? docs
? modules/syndication
? sites/all/modules/admin_menu
? sites/all/modules/cck
? sites/all/modules/coder
? sites/all/modules/cvs_deploy
? sites/all/modules/demo
? sites/all/modules/devel
? sites/all/modules/drush
? sites/all/modules/google_analytics
? sites/all/modules/mollom
? sites/all/modules/path_redirect
? sites/all/modules/pbs
? sites/all/modules/plugin_manager
? sites/all/modules/robotstxt
? sites/all/modules/sandbox
Index: modules/contact/contact.pages.inc
===================================================================
RCS file: /cvs/drupal/drupal/modules/contact/contact.pages.inc,v
retrieving revision 1.16
diff -u -p -r1.16 contact.pages.inc
--- modules/contact/contact.pages.inc	8 Mar 2009 05:08:22 -0000	1.16
+++ modules/contact/contact.pages.inc	20 Apr 2009 22:01:34 -0000
@@ -236,6 +236,10 @@ function contact_mail_user_submit($form,
   watchdog('mail', '%name-from sent %name-to an e-mail.', array('%name-from' => $user->name, '%name-to' => $account->name));
   drupal_set_message(t('The message has been sent.'));
 
-  // Back to the requested users profile page.
-  $form_state['redirect'] = "user/$account->uid";
+  // Return to the requested users' profile page only if the current user can
+  // access user profiles.
+  if (user_access('access user profiles')) {
+    // Back to the requested users profile page.
+    $form_state['redirect'] = 'user/' . $account->uid;
+  }
 }
Index: modules/contact/contact.test
===================================================================
RCS file: /cvs/drupal/drupal/modules/contact/contact.test,v
retrieving revision 1.17
diff -u -p -r1.17 contact.test
--- modules/contact/contact.test	5 Apr 2009 12:10:56 -0000	1.17
+++ modules/contact/contact.test	20 Apr 2009 22:01:34 -0000
@@ -288,10 +288,9 @@ class ContactPersonalTestCase extends Dr
 
     // Create web users and attempt to use personal contact forms with default set to true.
     $web_user1 = $this->drupalCreateUser(array());
-    $web_user2 = $this->drupalCreateUser(array());
+    $web_user2 = $this->drupalCreateUser(array('access user profiles'));
 
     $this->drupalLogin($web_user1);
-
     $this->drupalGet('user/' . $web_user2->uid . '/contact');
     $this->assertResponse(200, t('Access to personal contact form granted.'));
 
@@ -300,7 +299,15 @@ class ContactPersonalTestCase extends Dr
     $edit['message'] = $this->randomName(64);
     $this->drupalPost(NULL, $edit, t('Send e-mail'));
     $this->assertText(t('The message has been sent.'), t('Message sent.'));
-
+    $this->assertNotEqual($this->getUrl(), url('user/' . $web_user2->uid, array('absolute' => TRUE)), t("Not redirected to user's profile page after submission."));
+    $this->assertResponse(200, t('Redirected after submission.'));
+    
+    $this->drupalLogin($web_user2);
+    $this->drupalPost('user/'. $web_user1->uid . '/contact', $edit, t('Send e-mail'));
+    $this->assertText(t('The message has been sent.'), t('Message sent.'));
+    $this->assertEqual($this->getUrl(), url('user/' . $web_user1->uid, array('absolute' => TRUE)), t("Redirected to user's profile page after submission."));
+    $this->assertResponse(200, t('Redirected after submission.'));
+    
     // Clear flood table in preparation for flood test and allow other checks to complete.
     db_delete('flood')->execute();
     $num_records_flood = db_query("SELECT COUNT(*) FROM {flood}")->fetchField();
@@ -308,20 +315,17 @@ class ContactPersonalTestCase extends Dr
 
     // Submit contact form with correct values and check flood interval.
     for ($i = 0; $i < $flood_control; $i++) {
-      $this->drupalGet('user/' . $web_user2->uid . '/contact');
+      $this->drupalGet('user/' . $web_user1->uid . '/contact');
       $this->drupalPost(NULL, $edit, t('Send e-mail'));
       $this->assertText(t('The message has been sent.'), t('Message sent.'));
     }
 
     // Submit contact form one over limit.
-    $this->drupalGet('user/' . $web_user2->uid . '/contact');
+    $this->drupalGet('user/' . $web_user1->uid . '/contact');
     $this->assertRaw(t('You cannot send more than %number messages per hour. Please try again later.', array('%number' => $flood_control)), t('Message threshold reached.'));
 
-    $this->drupalLogout();
-
-    $this->drupalLogin($admin_user);
-
     // Disable the personal contact form.
+    $this->drupalLogin($admin_user);
     $edit = array();
     $edit['contact_default_status'] = FALSE;
     $this->drupalPost('admin/build/contact/settings', $edit, t('Save configuration'));
@@ -335,7 +339,6 @@ class ContactPersonalTestCase extends Dr
     $web_user4 = $this->drupalCreateUser(array());
 
     $this->drupalLogin($web_user3);
-
     $this->drupalGet('user/' . $web_user4->uid . '/contact');
     $this->assertResponse(403, t('Access to personal contact form denied.'));
   }