Stale values of hidden fields in profile_values, and are browsable [#123577]

When you have a public profile field, and make it hidden, the field values are still in the 'profile_values' table.
And they'll stay there because profile_save() doesn't handle them anymore.

What's worse is that a they might also be browsable, if a page title has been given.
This is because the function profile_browse() checks for 'private' fields but not for 'hidden' fields.

This simple patch blocks the viewing of hidden fields.

This issue applies to 4.7 and 5.0

Cheers, Danny van der Weide

Comment	File	Size	Author
#9	profile.module_20070627.patch	800 bytes	stevenpatz
#3	profile_41.patch	830 bytes	tostinni
	profile2.patch	477 bytes	dvdweide

Comments

Comment #1

dvdweide commented 1 March 2007 at 10:48

Status:

Reviewed & tested by the community

» Needs review

I heard i shouldn't put my own patches on 'ready to commit'.

Danny

Comment #2

ChrisKennedy commented 3 March 2007 at 03:49

Status:

Needs review

» Needs work

You have a typo in your comment and it isn't a cvs patch per http://drupal.org/patch

Status	File	Size
new	profile_41.patch	830 bytes

Comment #4

dvdweide commented 2 May 2007 at 10:08

Hi Tostinni,

Your patch makes hidden fields browsable by users with 'administer users' permission.

But hidden fields are not browsable because they are stored in the 'users' table and not in the 'profile_values' table like all the other profile values.
This means that hidden fields cannot be browsable, and thus my patch is correct!

Furthermore, i think that the priority should remain 'critical' because of possible stale values that are still in the 'profile_values' table when a profile field has been changed to 'hidden' in a later stadium. This is a potential security problem.

I don't know if i have to resubmit my patch to override yours, but first i'll wait for your reaction/opinion.

Cheers, Danny

Comment #5

tostinni commented 2 May 2007 at 14:30

But hidden fields are not browsable because they are stored in the 'users' table and not in the 'profile_values' table like all the other profile values.

Hum where did you get that ?
I try to save some hidden fields and they all went to profile_values table, can you describe this a little more ?

Comment #6

dvdweide commented 3 May 2007 at 09:21

Priority:

Normal

» Critical

Please excuse my ignorance, Tostinni!
It seems that this code has changed somewhere between 4.7 an 5.x, and i didn't notice.....

So, your patch is for the HEAD/5.x branches, while mine is for 4.7. Great!
I've looked at yours, and although i didn't try it out, my eyes are sure it will work just fine.

Il still don't agree on the priority change, though.
This is a critical issue, because anyone can browse hidden profile fields, and it's even worse on 5.x than on 4.7, since hidden fields have become actually browsable.
So, i feel i have to change is back again. Sorry! ;-)

Cheers, Danny