Viewing/Editing/Deleting non-existent users

cef mentioned two potential problems:

1) deleting users from user/___/delete seems to delete by name rather than by UID. I checked this in CVS, and that's not the case -- deleting is done by UID.

2) going to user/___ or user/___/edit for a non-existent user shows a blank form, rather than a page not found, or something like that.

Looking at user.module in HEAD, it looks like there's an || where there should be an &&, unless I'm missing something.

In user_menu:

      if ($user_exists !== FALSE || $admin_access) {
        $items[] = array('path' => 'user/'. arg(1) .'/view', 'title' => t('view'),
          'access' => $view_access, 'type' => MENU_DEFAULT_LOCAL_TASK, 'weight' => -10);
        $items[] = array('path' => 'user/'. arg(1) .'/edit', 'title' => t('edit'),
          'callback' => 'user_edit', 'access' => $admin_access || $user->uid == arg(1),
          'type' => MENU_LOCAL_TASK);
        $items[] = array('path' => 'user/'. arg(1) .'/delete', 'title' => t('delete'),
          'callback' => 'user_edit', 'access' => $admin_access,
          'type' => MENU_CALLBACK);
...

Is there any reason why someone with admin access should be able to edit and delete a non-existent user?

I was originally going to attach a patch that just changed the || to an &&, but I think this is a little neater. In addition to preventing the editing and deleting of non-existent users, it prevents the editing and deleting of UID 0, and skips an unnecessary $admin_access check, since the menu items already take care of it as needed.

Seems that there was quite a bit of discussion about not 'special casing' the deletion of uid 0 and 1 (e.g., http://drupal.org/node/46149), so I think that perhaps it's best to stick to the original idea of just replacing the || with &&. Otherwise, this look good.

Djun

Actually, the && patch would prevent a user from editing his own account, if I'm reading the code correctly, so that wouldn't work anyway.

Here's a revised patch that removes the UID 0 special case, but is otherwise the same as the previous one.

There is a check on uid > 0 now (v1.612 : http://drupal.org/node/43818)
Permissions were also checked by sa-2006-001: Custom menu items are accessible to anyone (v1.594)

A user does not have access to the view/edit/... page for a non-existing user. You get a "page not found" now.

Setting it as fixed.