Early Bird Registration for DrupalCon Portland 2024 is open! Register by 23:59 PST on 31 March 2024, to get $100 off your ticket.
One of the users of my site noticed that their content profile nodes were showing up in google queries for his name. While content_profile restricts access to profiles via the user page, it does not restrict access via the node alias (users/bitchkat/profile) or node/%node url (node/78)
I fixed this in one of my custom modules as follows
function league_manager_menu_alter(&$items) {
if ($items['node/%node']['access callback'] !== TRUE) {
$items['node/%node']['access callback'] = 'lms_node_access';
}
}
function lms_node_access($op, $node, $account=null)
{
if (is_null($account)) {
global $user;
$account = $user;
}
// content profile isn't blocking content_profile nodes
if ($op == 'view' && is_content_profile($node->type)) {
return ($account->uid == $node->uid)
|| user_access("access user profiles");
}
// fall back to regular node access rules
return node_access($op, $node, $account);
}