I'm new to content_profile so this may or may not be a bug.

Steps to recreate:
User 2 tries to edit user 3's profile node by visiting example.com/user/3/profile/profile

Observed Behavior:
User 2 is redirected to the node edit page for his own profile node.

Expected Behavior:
Access denied message.

This seems to be even more confusing for users when you enable "Show a tab at the user's page" since then there is a tab that links to example.com/user/3/profile/profile

Attached is a patch that modifies the profile/profile callback function so that it checks to make sure the user is trying to edit their own profile node or the user has "administer node" permissions.

CommentFileSizeAuthor
profile_page_access.patch764 bytesjcruz

Comments

andreiashu’s picture

Status: Needs review » Reviewed & tested by the community

@jcruz: I just applied the patch and it works. Thanks !

RTBC in my opinion.

fago’s picture

Status: Reviewed & tested by the community » Fixed

indeed, thanks. I've added a comment to it and committed it.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.