--- /root/drupal/drupal/modules/profile.module 2005-04-24 09:34:35.582867968 -0500 +++ profile.module 2005-04-24 09:45:55.551497024 -0500 @@ -216,10 +216,16 @@ function profile_save_profile(&$edit, &$user, $category) { if (($_GET['q'] == 'user/register') ? 1 : 0) { - $result = db_query('SELECT fid, name, type FROM {profile_fields} WHERE register = 1 AND visibility != %d ORDER BY category, weight', PROFILE_HIDDEN); + if (user_access('administer users')) + $result = db_query('SELECT fid, name, type FROM {profile_fields} WHERE register = 1 AND ORDER BY category, weight'); + else + $result = db_query('SELECT fid, name, type FROM {profile_fields} WHERE register = 1 AND visibility != %d ORDER BY category, weight', PROFILE_HIDDEN); } else { - $result = db_query("SELECT fid, name, type FROM {profile_fields} WHERE LOWER(category) = LOWER('%s') AND visibility != %d", $category, PROFILE_HIDDEN); + if (user_access('administer users')) + $result = db_query("SELECT fid, name, type FROM {profile_fields} WHERE LOWER(category) = LOWER('%s')", $category); + else + $result = db_query("SELECT fid, name, type FROM {profile_fields} WHERE LOWER(category) = LOWER('%s') AND visibility != %d", $category, PROFILE_HIDDEN); // We use LOWER('%s') instead of PHP's strtolower() to avoid UTF-8 conversion issues. } while ($field = db_fetch_object($result)) { @@ -278,8 +284,12 @@ profile_load_profile($user); // Show private fields to administrators and people viewing their own account. - if (user_access('administer users') || $GLOBALS['user']->uid == $user->uid) { - $result = db_query('SELECT * FROM {profile_fields} WHERE visibility != %d ORDER BY category, weight', PROFILE_HIDDEN); + $admin_access = user_access('administer users'); + if ( $admin_access || $GLOBALS['user']->uid == $user->uid) { + if ($admin_access) + $result = db_query('SELECT * FROM {profile_fields} ORDER BY category, weight'); + else + $result = db_query('SELECT * FROM {profile_fields} WHERE visibility != %d ORDER BY category, weight', PROFILE_HIDDEN); } else { $result = db_query('SELECT * FROM {profile_fields} WHERE visibility != %d AND visibility != %d ORDER BY category, weight', PROFILE_PRIVATE, PROFILE_HIDDEN); @@ -313,10 +323,16 @@ function profile_form_profile($edit, $user, $category) { if (($_GET['q'] == 'user/register') ? 1 : 0) { - $result = db_query('SELECT * FROM {profile_fields} WHERE register = 1 ORDER BY category, weight'); + if (user_access('administer users')) + $result = db_query('SELECT * FROM {profile_fields} WHERE register = 1 ORDER BY category, weight'); + else + $result = db_query('SELECT * FROM {profile_fields} WHERE register = 1 AND visibility != %d ORDER BY category, weight', PROFILE_HIDDEN); } else { - $result = db_query("SELECT * FROM {profile_fields} WHERE LOWER(category) = LOWER('%s') ORDER BY weight", $category); + if (user_access('administer users')) + $result = db_query("SELECT * FROM {profile_fields} WHERE LOWER(category) = LOWER('%s')", $category); + else + $result = db_query("SELECT * FROM {profile_fields} WHERE LOWER(category) = LOWER('%s') AND visibility != %d", $category, PROFILE_HIDDEN); // We use LOWER('%s') instead of PHP's strtolower() to avoid UTF-8 conversion issues. }