Navigating to /relationships/xxx results in everyone's relationships and elaborations being shown to authenticated users

Assuming you have 1 relationship type set up then if you go to /relationships/1 it works fine showing your relationships of type "1" however if you pass any other value to the url eg "blah" /relationships/blah it will list every single relationship on the site for every user and show the elaboration comments that users have entered too.

Comments

victoria_b’s picture

victoria_b commented

Happens on my site too.

Hope this will be fixed soon.

fossle’s picture

fossle commented

subscribing

Valc’s picture

Valc commented
Version: 6.x-1.0-rc3 » 6.x-1.0-rc6

subscribing

Still there in the newest release. Any invalid argument for * in the 'relationships/*' path will result in all relationships of all users beeing displayed to any registered user.

mrf’s picture

mrf commented
Issue tags: +6.x-1.1

Closed #1182844: Typing in relationships/(anything) shows alot of users as a duplicate of this issue.

mrf’s picture

mrf commented
Version: 6.x-1.0-rc6 » 6.x-1.x-dev

Note to read http://drupal.org/node/209056 and line 525 or therabouts of user_relationships_ui.module for the path to fixing this.

mrf’s picture

mrf commented
Priority: Normal » Major
Issue tags: -6.x-1.1

Pretty sure you can only see information you would already have access to with this method (plugging in a given users uid) but this still definitely needs a fix as something is seriously broken with these generated items.

mrf’s picture

mrf commented
Status: Active » Fixed

Fix committed to 6.x-1.x-dev

mrf’s picture

mrf commented
Version: 6.x-1.x-dev » 7.x-1.x-dev
Status: Fixed » Active

Pretty sure all the menu stuff has changed but leaving this open as a reminder to check the status of this bug in 7.x.

mrf’s picture

mrf commented
Status: Active » Fixed

Dropped completely from 7.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.