[support] user_autocomplete and privacy

[Greg Knaddison]

Note that there are also username auto-complete callbacks that provide
lists of usernames. You should hook_menu_alter those if you haven't
already to use the "access user profiles" permission (or something
similar).

This is not really changed in Drupal 7 and it's probably too late to change it.

For Drupal 8 I started this issue http://drupal.org/node/849602

Regards,
Greg

--
Greg Knaddison | 303-800-5623 | http://growingventuresolutions.com
Mastering Drupal | http://www.masteringdrupal.com




On Wed, Jul 21, 2010 at 2:16 AM, Ivan Sergio Borgonovo
<mail at webthatworks.it> wrote:
> I'm writing a module that should hide user existence according to
> their privacy settings.
>
> I've been able to hide names (overriding phptemplate_username) and
> users profiles (404 with hook_user view).
> That's far from clean but at least it works. Is D7 any better in
> this area?
>
> But I'm out of reasonably clean hack to hide users existence in
> user_autocomplete.
>
> Everything is guarded by a user_access, 'access user profiles' and I
> can't see any other way than hacking core.
>
> --
> Ivan Sergio Borgonovo
> http://www.webthatworks.it
>
> --
> [ Drupal support list | http://lists.drupal.org/ ]
>