What’s the “official” way to remove Plone’s Users tab?

Question

I've got an installation of Plone 4.2.1 running nicely, but visitors to the site can click on the Users tab in the main menu and go straight to a search of all my registered users. Certainly, anonymous visitors are unable to actually list anyone, but I don't want this functionality at all.

What's the Plone way of:

• removing the Users tab from the main menu?
• stopping the URL /Members returning anything except 404?

Are there other effects of this functionality I should be aware of?

Answer 1

The Users tab is only shown because there is a Members folder (with the title Users) in the root that is publicly visibile.

You have three options to deal with the default; make the Members folder private, delete it altogether, or remove the index_html default view.

Unpublish

You can 'unpublish', retract, the folder workflow to make it private, and anonymous users are then redirected to the login form instead of seeing the user search form:

Simply go to the folder, click on the workflow state (Published) and choose Retract.

Delete

If you do not need to have per-user folders, you can remove the Members folder altogether. You do need to make sure that user folder creation is not enabled first. Go to the Control Panel (click on your username, top right, select Site Setup):

select Security:

and make sure that Enable User Folders is not checked. If it is, uncheck it and save the settings.

Now just delete the Members folder; click Users, find the Actions menu on the right, then select Delete:

then confirm the deletion in the popup:

Deletion means all users will get a 404 when visiting /Members in your site.

Delete the default view

The Members folder contains a index_html object that provides the user form search. If all you want to get rid of is this view, you can delete it. If your Members folder is still public, visitors can see any userfolders that have been created though.

Deleting this view requires going to the ZMI, the Zope Management Interface, navigating to the Members folder and deleting the index_html object there.

Since this is not really the recommended course of action I'm leaving out the screenshots for this part.

Answer 2

You can just delete the Users folder.