Every users "my account" page is visible through URL manipulation

Let me ask for verification, this is surely in 4.6.5?

I was able to recreate this issue in Drupal 4.6.4

Dub

In 4.7, the user profile is not revealed, but the non-numeric 'uid' shows up on the user login form. See attached screenshot

I was also able to recreate this problem in Drupal 4.6.3..

Dub

i get the same error with head as puregin. This is not funny if someone spread the url drupal.org/user/SIGN_UP_TO_THIS_CRAPPY_SITE/ :-)

quick fix for Drupal 4.6.3 & Drupal 4.6.4

Replace the theme_user_profile (which starts on line number 614) with the following.

function theme_user_profile($account, $fields) {
  if (!user_access('access user profiles')) {
    drupal_access_denied();
    }   
  else {
          $output = "<div class=\"profile\">\n";
          $output .= theme('user_picture', $account);
	foreach ($fields as $category => $value) {
               $output .= "<h2>$category</h2>$value";
	   } 
          $output .= "</div>\n";
          return $output;
        }
}

I don't have a CVS or 4.7 beta version installed at the moment to try the same with that.

hope that's of use to others and is only a temporary (emergency) fix until the source of the problem is resolved.

Dub

Sorry. Forgot to mention the above if for the user.module (for Drupals version 4.6.3 , 4.6.4 and 4.6.5)

Dub

Just to confirm that the bug exists in 4.6.3 and that the quick fix (#6) by Dublin Drupaller works (thanks for that).

It does seem to add some minor problems to the resulting page.

Visit http://www.orchidsonline.com.au/interactive/?q=/user/1asdfa to see the results.

Obviously that is better than being able to get to user info without authorization but it needs to be looked at.

wellsy

Sorry Wellsy...it was intended as an emergency fix only...I think what's happening is that Drupal is picking up the user/n argument, checking access and then displaying the access denied message. But it then picks up on the user/n+added letters argument and tries to display the page again.

I'm looking at it now to see why that's the case, so while the emergency fix (posted above) isn't perfect, at least it protects the user profiles from anonymous viewing until we suss out what's going on

Dub

Yep...understood.

I was basically agreeing with what you have just said

wellsy

This doesn't seem to be an issue if one is using clean urls. I just tried it on my 4.6.5 site with clean urls and I only see the Access Denied message.

has this issue been fixed now in the latest version of 4.6.5 available for dowload from drupal.org?

I just tested and my new install (recent download) and all appears to be good.

Ah....Just been checking my old install (noticed an anonymous visit in the logs) and found that if you enter user/111asdfa then (if there is that number user) you can see the user details. No editing options are available.

user/11asdfa does not work

So the quick fix seems to have a weakness I am sorry to say

I wonder whether user/222asdfa works? Or user/333asdfa works?
Sorry I do not have that many users to check.

Note: my install is 4.6.3 with the quick fix