At http://drupal.org/node/64893, a fix has been submitted to remove visibility of unused accounts to deter spammers.
When viewing such an account, a user gets a 404.
The problem is that such accounts are still listed in the user list (profile), so a user would browse the list, click on the profile link for another user, and get a 404.

To reproduce: create a new account, and go to ?q=profile (possibly as another non-admin user).
Without the patch, the newly created but never accessed account is listed but accessing the profile gives a 404.
With the patch, the account is not listed in the first place.

The admin can still see all users, regardless of status, at ?q=admin/user/user .

CommentFileSizeAuthor
#13 user_list_47.diff_0.txt1.37 KBbeginner
#10 user_list4.diff.txt1.38 KBmhutch
#4 user_list3.diff.txt1.38 KBmhutch
#3 user_list2.diff.txt1.36 KBbeginner
#1 user_list_47.diff.txt795 bytesbeginner
user_list.diff.txt809 bytesbeginner

Comments

beginner’s picture

beginner commented
StatusFileSize
new user_list_47.diff.txt795 bytes

here's a patch for 4.7

pwolanin’s picture

pwolanin commented

Can we combine this patch with some version of this one: http://drupal.org/node/84490

Or is it better to keep these issues separate?

beginner’s picture

beginner commented
StatusFileSize
new user_list2.diff.txt1.36 KB

What you are trying to achieve seems different.
This patch fixes a simple issue and should get committed soon.

I missed a query in my earlier patch.

mhutch’s picture

mhutch commented
StatusFileSize
new user_list3.diff.txt1.38 KB

Actually, this issue is a duplicate of http://drupal.org/node/73804, not the other way around, because this one is newer.

Also, my (older) patch in the other issue is better, because it also hides blocked users and admin-created users (access=-1, see http://drupal.org/node/84490). The header format of the patch may not have been quite right, but I've edited it into this one. I've also removed some unnecessary string parsing.

beginner’s picture

beginner commented

I just notice a mistake I made in my original patch that you copied in the second.
Shouldn't status be u.status?

beginner’s picture

beginner commented

... I mean in the first query, not in the second, obviously.

mhutch’s picture

mhutch commented

Nah, I made the mistake in my original patch too ;-)

It doesn't really matter, because there is no 'status' field in {profile_values}.

beginner’s picture

beginner commented
Status: Needs review » Reviewed & tested by the community

The patch is good, then.

dries’s picture

dries commented
Status: Reviewed & tested by the community » Needs work

The check on status makes sense but what is the rationale with hiding admin created users? These are valid users, regardless of the fact they logged on. Not being able to see these might be confusing. Does it trigger a bug when you try to view their profile?

mhutch’s picture

mhutch commented
Status: Needs work » Needs review
StatusFileSize
new user_list4.diff.txt1.38 KB

Sorry, I misunderstood the reasoning behind setting negative access values. Here's an updated patch that will show admin-created users.

dries’s picture

dries commented
Status: Needs review » Fixed

Great job, MikalH. Committed to CVS HEAD. Thanks.

beginner’s picture

beginner commented
Version: x.y.z » 4.7.3
Status: Fixed » Reviewed & tested by the community

Does the patch need to be re-rolled for 4.7?

beginner’s picture

beginner commented
StatusFileSize
new user_list_47.diff_0.txt1.37 KB

well, here it is.

gerhard killesreiter’s picture

gerhard killesreiter commented
Status: Reviewed & tested by the community » Fixed

committed

pwolanin’s picture

pwolanin commented

please look at this related issue now that the above is committed: http://drupal.org/node/84490

killes@www.drop.org’s picture

killes@www.drop.org commented

MikalH, beginner: Please note that changing " to ' is not always permissible in PHP:

http://drupal.org/node/89405

mhutch’s picture

mhutch commented

Oops, sorry! I didn't notice that string interpolation was actually being used :(

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)