User info should not be visible without permission

I made a patch that fixed this by adding a new permission, "access users".

This is everything this patch does:

• Add new permission, "access users"
• If a user does not have the "access users" permission, s/he cannot read another user's profile at all, and instead gets an "access denied" page.

I hope I did this in the proper way.

I think we should not introduce a new permission but merge with the existing 'access user list' permission (or rename it to 'access users'). Marking this "won't fix" until the patch has been udpated.

Another patch, this time renaming the permission "access user list" to "access users", and adding a check in the user viewing function to only allow users with this permission to view the user information.

The previous patch was accepted, but then for some reason reversed as part of another CVS commit.

So, here is a new patch that brings back the "access users" permission. It controls whether or not a user may view other users info.

A new and revised patch.
It adds an "access users" permission

I'd like to see this patch applied to cvs before the 4.5 release. Now that we can protect our nodes from unauthorized access it just makes sense to protect our user data as well. In the future I'd like to see scheme where the user (as in end-user) is able to selet which of his data gets published.

I would like this too

Can the name be changed to 'view user profiles'?

It can, but I used "access" for consistancy. we have "access newsfeeds", "access comments", "access etc".

This patch is critical for corporate sites btw. A corporate site that has its customers information lying on the streets (so to say) is not-done.

Ber

Updated for CVS. I assumed that "admin users" implies "access users" in user_admin.

Does not apply anymore, Ber can you have a look at it?

New patch. Should apply to HEAD.

It's a patch (which still applies and wants into core).

Ok, updated patch. Includes changes to format_name to only display unlinked username for non-privileddged users. 'acccess users' is now 'access user profiles'. The search users tab won't get displayed either if you are not allowed to seee user profiles. The patch got even tested.

Further testing revealed a bug in the older parts of the patch...

Another iteration: Users should alwys be allowed to see their own user page.

Committed to 4.6/HEAD.

We found that users should not wonder why they cannot see other users' pages anymore. DB update required.

Patch for HEAD attached, 4.6 to follow.

Where the access checks for the blocks required?

Also, people can't update their own profile information with this patch. Marking this critical.

Committed to HEAD.

the database updates weren't applied yet.

Database updates were deemed unnessesary. I am not too happy about that, as I recall the many issues that people had when nobody could see any content on their site due to a not set permission. Oh well.