Index: includes/form.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/form.inc,v
retrieving revision 1.287
diff -u -p -r1.287 form.inc
--- includes/form.inc	21 Sep 2008 06:34:41 -0000	1.287
+++ includes/form.inc	23 Sep 2008 06:41:56 -0000
@@ -2005,7 +2005,7 @@ function theme_textfield($element) {
   $extra = '';
   $output = '';
 
-  if ($element['#autocomplete_path']) {
+  if ($element['#autocomplete_path'] && menu_valid_path(array('link_path' => $element['#autocomplete_path']))) {
     drupal_add_js('misc/autocomplete.js');
     $class[] = 'form-autocomplete';
     $extra =  '<input class="autocomplete" type="hidden" id="' . $element['#id'] . '-autocomplete" value="' . check_url(url($element['#autocomplete_path'], array('absolute' => TRUE))) . '" disabled="disabled" />';
Index: modules/profile/profile.admin.inc
===================================================================
RCS file: /cvs/drupal/drupal/modules/profile/profile.admin.inc,v
retrieving revision 1.12
diff -u -p -r1.12 profile.admin.inc
--- modules/profile/profile.admin.inc	21 Aug 2008 19:36:38 -0000	1.12
+++ modules/profile/profile.admin.inc	23 Sep 2008 06:41:57 -0000
@@ -269,6 +269,7 @@ Unless you know what you are doing, it i
   $form['fields']['autocomplete'] = array('#type' => 'checkbox',
     '#title' => t('Form will auto-complete while user is typing.'),
     '#default_value' => $edit['autocomplete'],
+    '#description' => t('For security, auto-complete will be disabled if the user does not have access to user profiles.'),
   );
   $form['fields']['required'] = array('#type' => 'checkbox',
     '#title' => t('The user must enter a value.'),
Index: modules/profile/profile.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/profile/profile.module,v
retrieving revision 1.244
diff -u -p -r1.244 profile.module
--- modules/profile/profile.module	5 Sep 2008 09:25:52 -0000	1.244
+++ modules/profile/profile.module	23 Sep 2008 06:41:57 -0000
@@ -570,4 +570,3 @@ function _profile_get_fields($category, 
   $sql .= ' ORDER BY category, weight';
   return db_query($sql, $args);
 }
-
Index: modules/profile/profile.test
===================================================================
RCS file: /cvs/drupal/drupal/modules/profile/profile.test,v
retrieving revision 1.6
diff -u -p -r1.6 profile.test
--- modules/profile/profile.test	5 Jun 2008 21:55:44 -0000	1.6
+++ modules/profile/profile.test	23 Sep 2008 06:41:58 -0000
@@ -248,11 +248,56 @@ class ProfileTestWeights extends Profile
   }
 }
 
+class ProfileTestAutocomplete extends ProfileTestCase {
+
+  /**
+   * Implementation of getInfo().
+   */
+  function getInfo() {
+    return array(
+      'name' => t('Autocompletion'),
+      'description' => t('Test profile fields with autocompletion.'),
+      'group' => t('Profile')
+    );
+  }
+
+  /**
+   * Tests profile field autocompletion and permissions.
+   */
+  function testAutocomplete() {
+    $this->drupalLogin($this->admin_user);
+
+    $category = $this->randomName();
+    $field = $this->createProfileField('textfield', $category, array('weight' => 1, 'autocomplete' => 1));
+    $field['value'] = $this->randomName();
+    $autocomplete_html = '<input class="autocomplete" type="hidden" id="' . form_clean_id('edit-' . $field['form_name'] . '-autocomplete') . '" value="' . url('profile/autocomplete/' . $field['fid'], array('absolute' => TRUE)) . '" disabled="disabled" />';
+    $field_html = '<input type="text" maxlength="255" name="' . $field['form_name'] . '" id="'. form_clean_id('edit-' . $field['form_name']) . '" size="60" value="' . $field['value'] . '" class="form-text form-autocomplete required" />';
+    $this->setProfileField($field, $field['value']);
+
+    $this->drupalGet('user/' . $this->admin_user->uid . '/edit/' . $category);
+    $this->assertRaw($autocomplete_html, t('Autocomplete found.'));
+    $this->assertRaw('misc/autocomplete.js', t('Autocomplete JavaScript found.'));
+    $this->assertRaw('class="form-text form-autocomplete"', t('Autocomplete form element class found.'));
+
+    $this->drupalGet('profile/autocomplete/' . $field['fid'] . '/' . $field['value'][0]);
+    $this->assertResponse(200, t('Autocomplete path allowed to user with permission.'));
+    $this->assertRaw($field['value'], t('Autocomplete value found.'));
+
+    $this->drupalLogout();
+    $this->drupalLogin($this->normal_user);
+
+    $this->drupalGet('user/' . $this->normal_user->uid . '/edit/' . $category);
+    $this->assertNoRaw($autocomplete_html, t('Autocomplete not found.'));
+
+    $this->drupalGet('profile/autocomplete/' . $field['fid'] . '/' . $field['value'][0]);
+    $this->assertResponse(403, t('Autocomplete path denied to user without permission.'));
+  }
+}
+
   /**
    * TODO:
    * - Test field visibility
    * - Test profile browsing
-   * - Test autocomplete
    * - Test required fields
    * - Test fields on registration form
    * - Test updating fields
Index: modules/user/user.test
===================================================================
RCS file: /cvs/drupal/drupal/modules/user/user.test,v
retrieving revision 1.15
diff -u -p -r1.15 user.test
--- modules/user/user.test	20 Sep 2008 20:22:25 -0000	1.15
+++ modules/user/user.test	23 Sep 2008 06:41:58 -0000
@@ -516,3 +516,43 @@ class UserAdminTestCase extends DrupalWe
     $this->assertEqual($account->status, 0, 'User B blocked');
   }
 }
+
+class UserAutocompleteTestCase extends DrupalWebTestCase {
+
+  /**
+   * Implementation of getInfo().
+   */
+  function getInfo() {
+    return array(
+      'name' => t('User autocompletion'),
+      'description' => t('Test user autocompletion functionality.'),
+      'group' => t('User')
+    );
+  }
+
+  /**
+   * Implementation of setUp().
+   */
+  function setUp() {
+    parent::setUp();
+
+    $this->user1 = $this->drupalCreateUser();
+    $this->user2 = $this->drupalCreateUser(array('access user profiles'));
+  }
+
+  /**
+   * Attempts to access user autocompletion from users with or without the
+   * proper access and verify the correct results.
+   */
+  function testUserAutocomplete() {
+    $this->drupalLogin($this->user1);
+    $this->drupalGet('user/autocomplete/' . $this->user1->name[0]);
+    $this->assertResponse(403, t('Autocompletion access denied to user without permission.'));
+
+    $this->drupalLogout();
+    $this->drupalLogin($this->user2);
+    $this->drupalGet('user/autocomplete/' . $this->user1->name[0]);
+    $this->assertResponse(200, t('Autocompletion access allowed.'));
+    $this->assertRaw($this->user1->name, t('User name found in autocompletion results.'));
+  }
+}