April 2005 - Development - lists.drupal.org

[drupal-devel] [bug] Error when deleting containers and forums
by chx 12 Apr '05

12 Apr '05

Issue status update for http://drupal.org/node/20284 Project: Drupal Version: cvs Component: forum.module Category: bug reports Priority: critical -Assigned to: Anonymous +Assigned to: chx Reported by: Donovan Updated by: chx -Status: active +Status: patch Attachment: http://drupal.org/files/issues/forum_12.patch (786 bytes) I won't comment this patch. chx Previous comments: ------------------------------------------------------------------------ April 10, 2005 - 23:51 : Donovan I receive the following error when deleting containers and forums: user error: Table 'db12345678.forum' doesn't exist query: SELECT f.nid FROM forum f WHERE f.tid = 37 in /.../includes/database.mysql.inc on line 66. user error: Table 'db12345678.forum' doesn't exist query: SELECT f.nid FROM forum f WHERE f.tid = 38 in /.../includes/database.mysql.inc on line 66. warning: Cannot modify header information - headers already sent by (output started at /.../includes/common.inc:384) in /.../includes/common.inc on line 192. I am running the latest CVS versions of Drupal and all modules including forum module. My config is using a database prefix so I believe the code is not appending the db prefix.

1 0

[drupal-devel] Status of Sections
by Dan Robinson 12 Apr '05

12 Apr '05

Folks, Is anyone planning to continue work on "Sections"? How much work is there to upgrade it to 4.6? Thanks, Dan

3 3

[drupal-devel] [bug] User info should not be visible without permission
by Anonymous 12 Apr '05

12 Apr '05

Issue status update for http://drupal.org/node/4166 Project: Drupal Version: cvs Component: user system Category: bug reports Priority: critical Assigned to: killes(a)www.drop.org Reported by: mic Updated by: Anonymous Status: patch Attachment: http://drupal.org/files/issues/user_17.patch (1.11 KB) The previous patch was for the "can't edit profile pages" problem. This patch here removes the access checks for the blocks. I'd leave them in, but have no strong feelings about either way. Anonymous Previous comments: ------------------------------------------------------------------------ November 17, 2003 - 05:23 : mic When anonymous visitors do not have "Access userlist" permission, they can still view all the public info in user profiles. Drupal sites that are created for a group of friends or for an organization want to protect their e-mail addresses, telephone numbers and so on, while making these accessible to fellow members. This could be a critical feature request, but since I think it's an error, I'm sending you this as bug. (I don't have CVS, so I'm hoping someone else will make the simple correction needed to the user module) ------------------------------------------------------------------------ February 3, 2004 - 04:41 : daBrado Attachment: http://drupal.org/files/issues/user-module-add-view-permission.patch (1.54 KB) I made a patch that fixed this by adding a new permission, "access users". This is everything this patch does: Add new permission, "access users" If a user does not have the "access users" permission, s/he cannot read another user's profile at all, and instead gets an "access denied" page. I hope I did this in the proper way. ------------------------------------------------------------------------ April 21, 2004 - 19:25 : Dries I think we should not introduce a new permission but merge with the existing 'access user list' permission (or rename it to 'access users'). Marking this "won't fix" until the patch has been udpated. ------------------------------------------------------------------------ May 28, 2004 - 01:26 : daBrado Attachment: http://drupal.org/files/issues/user-module-add-view-permission_0.patch (1.88 KB) Another patch, this time renaming the permission "access user list" to "access users", and adding a check in the user viewing function to only allow users with this permission to view the user information. ------------------------------------------------------------------------ July 5, 2004 - 14:31 : Anonymous Attachment: http://drupal.org/files/issues/user-module-add-view-permission_1.patch (1.86 KB) Here is a patch again, now for CVS. Does the same thing as above. It is a very simple patch. If it seems proper, I hope that can be included before it goes stale. ------------------------------------------------------------------------ July 9, 2004 - 01:08 : daBrado Attachment: http://drupal.org/files/issues/user-module-add-view-permission_2.patch (1.33 KB) The previous patch was accepted, but then for some reason reversed as part of another CVS commit. So, here is a new patch that brings back the "access users" permission. It controls whether or not a user may view other users info. ------------------------------------------------------------------------ September 22, 2004 - 15:53 : Bèr Kessels Attachment: http://drupal.org/files/issues/access_users_perm.patch (6.46 KB) A new and revised patch. It adds an "access users" permission ------------------------------------------------------------------------ September 22, 2004 - 17:02 : killes(a)www.drop.org I'd like to see this patch applied to cvs before the 4.5 release. Now that we can protect our nodes from unauthorized access it just makes sense to protect our user data as well. In the future I'd like to see scheme where the user (as in end-user) is able to selet which of his data gets published. ------------------------------------------------------------------------ September 23, 2004 - 00:52 : rkendall I would like this too ------------------------------------------------------------------------ October 14, 2004 - 22:46 : drumm Can the name be changed to 'view user profiles'? ------------------------------------------------------------------------ October 18, 2004 - 08:19 : Bèr Kessels It can, but I used "access" for consistancy. we have "access newsfeeds", "access comments", "access etc". This patch is critical for corporate sites btw. A corporate site that has its customers information lying on the streets (so to say) is not-done. Ber ------------------------------------------------------------------------ November 27, 2004 - 12:49 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user-access.patch (5.96 KB) Updated for CVS. I assumed that "admin users" implies "access users" in user_admin. ------------------------------------------------------------------------ March 1, 2005 - 16:30 : killes(a)www.drop.org Does not apply anymore, Ber can you have a look at it? ------------------------------------------------------------------------ March 7, 2005 - 08:19 : Bèr Kessels Attachment: http://drupal.org/files/issues/user_access_0.patch (9.74 KB) New patch. Should apply to HEAD. ------------------------------------------------------------------------ April 7, 2005 - 20:29 : killes(a)www.drop.org It's a patch (which still applies and wants into core). ------------------------------------------------------------------------ April 8, 2005 - 17:10 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user_access_bug_1.patch (11.45 KB) Ok, updated patch. Includes changes to format_name to only display unlinked username for non-privileddged users. 'acccess users' is now 'access user profiles'. The search users tab won't get displayed either if you are not allowed to seee user profiles. The patch got even tested. ------------------------------------------------------------------------ April 8, 2005 - 17:19 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user_access_bug_2.patch (11.26 KB) Further testing revealed a bug in the older parts of the patch... ------------------------------------------------------------------------ April 8, 2005 - 19:02 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user_access_bug_3.patch (11.35 KB) Another iteration: Users should alwys be allowed to see their own user page. ------------------------------------------------------------------------ April 11, 2005 - 22:49 : Steven Committed to 4.6/HEAD. ------------------------------------------------------------------------ April 11, 2005 - 23:04 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user-db.patch (2.56 KB) We found that users should not wonder why they cannot see other users' pages anymore. DB update required. Patch for HEAD attached, 4.6 to follow. ------------------------------------------------------------------------ April 11, 2005 - 23:11 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user-db_0.patch (2.45 KB) ------------------------------------------------------------------------ April 12, 2005 - 04:25 : Anonymous Won't the way the upgrade numbers don't match up between 4.6 and HEAD eventually cause problems for 4.6 users that upgrade to 4.7? ------------------------------------------------------------------------ April 12, 2005 - 05:20 : Dries Where the access checks for the blocks required? ------------------------------------------------------------------------ April 12, 2005 - 14:02 : Dries Also, people can't update their own profile information with this patch. Marking this critical. ------------------------------------------------------------------------ April 12, 2005 - 14:53 : Anonymous Attachment: http://drupal.org/files/issues/user_16.patch (706 bytes) Sorry, here's a patch.

1 0

[drupal-devel] [bug] User info should not be visible without permission
by Anonymous 12 Apr '05

12 Apr '05

Issue status update for http://drupal.org/node/4166 Project: Drupal Version: cvs Component: user system Category: bug reports Priority: critical Assigned to: killes(a)www.drop.org Reported by: mic Updated by: Anonymous Status: patch Attachment: http://drupal.org/files/issues/user_16.patch (706 bytes) Sorry, here's a patch. Anonymous Previous comments: ------------------------------------------------------------------------ November 17, 2003 - 05:23 : mic When anonymous visitors do not have "Access userlist" permission, they can still view all the public info in user profiles. Drupal sites that are created for a group of friends or for an organization want to protect their e-mail addresses, telephone numbers and so on, while making these accessible to fellow members. This could be a critical feature request, but since I think it's an error, I'm sending you this as bug. (I don't have CVS, so I'm hoping someone else will make the simple correction needed to the user module) ------------------------------------------------------------------------ February 3, 2004 - 04:41 : daBrado Attachment: http://drupal.org/files/issues/user-module-add-view-permission.patch (1.54 KB) I made a patch that fixed this by adding a new permission, "access users". This is everything this patch does: Add new permission, "access users" If a user does not have the "access users" permission, s/he cannot read another user's profile at all, and instead gets an "access denied" page. I hope I did this in the proper way. ------------------------------------------------------------------------ April 21, 2004 - 19:25 : Dries I think we should not introduce a new permission but merge with the existing 'access user list' permission (or rename it to 'access users'). Marking this "won't fix" until the patch has been udpated. ------------------------------------------------------------------------ May 28, 2004 - 01:26 : daBrado Attachment: http://drupal.org/files/issues/user-module-add-view-permission_0.patch (1.88 KB) Another patch, this time renaming the permission "access user list" to "access users", and adding a check in the user viewing function to only allow users with this permission to view the user information. ------------------------------------------------------------------------ July 5, 2004 - 14:31 : Anonymous Attachment: http://drupal.org/files/issues/user-module-add-view-permission_1.patch (1.86 KB) Here is a patch again, now for CVS. Does the same thing as above. It is a very simple patch. If it seems proper, I hope that can be included before it goes stale. ------------------------------------------------------------------------ July 9, 2004 - 01:08 : daBrado Attachment: http://drupal.org/files/issues/user-module-add-view-permission_2.patch (1.33 KB) The previous patch was accepted, but then for some reason reversed as part of another CVS commit. So, here is a new patch that brings back the "access users" permission. It controls whether or not a user may view other users info. ------------------------------------------------------------------------ September 22, 2004 - 15:53 : Bèr Kessels Attachment: http://drupal.org/files/issues/access_users_perm.patch (6.46 KB) A new and revised patch. It adds an "access users" permission ------------------------------------------------------------------------ September 22, 2004 - 17:02 : killes(a)www.drop.org I'd like to see this patch applied to cvs before the 4.5 release. Now that we can protect our nodes from unauthorized access it just makes sense to protect our user data as well. In the future I'd like to see scheme where the user (as in end-user) is able to selet which of his data gets published. ------------------------------------------------------------------------ September 23, 2004 - 00:52 : rkendall I would like this too ------------------------------------------------------------------------ October 14, 2004 - 22:46 : drumm Can the name be changed to 'view user profiles'? ------------------------------------------------------------------------ October 18, 2004 - 08:19 : Bèr Kessels It can, but I used "access" for consistancy. we have "access newsfeeds", "access comments", "access etc". This patch is critical for corporate sites btw. A corporate site that has its customers information lying on the streets (so to say) is not-done. Ber ------------------------------------------------------------------------ November 27, 2004 - 12:49 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user-access.patch (5.96 KB) Updated for CVS. I assumed that "admin users" implies "access users" in user_admin. ------------------------------------------------------------------------ March 1, 2005 - 16:30 : killes(a)www.drop.org Does not apply anymore, Ber can you have a look at it? ------------------------------------------------------------------------ March 7, 2005 - 08:19 : Bèr Kessels Attachment: http://drupal.org/files/issues/user_access_0.patch (9.74 KB) New patch. Should apply to HEAD. ------------------------------------------------------------------------ April 7, 2005 - 20:29 : killes(a)www.drop.org It's a patch (which still applies and wants into core). ------------------------------------------------------------------------ April 8, 2005 - 17:10 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user_access_bug_1.patch (11.45 KB) Ok, updated patch. Includes changes to format_name to only display unlinked username for non-privileddged users. 'acccess users' is now 'access user profiles'. The search users tab won't get displayed either if you are not allowed to seee user profiles. The patch got even tested. ------------------------------------------------------------------------ April 8, 2005 - 17:19 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user_access_bug_2.patch (11.26 KB) Further testing revealed a bug in the older parts of the patch... ------------------------------------------------------------------------ April 8, 2005 - 19:02 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user_access_bug_3.patch (11.35 KB) Another iteration: Users should alwys be allowed to see their own user page. ------------------------------------------------------------------------ April 11, 2005 - 22:49 : Steven Committed to 4.6/HEAD. ------------------------------------------------------------------------ April 11, 2005 - 23:04 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user-db.patch (2.56 KB) We found that users should not wonder why they cannot see other users' pages anymore. DB update required. Patch for HEAD attached, 4.6 to follow. ------------------------------------------------------------------------ April 11, 2005 - 23:11 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user-db_0.patch (2.45 KB) ------------------------------------------------------------------------ April 12, 2005 - 04:25 : Anonymous Won't the way the upgrade numbers don't match up between 4.6 and HEAD eventually cause problems for 4.6 users that upgrade to 4.7? ------------------------------------------------------------------------ April 12, 2005 - 05:20 : Dries Where the access checks for the blocks required? ------------------------------------------------------------------------ April 12, 2005 - 14:02 : Dries Also, people can't update their own profile information with this patch. Marking this critical.

1 0

[drupal-devel] taxonomy rewrite
by Karoly Negyesi 12 Apr '05

12 Apr '05

Hi! I feel the urge to rewrite the taxonomy module for 4.7 Comments are welcome. NK

6 5

[drupal-devel] [bug] User info should not be visible without permission
by Dries 12 Apr '05

12 Apr '05

Issue status update for http://drupal.org/node/4166 Project: Drupal Version: cvs Component: user system Category: bug reports -Priority: normal +Priority: critical Assigned to: killes(a)www.drop.org Reported by: mic Updated by: Dries Status: patch Also, people can't update their own profile information with this patch. Marking this critical. Dries Previous comments: ------------------------------------------------------------------------ November 17, 2003 - 07:23 : mic When anonymous visitors do not have "Access userlist" permission, they can still view all the public info in user profiles. Drupal sites that are created for a group of friends or for an organization want to protect their e-mail addresses, telephone numbers and so on, while making these accessible to fellow members. This could be a critical feature request, but since I think it's an error, I'm sending you this as bug. (I don't have CVS, so I'm hoping someone else will make the simple correction needed to the user module) ------------------------------------------------------------------------ February 3, 2004 - 06:41 : daBrado Attachment: http://drupal.org/files/issues/user-module-add-view-permission.patch (1.54 KB) I made a patch that fixed this by adding a new permission, "access users". This is everything this patch does: Add new permission, "access users" If a user does not have the "access users" permission, s/he cannot read another user's profile at all, and instead gets an "access denied" page. I hope I did this in the proper way. ------------------------------------------------------------------------ April 21, 2004 - 21:25 : Dries I think we should not introduce a new permission but merge with the existing 'access user list' permission (or rename it to 'access users'). Marking this "won't fix" until the patch has been udpated. ------------------------------------------------------------------------ May 28, 2004 - 03:26 : daBrado Attachment: http://drupal.org/files/issues/user-module-add-view-permission_0.patch (1.88 KB) Another patch, this time renaming the permission "access user list" to "access users", and adding a check in the user viewing function to only allow users with this permission to view the user information. ------------------------------------------------------------------------ July 5, 2004 - 16:31 : Anonymous Attachment: http://drupal.org/files/issues/user-module-add-view-permission_1.patch (1.86 KB) Here is a patch again, now for CVS. Does the same thing as above. It is a very simple patch. If it seems proper, I hope that can be included before it goes stale. ------------------------------------------------------------------------ July 9, 2004 - 03:08 : daBrado Attachment: http://drupal.org/files/issues/user-module-add-view-permission_2.patch (1.33 KB) The previous patch was accepted, but then for some reason reversed as part of another CVS commit. So, here is a new patch that brings back the "access users" permission. It controls whether or not a user may view other users info. ------------------------------------------------------------------------ September 22, 2004 - 17:53 : Bèr Kessels Attachment: http://drupal.org/files/issues/access_users_perm.patch (6.46 KB) A new and revised patch. It adds an "access users" permission ------------------------------------------------------------------------ September 22, 2004 - 19:02 : killes(a)www.drop.org I'd like to see this patch applied to cvs before the 4.5 release. Now that we can protect our nodes from unauthorized access it just makes sense to protect our user data as well. In the future I'd like to see scheme where the user (as in end-user) is able to selet which of his data gets published. ------------------------------------------------------------------------ September 23, 2004 - 02:52 : rkendall I would like this too ------------------------------------------------------------------------ October 15, 2004 - 00:46 : drumm Can the name be changed to 'view user profiles'? ------------------------------------------------------------------------ October 18, 2004 - 10:19 : Bèr Kessels It can, but I used "access" for consistancy. we have "access newsfeeds", "access comments", "access etc". This patch is critical for corporate sites btw. A corporate site that has its customers information lying on the streets (so to say) is not-done. Ber ------------------------------------------------------------------------ November 27, 2004 - 14:49 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user-access.patch (5.96 KB) Updated for CVS. I assumed that "admin users" implies "access users" in user_admin. ------------------------------------------------------------------------ March 1, 2005 - 18:30 : killes(a)www.drop.org Does not apply anymore, Ber can you have a look at it? ------------------------------------------------------------------------ March 7, 2005 - 10:19 : Bèr Kessels Attachment: http://drupal.org/files/issues/user_access_0.patch (9.74 KB) New patch. Should apply to HEAD. ------------------------------------------------------------------------ April 7, 2005 - 22:29 : killes(a)www.drop.org It's a patch (which still applies and wants into core). ------------------------------------------------------------------------ April 8, 2005 - 19:10 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user_access_bug_1.patch (11.45 KB) Ok, updated patch. Includes changes to format_name to only display unlinked username for non-privileddged users. 'acccess users' is now 'access user profiles'. The search users tab won't get displayed either if you are not allowed to seee user profiles. The patch got even tested. ------------------------------------------------------------------------ April 8, 2005 - 19:19 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user_access_bug_2.patch (11.26 KB) Further testing revealed a bug in the older parts of the patch... ------------------------------------------------------------------------ April 8, 2005 - 21:02 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user_access_bug_3.patch (11.35 KB) Another iteration: Users should alwys be allowed to see their own user page. ------------------------------------------------------------------------ April 12, 2005 - 00:49 : Steven Committed to 4.6/HEAD. ------------------------------------------------------------------------ April 12, 2005 - 01:04 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user-db.patch (2.56 KB) We found that users should not wonder why they cannot see other users' pages anymore. DB update required. Patch for HEAD attached, 4.6 to follow. ------------------------------------------------------------------------ April 12, 2005 - 01:11 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user-db_0.patch (2.45 KB) ------------------------------------------------------------------------ April 12, 2005 - 06:25 : Anonymous Won't the way the upgrade numbers don't match up between 4.6 and HEAD eventually cause problems for 4.6 users that upgrade to 4.7? ------------------------------------------------------------------------ April 12, 2005 - 07:20 : Dries Where the access checks for the blocks required?

1 0

[drupal-devel] [bug] Missing <div> container on HTML output
by stefan nagtegaal 12 Apr '05

12 Apr '05

Issue status update for http://drupal.org/node/20079 Project: Drupal Version: cvs Component: book.module Category: bug reports Priority: minor Assigned to: Anonymous Reported by: budda Updated by: stefan nagtegaal Status: patch Why don't we remove the menu-<div>?? We can style it using .block-user etc, right? Stefan. stefan nagtegaal Previous comments: ------------------------------------------------------------------------ April 6, 2005 - 19:46 : budda Line 588 should be made to output the tree navigation within a container the same as the core navigation block - to keep consistent. new line 588: return '<div class="menu"><ul>'. $tree .'</ul></div>'; You are still able to format the book tree navigation different to the core navigation block as this tree is a child of css class 'book-block'. ------------------------------------------------------------------------ April 6, 2005 - 19:48 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/book_28.patch (558 bytes) Here's the patch. ------------------------------------------------------------------------ April 6, 2005 - 21:34 : Dries Where does Drupal core emit a class="menu" ? ------------------------------------------------------------------------ April 6, 2005 - 21:43 : jhriggs Line 89 of menu.module in menu_block(): $data['content'] = '<div class="menu">'. theme('menu_tree', $delta) .'</div>' ; Should the change maybe be made to theme_menu_tree() instead to take care of all of them at once? And if so, should the class be called "tree" rather than "menu"? ------------------------------------------------------------------------ April 7, 2005 - 11:26 : budda Class "tree" would be good. But would this change break any existing themes? Also - the tree menu is used within the book pages at the footer to show nested pages - so would you want that to be within the same class?

4 3

[drupal-devel] [bug] User info should not be visible without permission
by Dries 12 Apr '05

12 Apr '05

Issue status update for http://drupal.org/node/4166 Project: Drupal Version: cvs Component: user system Category: bug reports Priority: normal Assigned to: killes(a)www.drop.org Reported by: mic Updated by: Dries Status: patch Where the access checks for the blocks required? Dries Previous comments: ------------------------------------------------------------------------ November 17, 2003 - 07:23 : mic When anonymous visitors do not have "Access userlist" permission, they can still view all the public info in user profiles. Drupal sites that are created for a group of friends or for an organization want to protect their e-mail addresses, telephone numbers and so on, while making these accessible to fellow members. This could be a critical feature request, but since I think it's an error, I'm sending you this as bug. (I don't have CVS, so I'm hoping someone else will make the simple correction needed to the user module) ------------------------------------------------------------------------ February 3, 2004 - 06:41 : daBrado Attachment: http://drupal.org/files/issues/user-module-add-view-permission.patch (1.54 KB) I made a patch that fixed this by adding a new permission, "access users". This is everything this patch does: Add new permission, "access users" If a user does not have the "access users" permission, s/he cannot read another user's profile at all, and instead gets an "access denied" page. I hope I did this in the proper way. ------------------------------------------------------------------------ April 21, 2004 - 21:25 : Dries I think we should not introduce a new permission but merge with the existing 'access user list' permission (or rename it to 'access users'). Marking this "won't fix" until the patch has been udpated. ------------------------------------------------------------------------ May 28, 2004 - 03:26 : daBrado Attachment: http://drupal.org/files/issues/user-module-add-view-permission_0.patch (1.88 KB) Another patch, this time renaming the permission "access user list" to "access users", and adding a check in the user viewing function to only allow users with this permission to view the user information. ------------------------------------------------------------------------ July 5, 2004 - 16:31 : Anonymous Attachment: http://drupal.org/files/issues/user-module-add-view-permission_1.patch (1.86 KB) Here is a patch again, now for CVS. Does the same thing as above. It is a very simple patch. If it seems proper, I hope that can be included before it goes stale. ------------------------------------------------------------------------ July 9, 2004 - 03:08 : daBrado Attachment: http://drupal.org/files/issues/user-module-add-view-permission_2.patch (1.33 KB) The previous patch was accepted, but then for some reason reversed as part of another CVS commit. So, here is a new patch that brings back the "access users" permission. It controls whether or not a user may view other users info. ------------------------------------------------------------------------ September 22, 2004 - 17:53 : Bèr Kessels Attachment: http://drupal.org/files/issues/access_users_perm.patch (6.46 KB) A new and revised patch. It adds an "access users" permission ------------------------------------------------------------------------ September 22, 2004 - 19:02 : killes(a)www.drop.org I'd like to see this patch applied to cvs before the 4.5 release. Now that we can protect our nodes from unauthorized access it just makes sense to protect our user data as well. In the future I'd like to see scheme where the user (as in end-user) is able to selet which of his data gets published. ------------------------------------------------------------------------ September 23, 2004 - 02:52 : rkendall I would like this too ------------------------------------------------------------------------ October 15, 2004 - 00:46 : drumm Can the name be changed to 'view user profiles'? ------------------------------------------------------------------------ October 18, 2004 - 10:19 : Bèr Kessels It can, but I used "access" for consistancy. we have "access newsfeeds", "access comments", "access etc". This patch is critical for corporate sites btw. A corporate site that has its customers information lying on the streets (so to say) is not-done. Ber ------------------------------------------------------------------------ November 27, 2004 - 14:49 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user-access.patch (5.96 KB) Updated for CVS. I assumed that "admin users" implies "access users" in user_admin. ------------------------------------------------------------------------ March 1, 2005 - 18:30 : killes(a)www.drop.org Does not apply anymore, Ber can you have a look at it? ------------------------------------------------------------------------ March 7, 2005 - 10:19 : Bèr Kessels Attachment: http://drupal.org/files/issues/user_access_0.patch (9.74 KB) New patch. Should apply to HEAD. ------------------------------------------------------------------------ April 7, 2005 - 22:29 : killes(a)www.drop.org It's a patch (which still applies and wants into core). ------------------------------------------------------------------------ April 8, 2005 - 19:10 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user_access_bug_1.patch (11.45 KB) Ok, updated patch. Includes changes to format_name to only display unlinked username for non-privileddged users. 'acccess users' is now 'access user profiles'. The search users tab won't get displayed either if you are not allowed to seee user profiles. The patch got even tested. ------------------------------------------------------------------------ April 8, 2005 - 19:19 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user_access_bug_2.patch (11.26 KB) Further testing revealed a bug in the older parts of the patch... ------------------------------------------------------------------------ April 8, 2005 - 21:02 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user_access_bug_3.patch (11.35 KB) Another iteration: Users should alwys be allowed to see their own user page. ------------------------------------------------------------------------ April 12, 2005 - 00:49 : Steven Committed to 4.6/HEAD. ------------------------------------------------------------------------ April 12, 2005 - 01:04 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user-db.patch (2.56 KB) We found that users should not wonder why they cannot see other users' pages anymore. DB update required. Patch for HEAD attached, 4.6 to follow. ------------------------------------------------------------------------ April 12, 2005 - 01:11 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user-db_0.patch (2.45 KB) ------------------------------------------------------------------------ April 12, 2005 - 06:25 : Anonymous Won't the way the upgrade numbers don't match up between 4.6 and HEAD eventually cause problems for 4.6 users that upgrade to 4.7?

1 0

[drupal-devel] [bug] User info should not be visible without permission
by Anonymous 12 Apr '05

12 Apr '05

Issue status update for http://drupal.org/node/4166 Project: Drupal Version: cvs Component: user system Category: bug reports Priority: normal Assigned to: killes(a)www.drop.org Reported by: mic Updated by: Anonymous Status: patch Won't the way the upgrade numbers don't match up between 4.6 and HEAD eventually cause problems for 4.6 users that upgrade to 4.7? Anonymous Previous comments: ------------------------------------------------------------------------ November 17, 2003 - 05:23 : mic When anonymous visitors do not have "Access userlist" permission, they can still view all the public info in user profiles. Drupal sites that are created for a group of friends or for an organization want to protect their e-mail addresses, telephone numbers and so on, while making these accessible to fellow members. This could be a critical feature request, but since I think it's an error, I'm sending you this as bug. (I don't have CVS, so I'm hoping someone else will make the simple correction needed to the user module) ------------------------------------------------------------------------ February 3, 2004 - 04:41 : daBrado Attachment: http://drupal.org/files/issues/user-module-add-view-permission.patch (1.54 KB) I made a patch that fixed this by adding a new permission, "access users". This is everything this patch does: Add new permission, "access users" If a user does not have the "access users" permission, s/he cannot read another user's profile at all, and instead gets an "access denied" page. I hope I did this in the proper way. ------------------------------------------------------------------------ April 21, 2004 - 19:25 : Dries I think we should not introduce a new permission but merge with the existing 'access user list' permission (or rename it to 'access users'). Marking this "won't fix" until the patch has been udpated. ------------------------------------------------------------------------ May 28, 2004 - 01:26 : daBrado Attachment: http://drupal.org/files/issues/user-module-add-view-permission_0.patch (1.88 KB) Another patch, this time renaming the permission "access user list" to "access users", and adding a check in the user viewing function to only allow users with this permission to view the user information. ------------------------------------------------------------------------ July 5, 2004 - 14:31 : Anonymous Attachment: http://drupal.org/files/issues/user-module-add-view-permission_1.patch (1.86 KB) Here is a patch again, now for CVS. Does the same thing as above. It is a very simple patch. If it seems proper, I hope that can be included before it goes stale. ------------------------------------------------------------------------ July 9, 2004 - 01:08 : daBrado Attachment: http://drupal.org/files/issues/user-module-add-view-permission_2.patch (1.33 KB) The previous patch was accepted, but then for some reason reversed as part of another CVS commit. So, here is a new patch that brings back the "access users" permission. It controls whether or not a user may view other users info. ------------------------------------------------------------------------ September 22, 2004 - 15:53 : Bèr Kessels Attachment: http://drupal.org/files/issues/access_users_perm.patch (6.46 KB) A new and revised patch. It adds an "access users" permission ------------------------------------------------------------------------ September 22, 2004 - 17:02 : killes(a)www.drop.org I'd like to see this patch applied to cvs before the 4.5 release. Now that we can protect our nodes from unauthorized access it just makes sense to protect our user data as well. In the future I'd like to see scheme where the user (as in end-user) is able to selet which of his data gets published. ------------------------------------------------------------------------ September 23, 2004 - 00:52 : rkendall I would like this too ------------------------------------------------------------------------ October 14, 2004 - 22:46 : drumm Can the name be changed to 'view user profiles'? ------------------------------------------------------------------------ October 18, 2004 - 08:19 : Bèr Kessels It can, but I used "access" for consistancy. we have "access newsfeeds", "access comments", "access etc". This patch is critical for corporate sites btw. A corporate site that has its customers information lying on the streets (so to say) is not-done. Ber ------------------------------------------------------------------------ November 27, 2004 - 12:49 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user-access.patch (5.96 KB) Updated for CVS. I assumed that "admin users" implies "access users" in user_admin. ------------------------------------------------------------------------ March 1, 2005 - 16:30 : killes(a)www.drop.org Does not apply anymore, Ber can you have a look at it? ------------------------------------------------------------------------ March 7, 2005 - 08:19 : Bèr Kessels Attachment: http://drupal.org/files/issues/user_access_0.patch (9.74 KB) New patch. Should apply to HEAD. ------------------------------------------------------------------------ April 7, 2005 - 20:29 : killes(a)www.drop.org It's a patch (which still applies and wants into core). ------------------------------------------------------------------------ April 8, 2005 - 17:10 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user_access_bug_1.patch (11.45 KB) Ok, updated patch. Includes changes to format_name to only display unlinked username for non-privileddged users. 'acccess users' is now 'access user profiles'. The search users tab won't get displayed either if you are not allowed to seee user profiles. The patch got even tested. ------------------------------------------------------------------------ April 8, 2005 - 17:19 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user_access_bug_2.patch (11.26 KB) Further testing revealed a bug in the older parts of the patch... ------------------------------------------------------------------------ April 8, 2005 - 19:02 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user_access_bug_3.patch (11.35 KB) Another iteration: Users should alwys be allowed to see their own user page. ------------------------------------------------------------------------ April 11, 2005 - 22:49 : Steven Committed to 4.6/HEAD. ------------------------------------------------------------------------ April 11, 2005 - 23:04 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user-db.patch (2.56 KB) We found that users should not wonder why they cannot see other users' pages anymore. DB update required. Patch for HEAD attached, 4.6 to follow. ------------------------------------------------------------------------ April 11, 2005 - 23:11 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user-db_0.patch (2.45 KB)

1 0

[drupal-devel] [bug] drop.org is down
by killes 12 Apr '05

12 Apr '05

Issue status update for http://drupal.org/node/20349 Project: Drupal Version: cvs Component: user.module Category: bug reports Priority: normal Assigned to: Anonymous Reported by: killes(a)www.drop.org Updated by: killes(a)www.drop.org Status: patch Attachment: http://drupal.org/files/issues/user-drop.org-is-down.patch (3.06 KB) drop.org is down and I don't think it will get much attention soon. I've replaced drop.org by drupal.org in the mailed messages. killes(a)www.drop.org

1 0