I’ve implemented my “dirty” solution as follows. If there is an better or cleaner approach, feel free to provide an answer:
function stop_access_profile()
{
global $pagenow;
if ($pagenow != 'user-edit.php') {
return;
}
$user_id = get_current_user_id();
$profile_id = intval($_GET['user_id']);
// Some logic implementation to decide whether the current user can see the current profile
// Omitted since it's irrelevant
if (!$can_see_profile) {
$profile = get_user_name($profile_id);
wp_die("You aren't allowed to see or edit the profile of {$profile}.");
}
}
add_action('admin_init', 'stop_access_profile');
It’s not relevant but the get_user_name
is a utility function that I wrote:
function get_user_name($id, $default = "")
{
if (!isset($id)) {
return $default;
}
$user = get_user_by('id', $id);
return $user->first_name . " " . $user->last_name;
}