Tested on Drupal 7.16 and 7.17 , both test applications with only the listed Modules active (other than the core ones)

Removing permission for the -Authenticated User- to edit his own -Profile2 page profile- cause him to lose his ability to access his -Profile2 page Main profile-.

Permission removed in
Home » Administration » People
Profile2 module >> Main profile: Edit own profile
Main profile is the default profile created by the module -Profile2 pages- itself, but the bug is present in other custom made profiles pages too.

The -Authenticated user- still have permission to see his own profile in
Home » Administration » People
Profile2 module >> Main profile: View own profile

This only happen when the chkbox in
Home » Administration » Structure » Profile types
>>Provide a separate page for editing profiles. is checked , ergo when the display of the -Profile2 pages Main profile- does NOT appen in the user core profile page

Giving the -Authenticated user- permission to Edit his own profile make the -Profile2 pages Main profile- visible and editable again.

When permisison to edit hiw own profile is removed to -Authenticated user-, the -Authenticated user- lose both access to his own profile and the menu link in the Header created by default from the module.

granting to the -Authenticated user- permission to see user profiles in
Home » Administration » People
User>>View user profiles , doesn't improve the situation.

Entity Api version: 7.x-1.0-rc3
Default Drupal theme.
Database: Mysql 5.5.27-28.1-log
PHP 5.3.18
Web server: Apache/2.4.3 (Unix) mod_fcgid/2.3.7

CommentFileSizeAuthor
#9 view_permission-1836322-10854574.patch647 bytesedvanleeuwen

Comments

gvnl’s picture

gvnl commented

I have the same. I noticed though, that the profiles are actually visible to the user if the url to the profile page is entered manually. It just disappears from the menu. Thus, the issue is not about granting access, but about populating the menu.

gvnl’s picture

gvnl commented

This is a refinement of my previous comment. This is my take on the problem, but please forgive me for not being completely knowledgeable on Drupal's internal architecture. I think the problem works this way:

  • Menu items will typically refer to a url such as '/profile-profile_type', where profile_type is of course the specific profile you are working on.
  • If you enter such an 'unpersonalized' url by hand, access to the profile page is denied.
  • However, if you manually enter '/profile-profile_type/uid', where uid is the numerical user ID as in the global $user->uid, then access is granted to the profile page, just as expected. Moreover, it is not editable; just the way we wanted.
  • Thus, I guess the problem is that the 'unpersonalized' url is not properly interpreted as a url to the particular user's profile, which in turn leads to a wrong assessment of access permissions.
  • Yet, this fails to explain why everything runs just fine if the user has editing permission to the profile.

This is where my Drupal knowledge ends, sorry... Hope this helps others diagnose the problem, though.

menelaoEE’s picture

menelaoEE commented

I had to change approaches since of timing issues, however in the hope to learn something new i re-enabled the previous settings to test what you said.
In my test, with the proper permission granted, even while manually passing the ID of the user in the page Url i continue to receive an ACCESS DENIED error.
It's worth noting tho that i spent only a limited amount of time testing this and that i may be making some other kind of mistake,
still thank you for taking time in replaying to my message.

spessex’s picture

spessex commented

I'm having the same issue. If I remove the permission to edit the users profile the link disappears from the menu and I cannot access his profile page to even view it by using the URL? I'm using 7.13

spessex’s picture

spessex commented

Hi

Did you ever get around this problem ads I'm pretty desperate to find a fix for this?

Exploratus’s picture

Exploratus commented

Same. If I disable edit on its own page, I cannot view a profile. Man, this is one buggy module From sitemap and panels support, to a very unintuitive interaction, I am a bit underwhelmed by this module.

jay-dee-ess’s picture

jay-dee-ess commented
Related issues: +#1334074: View and edit Profiles

Any update to this issue? I'm importing user info from LDAP into a role with a Profile2 managed profile page. I only want them to see the info and not be given the option to edit.

edvanleeuwen’s picture

edvanleeuwen
Primary language Dutch
Location Waalwijk
commented

I think I have a solution, see patch attached. Please test.

edvanleeuwen’s picture

edvanleeuwen
Primary language Dutch
Location Waalwijk
commented
Version: 7.x-1.2 » 7.x-1.x-dev
Status: Active » Needs review
StatusFileSize
new view_permission-1836322-10854574.patch647 bytes

Status: Needs review » Needs work

The last submitted patch, 9: view_permission-1836322-10854574.patch, failed testing.

edvanleeuwen’s picture

edvanleeuwen
Primary language Dutch
Location Waalwijk
commented

I am not sure why the patch fails, but what I have done is to remove a test of userView which always failed in the function profile2_user_view:

Original

   if ($profile_type->userView && $profile = profile2_load_by_user($account, $type)) {

Changed:

   if ($profile = profile2_load_by_user($account, $type)) {

This does not seem to have negative effects to the permissions, as far as I have tested.

rickj’s picture

rickj commented
Status: Needs work » Closed (duplicate)

This appears to be a duplicate of Issue #1954290, fixed in 7.x-1.4.