Hello
with this noew 1.11 version of Invite, the invite counter on profile pages is visible to everyone! Even the anauthenticated users. And obviously it raises quite a few privacy concerns. Is it possible to make it so that it is visible only to Administrators (or at least so that there is a choice).

Thanks

Comments

drupalina’s picture

Title: Invite counter on profile pages is visible to everyone! Is it possible to... » Invite counter on profile pages is visible to everyone! Is it possible to remove it?
Category: feature » bug
Priority: Normal » Critical

actually this is more of a bug report than just a feature requests... because making invitation counts display on each user's profile page so that everyone (even unathenticated users) can see how many people have invited, is actually a major privacy breach.

I cannot even remove it through CSS.

It is very usefuly for Admin to see, but not everyone else. There should be a role-based choice so that administrator can choose who is priviledged enough to see this kind of information.

smk-ka’s picture

StatusFileSize
new2.89 KB

Sounds reasonable. Please give the attached patch a try.

smk-ka’s picture

Assigned: Unassigned » smk-ka
Status: Active » Needs review
smk-ka’s picture

StatusFileSize
new2.92 KB

Permissions should be unique. Changed the permission identifier from "view statistics" to "view invite statistics".

drupalina’s picture

sorry, I don't know how to test patches.

I'd be happy to test a dev version if you implement that patch.

vm’s picture

how to apply patches = http://drupal.org/patch/apply

kbourne’s picture

I applied the patch. It either hides the info or it doesn't, even from the main admin on the site when you set that access. I think the main admin should always see it. And then maybe another item to include under the access section "view own invite statistics", which of course allows users to view own their own and not others. And then ideally, all of this could also be left optional to the user, as maybe a setting on their user/#/edit page (and the admin could control if that option is open to them or not, either under the settings, or under access permissions). The latter is just a suggestion, but I think the first part really needs to be in there for it to be of any use.

kbourne’s picture

actually, I just noticed that it either hides it or note when I set the access permissions under authenticated user. When I turn off the permission for authenticated users, I can't even see it as the main admin. When I set it under a role that I defined (admin), it doesn't make a difference.

abqaria’s picture

when is the next version for people who cannot patch ?

royal007’s picture

I am looking for a way to get rid of the 'Invitation counts' on the profile page views completely, is there an easy way to do this??

I thought I would try the above patch out. It does work, but the problem I found is that it doesn't hide the admin's 'Invitation counts' profile view. How to totally remove it, or is there some code I can remove to get rid of the invitation counts for good. Thanks

smk-ka’s picture

StatusFileSize
new3.25 KB

Sorry for the slow response.

Enhanced the patch with a 'view own invite statistics' permission, as suggested by kbourne, and also fixed the viewing permission.

@royal007
You could create a new 'admin' role instead of using the superadmin (userid=1) which always has permission to everything.

drupalina’s picture

Version: 5.x-1.11 » 5.x-1.12

the new 1.12 version still has this problem (unless I missed something). Authenticated users can see the Invitation counter numbers on other users' profile pages.

This is something that only superadmins should see. Or at least the access to this kind of information should be set depending on roles. I think the following options should appear in Access Controls:

View own invite counter
View all invite counters
Access sitewide invite statistics

Leeteq’s picture

Subscribing

dldege’s picture

As a work around you can do what I do which is implement hook_profile_alter and remove the counts


  if (!user_access('administer users')) {
    unset($fields['Invitation counts']);  
  }
MikeMoirano’s picture

I would also like to do this, both removing number of invites from the profile page and from the invite menu "your invitations." (Actually I would like to completely remove the 'your invitations' feature.) Would the hook_profile_alter change this for all users or just the administrator? Also, do I have to add anything else or would I simply add that php snippet to my template.php? Thanks!

dldege’s picture

if would remove it for everyone but you could wrap it all in something like

if (!user_access('administer users') {
//Remove all the sections you don't want
}

profile_alter is a module hook so I'm not sure you can put it in template.php (not sure what you would name it??) - maybe nameoftheme_profile_alter() works, never tried it.

zokazola’s picture

Thanks for the quick response. I guess I am not exactly sure where to implement the hook_profile_alter then. Thank!

dldege’s picture

I normally make a module for such code that is custom for my site where I put all my hooks like this.

Anonymous’s picture

Any idea when this will be included in the developer version - or is it already? (subscribing)

smk-ka’s picture

Good news, I've separated the invite stats functions from the main module and put them into its own module called Invite Statistics. That module also contains above patch that adds two permissions for greater control. I think this approach should satisfy anyone who was annoyed by the current functionality, since you can now fully control whether you want the stats at all.

So, if someone could check out the current DRUPAL-5 branch (or wait a couple of hours until the dev package gets updated) and test the new code/permissions, the next release could be ready shortly.

Anonymous’s picture

I cannot say anything about the Invite Statistics part as I do not need that kind of functionality, but I have installed the latest Invite dev module and I can confirm that Drupal no longer shows the invite statistics. Many thanks for your work, that was very helpful!

tobias’s picture

Hi -

many thanks for your work on this aspect of this very nifty module. I have installed this latest version and it seems to be working great. No issues with it so far.

Cheers,

Tobias

consolejockey’s picture

Priority: Critical » Normal

I'm still having this issue. Even with "track invitations" set to only admin level users under Access control I'm still seeing "Invitation counts" in user profiles when unauthenticated and when logged in as a non-admin user. I've tried uninstalling and reinstalling the invite module and still cannot hide this info. Any help would be appreciated.

smk-ka’s picture

Status: Needs review » Fixed

@consolejockey
First, the separated statistics module is available in CVS or development snapshot only. Second, the permission for the Invite Statistics module is named view (own) invite statistics.

Anonymous’s picture

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.