4.7.4 update broke my profile module

Yeah, there was a bad patch applied:

http://cvs.drupal.org/viewcvs/drupal/drupal/modules/profile.module?hidea...

Here's a patch which fixes the problem.

there also seems to be a bug in the profile field browsing. the title is now check_plain()'ed but it's got a theme('placeholder') in it.

I think a near-term update to 4.7.5 is in order.

If patches to the core break other pieces of core distribution (which profile.module is part of) then 4.7.4 cannot be considered a stable release.

However, I suggest a bit more testing to find any other potential problems in the core, especially related to the change in forms.

Thoughts?

I just discovered this problem on the sites I maintain and can confirm that the profile_29.patch above fixes the problem for me.

Losing the "placeholder" formating of the value in the titel is a pity. Can it be made to work again?

I've applied this to the 4.7 branch.

this doesn't make much sense to me, unless you *really* want to insure that XSS is blocked, I guess. The default theme_placeholder already runs check_plain():

http://api.drupal.org/api/4.7/function/theme_placeholder

I just downloaded 4.7.4. I enabled profiles and added terms like "Company Name"... I click the "name" entered on a users profile and get the following which seems very similar to this.

user warning: Unknown column '$query' in 'where clause' query: SELECT COUNT(*) FROM users u INNER JOIN profile_values v ON u.uid = v.uid WHERE v.fid = 1 AND $query AND u.access != 0 AND u.status != 0 in /var/www/html/drupal/includes/database.mysql.inc on line 121. 

user warning: Unknown column '$query' in 'where clause' query: SELECT u.uid, u.access FROM users u INNER JOIN profile_values v ON u.uid = v.uid WHERE v.fid = 1 AND $query AND u.access != 0 AND u.status != 0 ORDER BY u.access DESC LIMIT 0, 20 in /var/www/html/drupal/includes/database.mysql.inc on line 121. 

i appear to have the correct SQL you show in your patch. help is appreciated.

Look carefully the important change in the patch is singe ' quotes vs. double ".

my mistake... did a double SINGLE quote ... vs. the single DOUBLE quote.

I have a test site running 4.7.4 which is still only on my local machine. I applied the patch listed here and it removed the mysql error I got after the upgrade. Then, however, I noticed that when I listed /profile I only got the first few users (i.e. the ones before I inserted the patch and then added 80+ more users). After noticing this and messing with lots of different code, I remembered making this change.

I re-read the article, removed the 4.7.4 patched version and replaced it with the 4.7.3 profile module then the list came back. Now, even more oddly, in IE 7 (works fine in firefox) when I click on a particular users name I get a missing page error. The error in my log is:

Type page not found
Date Thursday, November 2, 2006 - 15:00
User Staff
Location http://localhost/user/53
Referrer http://localhost/profile
Message user/53 not found.
Severity warning
Hostname 127.0.0.1

This only happens in IE 7, and I can reach all of the user profiles "/user/#" fine via firefox. Any ideas of why this would be? It seems somewhat related to this issues, but I cannot tell for sure.

I should add that this happens in every user # except for the 3 that were added before I did the initial patch. In other words, IE 7 can use /user/1, /user/2, and /user/3 and all the others show up as missing pages....

Not certain what caused this but if I set the access field in the 'users' table to something other than 0 (i.e. make it appear as if the users had logged in) then all of the profiles show up in IE??