy level: Friends only.
 * Field can be viewed by only friends.
 */
define('CORE_SECURITY_PRIVACY_FRIENDS', 1);
 
/**
 * Privacy level: Private.
 * Field can be viewed by only user.
 */
define('CORE_SECURITY_PRIVACY_PRIVATE', 2);

Let's provide a form for the user to set their privacy settings for each field. Assuming you have implemented hook_menu() for this.

/**
 * Privacy settings form for user.
 */
function privacy_settings_form_callback($form, &$form_state) {
  global $user;
  $form = array();
  $options = array(0 => 'Public', 1 => 'Friends', 2 => 'Private');
  $instances = field_info_instances('user', 'user');
  foreach ($instances as $field_name => $field_info) {
    $form[$field_name] = array(
      '#type' => 'select',
      '#title' => t('Who can see your ') . $field_info['label'] . ' ?',
      '#options' => $options,
      '#default_value' => $user->data['privacy_settings'][$field_name],
    );
  }
  $form['submit'] = array(
    '#type' => 'submit',
    '#value' => t('Save'),
  );
  return $form;
}

In the submit handler of this form, just save these values in $user->data['privacy_settings']. Now let's set some default setting for a new user.

/**
 * Implements hook_user_insert().
 * Add default privacy settings.
 */
function MYMODULE_user_insert(&$edit, $account, $category) {
  // Add default privacy settings into users.data
  $instances = field_info_instances('user', 'user');
  $field_settings = array();
  foreach ($instances as $field_name => $field_info) {
    // Lets make it PUBLIC by default.
    $field_settings[$field_name] = CORE_SECURITY_PRIVACY_PUBLIC;
  }
  $data['privacy_settings'] = $field_settings;
  user_save($account, array('data' => $data));
}

Now let's check for field access.

/**
 * Implements hook_field_access().
 * Check if user has access for the field.
 */
function MYMODULE_field_access($op, $field, $entity_type, $entity, $account) {
  if ($entity_type == 'user') {
    switch ($op) {
      case 'view':
        global $user;
        // Implement you access logic here for each field.
        // $entity is user which is being viewed.
        // You will get his privacy setting for single field in $entity->data['privacy_settings'][$field['field_name']].
        // If you want, you can use the constants defined above.
        // If current user has access to field then return TRUE, else FALSE.
        break;
    }
  }
}