Exposed user/author filter autocomplete works only with 'administer view' permission active

This should now be fixed in -dev. Thanks for the report!

How did you setup an auto complete search? I have a similar situation where I need to be able to search by username or the User's Last Name (a cck text field) using an autocomplete search filter above the view.

I'm fighting with the same thing as #4.. i would need autocomplete or dropdown list for filtering from text field, but this seems to be impossible? For taxonomy terms they work ok.

This has caused major information leakage on sites that doesn't really want to expose their user base. (ref: http://www.behindthefirewalls.com/2013/04/stealing-drupal-users.html). Can we fix it?

we can fix it either by using the module https://drupal.org/project/config_perms or by changing the code mentioned below in function views_ajax_autocomplete_user() in views module .

Current :- if ($last_string != '') {

Change :- if ($last_string != '' && user_access('access user profiles'))

In D7 views module's menu hook we have

$items['admin/views/ajax/autocomplete/user'] = array(
    'page callback' => 'views_ajax_autocomplete_user',
    'theme callback' => 'ajax_base_page_theme',
    'access callback' => 'user_access',
    'access arguments' => array('access user profiles'),
    'type' => MENU_CALLBACK,
    'file' => 'includes/ajax.inc',
  );

We have access argument as 'access user profiles'. So for D7 perspective I don't think this is a security issue as it will only give you username if the current role has permission to view other user's profiles. see https://drupal.org/admin/views/ajax/autocomplete/user/bappa

But for D6 definitely we can add access argument 'access user profiles' by removing the existing 'access content'

Both solutions mentioned above is correct but I would prefer the later one mentioned by bapp.sarkar. In essence I think we need to do the way its done in D7 for D6, can this not be back ported?

The code base linkis not accessible, 7.x-3.x already has the fix (even current stable release 7.x-3.7 has) as specified in #8.

This seems to be issue for version 6 . adding the patch for drupal 6.

The patch is fine to me

The Drupal 6 branch is no longer supported, please check with the D6LTS project if you need further support. For more information as to why this issue was closed, please see issue #3030347: Plan to clean process issue queue