General help

• Create a new role UserWhoCannotUpdateProfile, with capabilitiy "Update user profile" set to Prevent
• On a particular user's profile page, click the Roles tab and assign the new role to the user

• Go to my profile page and click the Edit tab. I can edit my profile

• Setting the value to Prohibit
• Assign the role to the user Globally (site Administration -> Users -> Permissions -> Assign global roles)
• Preventing "View user profiles"
• Preventing "Edit user profiles" (edit vs. update -- what's the diff?)
  

As i understood, this checks (require_capability part) if user can/cannot edit his profile by the capability "moodle/user:editprofile" .

But i think, that this check is called only on special occassion, when admin/teacher edit another user profile. For user himself it is never called(or i missed something obvious and will have butter on my head, nevermind, not for first time ).

So if you expand this section to :

// check access control
 if ($user->id != $USER->id) {
 // teachers, parents, etc.
 $personalcontext = get_context_instance(CONTEXT_USER, $user->id);
 require_capability('moodle/user:editprofile', $personalcontext);
 // no editing of guest user account
 if (isguestuser($user->id)) {
 print_error('guestnoeditprofileother');
 }
 // no editing of primary admin!
 $mainadmin = get_admin();
 if ($user->id == $mainadmin->id) {
 print_error('adminprimarynoedit');
 }
 }else{
 $personalcontext = get_context_instance(CONTEXT_USER, $user->id);
 require_capability('moodle/user:editprofile', $personalcontext);
 }

Or put the check call outside, i really dont know, why its only there, as i said, maybe i missed something really obvious and more experienced developer will correct me, but for me it is this place, where the problem lies.