[Support Request]: Disable profile page for users with social login #2568

New Issue

OVERLORD · 2026-02-05T04:31:39+03:00

OVERLORD commented

2026-02-05 04:31:39 +03:00

Originally created by @androbey on GitHub (Jan 11, 2022).

Attempted Debugging

I have read the debugging page

Searched GitHub Issues

I have searched GitHub for the issue.

Describe the Scenario

Hi all,

I implemented a custom Oauth2 Provider and used the Theme System for it.
This works very well.

However, I want to achieve that those users, who can login via Oauth2 (Social Login) are not able to edit their profile at all.
Goal is that those users can only login via the Oauth2 provider and not change their name, avatar and so on..

I don't think this is much related to e.g. #1090 as I still want login for certain users with email/password and those user's should be able to edit their profile.

As far as I can tell current state of Theme system does not provide a way to hook into the render process, does it? (So that I can conditionally throw "No Access error" if user has social login connected).

Exact BookStack Version

v21.12.1

Log Content

No response

PHP Version

8.0

Hosting Environment

Ubuntun 20.04 (VPS, manual installation)

Originally created by @androbey on GitHub (Jan 11, 2022). ### Attempted Debugging - [X] I have read the debugging page ### Searched GitHub Issues - [X] I have searched GitHub for the issue. ### Describe the Scenario Hi all, I implemented a custom Oauth2 Provider and used the Theme System for it. This works very well. However, I want to achieve that those users, who can login via Oauth2 (Social Login) are not able to edit their profile at all. Goal is that those users can only login via the Oauth2 provider and not change their name, avatar and so on.. I don't think this is much related to e.g. #1090 as I still want login for certain users with email/password and those user's should be able to edit their profile. As far as I can tell current state of Theme system does not provide a way to hook into the render process, does it? (So that I can conditionally throw "No Access error" if user has social login connected). ### Exact BookStack Version v21.12.1 ### Log Content _No response_ ### PHP Version 8.0 ### Hosting Environment Ubuntun 20.04 (VPS, manual installation)

OVERLORD added the 🐕 Support label 2026-02-05 04:31:39 +03:00

OVERLORD closed this issue

2026-02-05 04:31:40 +03:00

OVERLORD commented

2026-02-05 04:31:45 +03:00

@ssddanbrown commented on GitHub (Jan 11, 2022):

Hi @androbey,
Good to hear of someone successfully using the theme system!

As far as I can tell current state of Theme system does not provide a way to hook into the render process, does it?

The visual theme system allows override of any view used by BookStack so you could use that to modify the user edit page/view as required.

Alternatively, using the logical theme system, you could maybe use the before middleware hook to look for user updates and block them if the condition meets your requirement. As an example:

<?php

use BookStack\Facades\Theme;
use BookStack\Theming\ThemeEvents;
use Illuminate\Http\Request;
use Illuminate\Support\Str;

Theme::listen(ThemeEvents::WEB_MIDDLEWARE_BEFORE, function(Request $request) {
    $makingUserUpdate = $request->method() === 'PUT' && Str::endsWith($request->path(), 'settings/users/' . user()->id);
    if ($makingUserUpdate && user()->hasSocialAccount('google')) {
        session()->flash('error', 'Not allowed to update your profile');
        return redirect('/');
    }
});

As with all advanced logical theme usage, you'll need to keep an eye on changes or test this upon large updates as the internal APIs & paths could change.

@ssddanbrown commented on GitHub (Jan 11, 2022): Hi @androbey, Good to hear of someone successfully using the theme system! > As far as I can tell current state of Theme system does not provide a way to hook into the render process, does it? The [visual theme system](https://github.com/BookStackApp/BookStack/blob/master/dev/docs/visual-theme-system.md) allows override of any view used by BookStack so you could use that to modify the user edit page/view as required. Alternatively, using the logical theme system, you could maybe use the before middleware hook to look for user updates and block them if the condition meets your requirement. As an example: ```php <?php use BookStack\Facades\Theme; use BookStack\Theming\ThemeEvents; use Illuminate\Http\Request; use Illuminate\Support\Str; Theme::listen(ThemeEvents::WEB_MIDDLEWARE_BEFORE, function(Request $request) { $makingUserUpdate = $request->method() === 'PUT' && Str::endsWith($request->path(), 'settings/users/' . user()->id); if ($makingUserUpdate && user()->hasSocialAccount('google')) { session()->flash('error', 'Not allowed to update your profile'); return redirect('/'); } }); ``` As with all advanced logical theme usage, you'll need to keep an eye on changes or test this upon large updates as the internal APIs & paths could change.

OVERLORD commented

2026-02-05 04:31:50 +03:00

@androbey commented on GitHub (Jan 11, 2022):

Hi @ssddanbrown,

ok wow, this is amazing! Thank you very much, it works as expected.

Obviously the WEB_MIDDLEWARE_BEFORE event is very powerful. Sorry to bother with this issue, my bad. Obviously did not read ThemeEvents code comments enough.

@androbey commented on GitHub (Jan 11, 2022): Hi @ssddanbrown, ok wow, this is amazing! Thank you very much, it works as expected. Obviously the WEB_MIDDLEWARE_BEFORE event is very powerful. Sorry to bother with this issue, my bad. Obviously did not read ThemeEvents code comments enough.

OVERLORD commented

2026-02-05 04:31:54 +03:00

@ssddanbrown commented on GitHub (Jan 11, 2022):

No bother at all, glad that helped!

@ssddanbrown commented on GitHub (Jan 11, 2022): No bother at all, glad that helped!

OVERLORD commented

2026-02-05 04:31:57 +03:00

@demlak commented on GitHub (Feb 24, 2025):

Hey.. i am interested in disabling profile-settings for my OIDC users.. is there any api-documentation for functions like hasSocialAccount() for adapting this code?

@demlak commented on GitHub (Feb 24, 2025): Hey.. i am interested in disabling profile-settings for my OIDC users.. is there any api-documentation for functions like `hasSocialAccount()` for adapting [this code](https://github.com/BookStackApp/BookStack/issues/3156#issuecomment-1010045986)?

OVERLORD commented

2026-02-05 04:31:59 +03:00

@ssddanbrown commented on GitHub (Feb 24, 2025):

@demlak No, not really, since it's just all internal code, not really a supported API of any type.

That specific function is just a method on the user model:

387c786768/app/Users/Models/User.php (L210-L225)

@ssddanbrown commented on GitHub (Feb 24, 2025): @demlak No, not really, since it's just all internal code, not really a supported API of any type. That specific function is just a method on the user model: https://github.com/BookStackApp/BookStack/blob/387c7867687b3761da5dd664b8fda3994bb8c57f/app/Users/Models/User.php#L210-L225

OVERLORD commented

2026-02-05 04:32:01 +03:00

@demlak commented on GitHub (Feb 24, 2025):

thx for this very fast reply =)

do you recommend a way of archiving my goal? maybe checking if external_auth_id is set?

in my case, i currently only have oidc users..

@demlak commented on GitHub (Feb 24, 2025): thx for this very fast reply =) do you recommend a way of archiving my goal? maybe checking if `external_auth_id` is set? in my case, i currently only have oidc users..

OVERLORD commented

2026-02-05 04:32:03 +03:00

@ssddanbrown commented on GitHub (Feb 24, 2025):

@demlak I don't really understand what your goal is to be honest.
Feel free to open a new support issue, to fully describe what you're attempting to achieve (and what you've got/attempted so far).

@ssddanbrown commented on GitHub (Feb 24, 2025): @demlak I don't really understand what your goal is to be honest. Feel free to open a new support issue, to fully describe what you're attempting to achieve (and what you've got/attempted so far).

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#2568