Nodeprofile does not respect "access user profiles" permission [#339562]

Hello,

I've looked all over but could not find anything related to this - sorry if I've overlooked something very obvious.

I've enable the userprofile and created a node type and added fields through CCK - however, I've turned off "access user profiles" for normal users in the Access control page. Nevertheless, all users can access the nodeprofile nodes of other users (as long as they have the "access content" permission of course).

Is this 'by design' or have I overlooked something (nice to know before I start poking around the code)?

Comments

Comment #1

kirie commented 26 November 2008 at 21:12

Title:

Nodeprofile does not respect "access user profiles" profiles

» Nodeprofile does not respect "access user profiles" permission

Sorry, fixed mistake in title

Comment #2

gregrenner commented 1 April 2009 at 20:57

This is of interest to me as well. I feel like this is a simple setting I've overlooked. Public profiles are great for open social networking sites. Lets say I wanted to use Node Profile for an eCommerce site (for example) and store private information such as Address, Email, Phone Number, etc. that should be kept hidden from other customers then I would want the ability to turn off access to a user's node profile for everyone but the admin and the user it belongs to.

Has anyone tried this before?

Comment #3

kirie commented 2 April 2009 at 21:29

It's been a while since we implemented this, but I dug it out and found out we went with a small custom module which basically had three parts:

- Small admin settings page where we could select which profile node type to enable access control on (we could also have injected this directly into the node type edit form).
- Implemented hook_nodeapi to 'access deny' all but node author and users with 'administer nodes' privileges.
- Implemented hook_db_rewrite_sql to prevent nodes to show up in i.e. search results etc.

All in all it came in to about 100 lines (including comments).

Comment #4

SeanA commented 5 November 2009 at 13:46

A simpler solution should work. For your nodeprofile content type, uncheck 'Published' and
'Promoted to front page' in the default workflow options. Then only the user and admins with 'administer nodes' permission will be able to view the content.