The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.I'm finding that when the permission view userpoints is enabled, when a user with that role visits another user's profile, besides seeing that user's points, they also see and "View" link - which leads to a 404 page.
I'm not certain of the intended behavior. Either the "View" link shouldn't be rendering for users with the view userpoints or these users should be able to access the other user's points summary. I'm betting the "View" link isn't supposed to be rendering.
| Comment | File | Size | Author |
|---|---|---|---|
| #22 | userpoints.module.view_userpoints1.patch | 882 bytes | quotesbro |
| #21 | userpoints.module.view_userpoints.patch | 887 bytes | quotesbro |
| #17 | fix_uid.patch | 2.74 KB | berdir |
| #15 | userpoints.patch | 496 bytes | MasterChief |
| #11 | d6_clean_up_my_access_checks2.patch | 4.68 KB | berdir |
Comments
Comment #1
berdirConfirmed, we also saw this when porting the module to D7.
The patch is against D7, I will create a backport once it has been commited to D7.
Comment #2
BenK commentedI've tested the patch and confirmed that the "View" link is now gone... Everything worked great (once I cleared my cache). So this looks ready to be committed!
--Ben
Comment #3
berdirCommited to D7.
Ok, attaching a possible patch for D6, might not be perfect yet.
This actually contains a full backport of the userpoints_access_my_points() functions, which simplifies the access check and doesn't check if the user already has points.
This also has a simple definition for myuserpoints, which redirects to myuserpoints/%user_uid_optional so that existing links still work. We might want to add that to D7 as well.
Comment #4
BenK commentedComment #5
Dret commentedI have a problem with the same functions in 6.x-1.1 Version:
(originally I thought was related to Contributed Module and I posted here: http://drupal.org/node/911048, sorry!)
At this moment when Admin (uid 1) try to use "Views" in a profile page of another user (uid 4) a 403 is returned.
The same 403 appear if a user (uid = 4) try to see "My Point" page or "Views" page in own profile page though having permission "view own userpoints".
Thanks Bye!
Comment #6
berdirTagging to make it easier to find patches like this one.
Comment #7
marcushenningsen commentedIt seems to have been corrected in the dev-version.
Comment #8
berdir#3: d6_clean_up_my_access_checks.patch queued for re-testing.
Comment #9
berdir#3: d6_clean_up_my_access_checks.patch queued for re-testing.
Comment #11
berdirNew patch to fix the conflict with another patch that was commited.
Comment #12
berdirCommited.
Comment #13
MasterChief commentedThis patch breaks the page my points, here the error message :
Missing argument 1 for userpoints_list_my_userpoints() in ..../userpoints.module on line 1663Comment #14
berdirTry rebuilding the menu.
Comment #15
MasterChief commentedHi berdir!
Flush all caches has for result to just make the error goes away but the page is still broken.
Here a first patch which fix just the title problem.
Comment #16
berdirOh, I see, $uid also needs to be replaced with $points_user->uid.
Comment #17
berdirHere is a patch, can you please test?
Really messed up this one, sorry about that :)
Comment #18
MasterChief commentedI tested the patch and it works well now !
PS :
Did you the last patch in the issue for float support ?
Comment #19
berdirOk, commited.
Comment #21
quotesbro commented#15 and #17 patches result in hiding user's points on the user profile page from other users having permission 'view userpoints'.
Here is a tiny patch against 6.x-1.x-dev to fix it
Comment #22
quotesbro commenteda little improvement
Comment #23
manuel.adanClosing this as outdated, 6.x version is no longer maintained.