user Profile viewable to anonymous users?

Hi Nysus..

Some profile fields are public and some are private. For example, you should not see the e-mail address. Are you seeing fields that should be private? You can make the public ones private by changing the setting in 'admin/user/configure/profile'

Yep. profile.module is enabled. And I know about the public/private thing in admin/users/configure/profile.

To answer your question it is the "public" elements that are showing up. If you switch those fields to be "private" - only the administrator can see them.

beyond the profile fields showing...the user settings are showing to anonymous users..basically anyone.

To explain further..consider a drupal site where great lengths are made to restrict access to blogs, events, pages, stories and other node content...e.g. a private community area for members-only where members have to login to access the content..

with the current system, anyone outside that community can view a users profile - even though ACCESS USER LIST is disabled in the admin/users/configure/permissions page - by guessing that if they type in /user/number they can view member details. Where as if the same anonymous user guesses to type in /blog/number they get the access denied message.

Hope that makes sense...

Jason

bumping this to see if anyone has come up with those 2 lines of code as mentioned by nysus.

Sorry if this is extremely simple to fix....but am a newbie...

Have submitted a feature request as nysus suggested.

Jason

Hiya Mr Maggoo

Have solved the problem by making two adjustments...(other users please note I am using drupal 4.5.0..I'm not sure if this works with other versions)

adjustment #1 adds in an extra field that shows up on the ADMINISTER - USERS - CONFIGURE - PERMISSIONS page and is simply an ACCESS USERS function where you can specify which roles have access to view the USER LIST and USER DETAILS.

A simple way of applying this change if you're (like me!) not very familiar with php is to open user.module in a text editor like NOTEPAD.EXE. Search for the following string function user_perm() and replace the lines you see in your user.module with this.

function user_perm() {
  return array('administer users', 'access users');
}

Adjustment #2 is the following replacement of the theme_user_profile function in USER.MODULE....very similar to your snippet..the only difference is Drupal looks to see if the user has ACCESS to view the user list/user profiles rather than if they are logged in.

A simple way of applying this change if you're (like me!) not very familiar with php is to open user.module in a text editor like NOTEPAD.EXE. Search for the following string theme_user_function and replace the lines you see in your user.module with this.

function theme_user_profile($account, $fields) {
global $user;
if (user_access('access users')) // check to see if the user has access
{
  $output = "<div class=\"profile\">\n";
  $output .= theme('user_picture', $account); // if so display the user account details
  foreach ($fields as $category => $value) {
    $output .= "<h2>$category</h2>$value";
  }
  $output .= "</div>\n";
}
else
{
// if the user is not logged in display a message
$output = "<div class=\"profile\">\n";
    $output .= "Sorry. You must <a href='?q=user/login'>LOGIN</a> to have access to view this 

page.";
     $output .= "</div>\n";
}
  return $output;
}

DON'T FORGET ! after applying this patch/ammendment to the user.module to go to ADMINISTER - USERS - CONFIGURE - PERMISSIONS to switch on the ACCESS USERS option for the appropriate user roles....

I hope that is of use to others...

Jason