- Development - lists.drupal.org

[drupal-devel] [bug] form_checkboxes saves "no selection" as string
by chx 12 Apr '05

12 Apr '05

Issue status update for http://drupal.org/node/18663 Project: Drupal Version: cvs Component: base system Category: bug reports Priority: critical Assigned to: chx Reported by: killes(a)www.drop.org Updated by: chx Status: patch Attachment: http://drupal.org/files/issues/form_checkboxes_4.patch (2.06 KB) Previous patch had index.php missing. jhriggs, the current problem is that a form_checkboxes expected to be an array. Currently, empty form_checkboxes is a string. That's bad. chx Previous comments: ------------------------------------------------------------------------ March 10, 2005 - 02:51 : killes(a)www.drop.org If you select nothing from a set of checkboxes an empty string is save to the variables table. This is a problem if the calling code assumes, it would get an array. We should make it save an empty array. The problem is the form_hidden field that we add. even if we replace form_hidden($name, 0) by form_hidden($name, array()) it isn't going to work, because the empty array is eaten by htmlspecialchars. redLED found this bug and he does not like it: 02:53 < redLED> i just like things saying 'CRITICAL' in red 02:53 < redLED> it gives this warm impending doom feeling 02:53 < redLED> and is generally associated with nuclear reactors in people's subconsciousness Suggestions welcome. ------------------------------------------------------------------------ March 12, 2005 - 19:47 : Steven There is no way to fix it in form_checkboxes() itself afaik, because even without htmlspecialchars, it would still come out as "Array". You can only create arrays indirectly through form submissions, by naming your values "foo[]". But you can not create empty arrays this way. So it is really up to the module which uses form_checkboxes() to handle this. A simple is_array() should do the trick. ------------------------------------------------------------------------ March 28, 2005 - 17:27 : chx Attachment: http://drupal.org/files/issues/checkboxes.patch (1.71 KB) system_settings_save can not really cope with this situation. This makes a problem with empty node options. And the fact that we have a check everywhere we use form_checkboxes is error prone, too. Here is a patch. If this accepted I'll comb the core for dead code. For eg. the first three lines of taxonomy_save_vocabulary and so. ------------------------------------------------------------------------ March 28, 2005 - 17:32 : chx Attachment: http://drupal.org/files/issues/checkboxes_0.patch (1.71 KB) Oh NO! One strayed space! I fixed it before steven beheads me.... ------------------------------------------------------------------------ March 28, 2005 - 18:36 : chx Attachment: http://drupal.org/files/issues/checkboxes_1.patch (1.64 KB) Among other changes, I have moved the hidden field form_checkboxes[] out of $edit. I have included HTML code, yes, but this is a very special thing, so it does not merit changing form_input just 'cos of this. And you won't need to theme a hidden field... ------------------------------------------------------------------------ April 8, 2005 - 08:19 : chx Attachment: http://drupal.org/files/issues/form_checkboxes_2.patch (1.9 KB) killes did not like the previous version. ------------------------------------------------------------------------ April 12, 2005 - 00:15 : chx Dries? ------------------------------------------------------------------------ April 12, 2005 - 20:15 : chx Attachment: http://drupal.org/files/issues/form_checkboxes_3.patch (1.64 KB) ------------------------------------------------------------------------ April 12, 2005 - 20:39 : jhriggs I have to agree with Steven that it is up to the calling code...and I hardly think this is critical. Code that is expecting an array from form_checkboxes() should ensure that it is dealing with an array (i.e. is_array()). As for dealing with variables set through things like system_settings_save(), the same thing applies. The code that is retrieving the variable should ensure that it is working with an array. With regards to your patch, what's the difference if the calling code has to remember to check via is_array() or remember to call fix_checkboxes()? This method is no less error prone as it's just as easy to forget this call as it is to check for an array. That is unless you are suggesting that fix_checkboxes() gets called for every page load which seems rather crufty. I wrote the original patch to add form_checkboxes() -- which didn't exist -- and if I remember, this was the desired behavior if nothing was selected. Isn't this the same behavior one would see using a multiple form_select() if the user chooses nothing? They should behave the same. A single select widget is the same as a radio group, and a multiple select widget is the same as a group of checkboxes. They should behave the same; the select types just take up less realestate.

1 0

[drupal-devel] [bug] Incorrect variable when reporting successful e-mail password sent
by Junyor 12 Apr '05

12 Apr '05

Issue status update for http://drupal.org/node/20396 Project: Drupal Version: cvs Component: user.module Category: bug reports Priority: normal Assigned to: Junyor Reported by: Junyor Updated by: Junyor Status: patch Attachment: http://drupal.org/files/issues/user_18.patch (873 bytes) When user.module reports that a password has been successfully sent to the user in the admin log, the information is incorrect. The bug is in 4.6 and CVS. The attached patch applies to both. Junyor

1 0

[drupal-devel] [bug] Cannot delete users
by Dries 12 Apr '05

12 Apr '05

Issue status update for http://drupal.org/node/19750 Project: Drupal Version: cvs Component: user.module Category: bug reports Priority: critical Assigned to: Anonymous Reported by: AtomicMaestro Updated by: Dries Status: patch Last patch committed to DRUPAL-4-6. Still waiting for a better fix for HEAD. Dries Previous comments: ------------------------------------------------------------------------ March 31, 2005 - 11:33 : AtomicMaestro I can't seem to delete users. To reproduce: 1. Create a user. 2. View the user created in 1. 3. Click Delete I would expect to be told I have to block the user first, but instead, I'm sent back to the user report. There's no message, nothing in the log. ------------------------------------------------------------------------ April 1, 2005 - 09:40 : asimmonds Attachment: http://drupal.org/files/issues/fix_delete_user.patch (581 bytes) Patch attached to fix this, the delete code in node.module works the same way ------------------------------------------------------------------------ April 3, 2005 - 16:15 : moshe weitzman when one deletes a user from list of users in admin, he expects to return back to that list after successfully deleting. thats the intent of the $_REQUEST['destination']. I think this patch will defeat that behavior. There certainly is a bug here, but I don't think we have found the right fix yet. I suggest testing a delete from both admin and user/edit pages. make sure you arrive at the expected page after a successful delete. ------------------------------------------------------------------------ April 4, 2005 - 09:19 : asimmonds There are two methods to enter the user edit page as a admin: 1/ View a user, then select the edit tab. 2/ Click 'edit' for the user in the admin/user list. The 2nd method sets destination=admin/user in the URL, when the user edit page is shown. If the Delete button is clicked, it calls drupal_goto("user/$account->uid/delete") (the code's comment mentions this is done to make the tabs disappear). As destination is already set, drupal_goto() redirects to that ie. "admin/user" instead of "user/$account->uid/delete" If after successfully deleting a user, the code calls drupal_goto("admin/user"). I looked at how node.module does the node delete/confirm sequence and it has this unset($_REQUEST['destination']) in there as well. Maybe this delete/confirm sequence pattern needs a re-think for 4.7 ------------------------------------------------------------------------ April 6, 2005 - 06:01 : moshe weitzman Attachment: http://drupal.org/files/issues/user_15.patch (1020 bytes) here is an alternative. this one properly maintains the destination parameter which is useful especially when you are not on the 1st page of your user listing. the redirect insures that you return to the page you were on. another advantage is that i was able to delete a few lines of code which were performing a drupal_goto(). the downside is that the pupose of the drupal_goto() was to get rid of the tabs. I don't mind the tabs on the delete confirm page, so I think my patch is better, and removes a couple lines of code. either patch presented here would work ok. ------------------------------------------------------------------------ April 6, 2005 - 07:13 : moshe weitzman Attachment: http://drupal.org/files/issues/menu_set_location.patch (2.23 KB) here is a different patch suggested by UnConed. Uses menu_set_location() to remove the tabs on the delete confirmation page for both nodes and users. ------------------------------------------------------------------------ April 6, 2005 - 21:28 : Dries Mmm, Steven's patch fixes the tabs but still is a bit of a hack. (Also, parts of the strings can't be translated, the use of arg(1) vs $edit['nid'] looks a bit weird.) Can't we fix this properly? ------------------------------------------------------------------------ April 8, 2005 - 14:50 : Dries Could this be fixed properly by making a stand-alone callback for the delete view?

1 0

[drupal-devel] [bug] form_checkboxes saves "no selection" as string
by jhriggs 12 Apr '05

12 Apr '05

Issue status update for http://drupal.org/node/18663 Project: Drupal Version: cvs Component: base system Category: bug reports Priority: critical Assigned to: chx Reported by: killes(a)www.drop.org Updated by: jhriggs Status: patch I have to agree with Steven that it is up to the calling code...and I hardly think this is critical. Code that is expecting an array from form_checkboxes() should ensure that it is dealing with an array (i.e. is_array()). As for dealing with variables set through things like system_settings_save(), the same thing applies. The code that is retrieving the variable should ensure that it is working with an array. With regards to your patch, what's the difference if the calling code has to remember to check via is_array() or remember to call fix_checkboxes()? This method is no less error prone as it's just as easy to forget this call as it is to check for an array. That is unless you are suggesting that fix_checkboxes() gets called for every page load which seems rather crufty. I wrote the original patch to add form_checkboxes() -- which didn't exist -- and if I remember, this was the desired behavior if nothing was selected. Isn't this the same behavior one would see using a multiple form_select() if the user chooses nothing? They should behave the same. A single select widget is the same as a radio group, and a multiple select widget is the same as a group of checkboxes. They should behave the same; the select types just take up less realestate. jhriggs Previous comments: ------------------------------------------------------------------------ March 9, 2005 - 19:51 : killes(a)www.drop.org If you select nothing from a set of checkboxes an empty string is save to the variables table. This is a problem if the calling code assumes, it would get an array. We should make it save an empty array. The problem is the form_hidden field that we add. even if we replace form_hidden($name, 0) by form_hidden($name, array()) it isn't going to work, because the empty array is eaten by htmlspecialchars. redLED found this bug and he does not like it: 02:53 < redLED> i just like things saying 'CRITICAL' in red 02:53 < redLED> it gives this warm impending doom feeling 02:53 < redLED> and is generally associated with nuclear reactors in people's subconsciousness Suggestions welcome. ------------------------------------------------------------------------ March 12, 2005 - 12:47 : Steven There is no way to fix it in form_checkboxes() itself afaik, because even without htmlspecialchars, it would still come out as "Array". You can only create arrays indirectly through form submissions, by naming your values "foo[]". But you can not create empty arrays this way. So it is really up to the module which uses form_checkboxes() to handle this. A simple is_array() should do the trick. ------------------------------------------------------------------------ March 28, 2005 - 10:27 : chx Attachment: http://drupal.org/files/issues/checkboxes.patch (1.71 KB) system_settings_save can not really cope with this situation. This makes a problem with empty node options. And the fact that we have a check everywhere we use form_checkboxes is error prone, too. Here is a patch. If this accepted I'll comb the core for dead code. For eg. the first three lines of taxonomy_save_vocabulary and so. ------------------------------------------------------------------------ March 28, 2005 - 10:32 : chx Attachment: http://drupal.org/files/issues/checkboxes_0.patch (1.71 KB) Oh NO! One strayed space! I fixed it before steven beheads me.... ------------------------------------------------------------------------ March 28, 2005 - 11:36 : chx Attachment: http://drupal.org/files/issues/checkboxes_1.patch (1.64 KB) Among other changes, I have moved the hidden field form_checkboxes[] out of $edit. I have included HTML code, yes, but this is a very special thing, so it does not merit changing form_input just 'cos of this. And you won't need to theme a hidden field... ------------------------------------------------------------------------ April 8, 2005 - 01:19 : chx Attachment: http://drupal.org/files/issues/form_checkboxes_2.patch (1.9 KB) killes did not like the previous version. ------------------------------------------------------------------------ April 11, 2005 - 17:15 : chx Dries? ------------------------------------------------------------------------ April 12, 2005 - 13:15 : chx Attachment: http://drupal.org/files/issues/form_checkboxes_3.patch (1.64 KB)

1 0

[drupal-devel] [bug] User info should not be visible without permission
by killes 12 Apr '05

12 Apr '05

Issue status update for http://drupal.org/node/4166 Project: Drupal Version: cvs Component: user system Category: bug reports -Priority: critical +Priority: normal Assigned to: killes(a)www.drop.org Reported by: mic Updated by: killes(a)www.drop.org -Status: fixed +Status: patch the database updates weren't applied yet. killes(a)www.drop.org Previous comments: ------------------------------------------------------------------------ November 17, 2003 - 06:23 : mic When anonymous visitors do not have "Access userlist" permission, they can still view all the public info in user profiles. Drupal sites that are created for a group of friends or for an organization want to protect their e-mail addresses, telephone numbers and so on, while making these accessible to fellow members. This could be a critical feature request, but since I think it's an error, I'm sending you this as bug. (I don't have CVS, so I'm hoping someone else will make the simple correction needed to the user module) ------------------------------------------------------------------------ February 3, 2004 - 05:41 : daBrado Attachment: http://drupal.org/files/issues/user-module-add-view-permission.patch (1.54 KB) I made a patch that fixed this by adding a new permission, "access users". This is everything this patch does: Add new permission, "access users" If a user does not have the "access users" permission, s/he cannot read another user's profile at all, and instead gets an "access denied" page. I hope I did this in the proper way. ------------------------------------------------------------------------ April 21, 2004 - 20:25 : Dries I think we should not introduce a new permission but merge with the existing 'access user list' permission (or rename it to 'access users'). Marking this "won't fix" until the patch has been udpated. ------------------------------------------------------------------------ May 28, 2004 - 02:26 : daBrado Attachment: http://drupal.org/files/issues/user-module-add-view-permission_0.patch (1.88 KB) Another patch, this time renaming the permission "access user list" to "access users", and adding a check in the user viewing function to only allow users with this permission to view the user information. ------------------------------------------------------------------------ July 5, 2004 - 15:31 : Anonymous Attachment: http://drupal.org/files/issues/user-module-add-view-permission_1.patch (1.86 KB) Here is a patch again, now for CVS. Does the same thing as above. It is a very simple patch. If it seems proper, I hope that can be included before it goes stale. ------------------------------------------------------------------------ July 9, 2004 - 02:08 : daBrado Attachment: http://drupal.org/files/issues/user-module-add-view-permission_2.patch (1.33 KB) The previous patch was accepted, but then for some reason reversed as part of another CVS commit. So, here is a new patch that brings back the "access users" permission. It controls whether or not a user may view other users info. ------------------------------------------------------------------------ September 22, 2004 - 16:53 : Bèr Kessels Attachment: http://drupal.org/files/issues/access_users_perm.patch (6.46 KB) A new and revised patch. It adds an "access users" permission ------------------------------------------------------------------------ September 22, 2004 - 18:02 : killes(a)www.drop.org I'd like to see this patch applied to cvs before the 4.5 release. Now that we can protect our nodes from unauthorized access it just makes sense to protect our user data as well. In the future I'd like to see scheme where the user (as in end-user) is able to selet which of his data gets published. ------------------------------------------------------------------------ September 23, 2004 - 01:52 : rkendall I would like this too ------------------------------------------------------------------------ October 14, 2004 - 23:46 : drumm Can the name be changed to 'view user profiles'? ------------------------------------------------------------------------ October 18, 2004 - 09:19 : Bèr Kessels It can, but I used "access" for consistancy. we have "access newsfeeds", "access comments", "access etc". This patch is critical for corporate sites btw. A corporate site that has its customers information lying on the streets (so to say) is not-done. Ber ------------------------------------------------------------------------ November 27, 2004 - 13:49 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user-access.patch (5.96 KB) Updated for CVS. I assumed that "admin users" implies "access users" in user_admin. ------------------------------------------------------------------------ March 1, 2005 - 17:30 : killes(a)www.drop.org Does not apply anymore, Ber can you have a look at it? ------------------------------------------------------------------------ March 7, 2005 - 09:19 : Bèr Kessels Attachment: http://drupal.org/files/issues/user_access_0.patch (9.74 KB) New patch. Should apply to HEAD. ------------------------------------------------------------------------ April 7, 2005 - 21:29 : killes(a)www.drop.org It's a patch (which still applies and wants into core). ------------------------------------------------------------------------ April 8, 2005 - 18:10 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user_access_bug_1.patch (11.45 KB) Ok, updated patch. Includes changes to format_name to only display unlinked username for non-privileddged users. 'acccess users' is now 'access user profiles'. The search users tab won't get displayed either if you are not allowed to seee user profiles. The patch got even tested. ------------------------------------------------------------------------ April 8, 2005 - 18:19 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user_access_bug_2.patch (11.26 KB) Further testing revealed a bug in the older parts of the patch... ------------------------------------------------------------------------ April 8, 2005 - 20:02 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user_access_bug_3.patch (11.35 KB) Another iteration: Users should alwys be allowed to see their own user page. ------------------------------------------------------------------------ April 11, 2005 - 23:49 : Steven Committed to 4.6/HEAD. ------------------------------------------------------------------------ April 12, 2005 - 00:04 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user-db.patch (2.56 KB) We found that users should not wonder why they cannot see other users' pages anymore. DB update required. Patch for HEAD attached, 4.6 to follow. ------------------------------------------------------------------------ April 12, 2005 - 00:11 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user-db_0.patch (2.45 KB) ------------------------------------------------------------------------ April 12, 2005 - 05:25 : Anonymous Won't the way the upgrade numbers don't match up between 4.6 and HEAD eventually cause problems for 4.6 users that upgrade to 4.7? ------------------------------------------------------------------------ April 12, 2005 - 06:20 : Dries Where the access checks for the blocks required? ------------------------------------------------------------------------ April 12, 2005 - 15:02 : Dries Also, people can't update their own profile information with this patch. Marking this critical. ------------------------------------------------------------------------ April 12, 2005 - 15:53 : Anonymous Attachment: http://drupal.org/files/issues/user_16.patch (706 bytes) Sorry, here's a patch. ------------------------------------------------------------------------ April 12, 2005 - 16:05 : Anonymous Attachment: http://drupal.org/files/issues/user_17.patch (1.11 KB) The previous patch was for the "can't edit profile pages" problem. This patch here removes the access checks for the blocks. I'd leave them in, but have no strong feelings about either way. ------------------------------------------------------------------------ April 12, 2005 - 19:32 : Dries Committed to HEAD.

1 0

[drupal-devel] [bug] form_checkboxes saves "no selection" as string
by chx 12 Apr '05

12 Apr '05

Issue status update for http://drupal.org/node/18663 Project: Drupal Version: cvs Component: base system Category: bug reports Priority: critical Assigned to: chx Reported by: killes(a)www.drop.org Updated by: chx Status: patch Attachment: http://drupal.org/files/issues/form_checkboxes_3.patch (1.64 KB) chx Previous comments: ------------------------------------------------------------------------ March 10, 2005 - 02:51 : killes(a)www.drop.org If you select nothing from a set of checkboxes an empty string is save to the variables table. This is a problem if the calling code assumes, it would get an array. We should make it save an empty array. The problem is the form_hidden field that we add. even if we replace form_hidden($name, 0) by form_hidden($name, array()) it isn't going to work, because the empty array is eaten by htmlspecialchars. redLED found this bug and he does not like it: 02:53 < redLED> i just like things saying 'CRITICAL' in red 02:53 < redLED> it gives this warm impending doom feeling 02:53 < redLED> and is generally associated with nuclear reactors in people's subconsciousness Suggestions welcome. ------------------------------------------------------------------------ March 12, 2005 - 19:47 : Steven There is no way to fix it in form_checkboxes() itself afaik, because even without htmlspecialchars, it would still come out as "Array". You can only create arrays indirectly through form submissions, by naming your values "foo[]". But you can not create empty arrays this way. So it is really up to the module which uses form_checkboxes() to handle this. A simple is_array() should do the trick. ------------------------------------------------------------------------ March 28, 2005 - 17:27 : chx Attachment: http://drupal.org/files/issues/checkboxes.patch (1.71 KB) system_settings_save can not really cope with this situation. This makes a problem with empty node options. And the fact that we have a check everywhere we use form_checkboxes is error prone, too. Here is a patch. If this accepted I'll comb the core for dead code. For eg. the first three lines of taxonomy_save_vocabulary and so. ------------------------------------------------------------------------ March 28, 2005 - 17:32 : chx Attachment: http://drupal.org/files/issues/checkboxes_0.patch (1.71 KB) Oh NO! One strayed space! I fixed it before steven beheads me.... ------------------------------------------------------------------------ March 28, 2005 - 18:36 : chx Attachment: http://drupal.org/files/issues/checkboxes_1.patch (1.64 KB) Among other changes, I have moved the hidden field form_checkboxes[] out of $edit. I have included HTML code, yes, but this is a very special thing, so it does not merit changing form_input just 'cos of this. And you won't need to theme a hidden field... ------------------------------------------------------------------------ April 8, 2005 - 08:19 : chx Attachment: http://drupal.org/files/issues/form_checkboxes_2.patch (1.9 KB) killes did not like the previous version. ------------------------------------------------------------------------ April 12, 2005 - 00:15 : chx Dries?

1 0

[drupal-devel] [bug] Error when deleting containers and forums
by chx 12 Apr '05

12 Apr '05

Issue status update for http://drupal.org/node/20284 Project: Drupal Version: cvs Component: forum.module Category: bug reports Priority: critical -Assigned to: Anonymous +Assigned to: chx Reported by: Donovan Updated by: chx -Status: active +Status: patch Attachment: http://drupal.org/files/issues/forum_12.patch (786 bytes) I won't comment this patch. chx Previous comments: ------------------------------------------------------------------------ April 10, 2005 - 23:51 : Donovan I receive the following error when deleting containers and forums: user error: Table 'db12345678.forum' doesn't exist query: SELECT f.nid FROM forum f WHERE f.tid = 37 in /.../includes/database.mysql.inc on line 66. user error: Table 'db12345678.forum' doesn't exist query: SELECT f.nid FROM forum f WHERE f.tid = 38 in /.../includes/database.mysql.inc on line 66. warning: Cannot modify header information - headers already sent by (output started at /.../includes/common.inc:384) in /.../includes/common.inc on line 192. I am running the latest CVS versions of Drupal and all modules including forum module. My config is using a database prefix so I believe the code is not appending the db prefix.

1 0

[drupal-devel] Status of Sections
by Dan Robinson 12 Apr '05

12 Apr '05

Folks, Is anyone planning to continue work on "Sections"? How much work is there to upgrade it to 4.6? Thanks, Dan

3 3

[drupal-devel] [bug] User info should not be visible without permission
by Anonymous 12 Apr '05

12 Apr '05

Issue status update for http://drupal.org/node/4166 Project: Drupal Version: cvs Component: user system Category: bug reports Priority: critical Assigned to: killes(a)www.drop.org Reported by: mic Updated by: Anonymous Status: patch Attachment: http://drupal.org/files/issues/user_17.patch (1.11 KB) The previous patch was for the "can't edit profile pages" problem. This patch here removes the access checks for the blocks. I'd leave them in, but have no strong feelings about either way. Anonymous Previous comments: ------------------------------------------------------------------------ November 17, 2003 - 05:23 : mic When anonymous visitors do not have "Access userlist" permission, they can still view all the public info in user profiles. Drupal sites that are created for a group of friends or for an organization want to protect their e-mail addresses, telephone numbers and so on, while making these accessible to fellow members. This could be a critical feature request, but since I think it's an error, I'm sending you this as bug. (I don't have CVS, so I'm hoping someone else will make the simple correction needed to the user module) ------------------------------------------------------------------------ February 3, 2004 - 04:41 : daBrado Attachment: http://drupal.org/files/issues/user-module-add-view-permission.patch (1.54 KB) I made a patch that fixed this by adding a new permission, "access users". This is everything this patch does: Add new permission, "access users" If a user does not have the "access users" permission, s/he cannot read another user's profile at all, and instead gets an "access denied" page. I hope I did this in the proper way. ------------------------------------------------------------------------ April 21, 2004 - 19:25 : Dries I think we should not introduce a new permission but merge with the existing 'access user list' permission (or rename it to 'access users'). Marking this "won't fix" until the patch has been udpated. ------------------------------------------------------------------------ May 28, 2004 - 01:26 : daBrado Attachment: http://drupal.org/files/issues/user-module-add-view-permission_0.patch (1.88 KB) Another patch, this time renaming the permission "access user list" to "access users", and adding a check in the user viewing function to only allow users with this permission to view the user information. ------------------------------------------------------------------------ July 5, 2004 - 14:31 : Anonymous Attachment: http://drupal.org/files/issues/user-module-add-view-permission_1.patch (1.86 KB) Here is a patch again, now for CVS. Does the same thing as above. It is a very simple patch. If it seems proper, I hope that can be included before it goes stale. ------------------------------------------------------------------------ July 9, 2004 - 01:08 : daBrado Attachment: http://drupal.org/files/issues/user-module-add-view-permission_2.patch (1.33 KB) The previous patch was accepted, but then for some reason reversed as part of another CVS commit. So, here is a new patch that brings back the "access users" permission. It controls whether or not a user may view other users info. ------------------------------------------------------------------------ September 22, 2004 - 15:53 : Bèr Kessels Attachment: http://drupal.org/files/issues/access_users_perm.patch (6.46 KB) A new and revised patch. It adds an "access users" permission ------------------------------------------------------------------------ September 22, 2004 - 17:02 : killes(a)www.drop.org I'd like to see this patch applied to cvs before the 4.5 release. Now that we can protect our nodes from unauthorized access it just makes sense to protect our user data as well. In the future I'd like to see scheme where the user (as in end-user) is able to selet which of his data gets published. ------------------------------------------------------------------------ September 23, 2004 - 00:52 : rkendall I would like this too ------------------------------------------------------------------------ October 14, 2004 - 22:46 : drumm Can the name be changed to 'view user profiles'? ------------------------------------------------------------------------ October 18, 2004 - 08:19 : Bèr Kessels It can, but I used "access" for consistancy. we have "access newsfeeds", "access comments", "access etc". This patch is critical for corporate sites btw. A corporate site that has its customers information lying on the streets (so to say) is not-done. Ber ------------------------------------------------------------------------ November 27, 2004 - 12:49 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user-access.patch (5.96 KB) Updated for CVS. I assumed that "admin users" implies "access users" in user_admin. ------------------------------------------------------------------------ March 1, 2005 - 16:30 : killes(a)www.drop.org Does not apply anymore, Ber can you have a look at it? ------------------------------------------------------------------------ March 7, 2005 - 08:19 : Bèr Kessels Attachment: http://drupal.org/files/issues/user_access_0.patch (9.74 KB) New patch. Should apply to HEAD. ------------------------------------------------------------------------ April 7, 2005 - 20:29 : killes(a)www.drop.org It's a patch (which still applies and wants into core). ------------------------------------------------------------------------ April 8, 2005 - 17:10 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user_access_bug_1.patch (11.45 KB) Ok, updated patch. Includes changes to format_name to only display unlinked username for non-privileddged users. 'acccess users' is now 'access user profiles'. The search users tab won't get displayed either if you are not allowed to seee user profiles. The patch got even tested. ------------------------------------------------------------------------ April 8, 2005 - 17:19 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user_access_bug_2.patch (11.26 KB) Further testing revealed a bug in the older parts of the patch... ------------------------------------------------------------------------ April 8, 2005 - 19:02 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user_access_bug_3.patch (11.35 KB) Another iteration: Users should alwys be allowed to see their own user page. ------------------------------------------------------------------------ April 11, 2005 - 22:49 : Steven Committed to 4.6/HEAD. ------------------------------------------------------------------------ April 11, 2005 - 23:04 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user-db.patch (2.56 KB) We found that users should not wonder why they cannot see other users' pages anymore. DB update required. Patch for HEAD attached, 4.6 to follow. ------------------------------------------------------------------------ April 11, 2005 - 23:11 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user-db_0.patch (2.45 KB) ------------------------------------------------------------------------ April 12, 2005 - 04:25 : Anonymous Won't the way the upgrade numbers don't match up between 4.6 and HEAD eventually cause problems for 4.6 users that upgrade to 4.7? ------------------------------------------------------------------------ April 12, 2005 - 05:20 : Dries Where the access checks for the blocks required? ------------------------------------------------------------------------ April 12, 2005 - 14:02 : Dries Also, people can't update their own profile information with this patch. Marking this critical. ------------------------------------------------------------------------ April 12, 2005 - 14:53 : Anonymous Attachment: http://drupal.org/files/issues/user_16.patch (706 bytes) Sorry, here's a patch.

1 0

[drupal-devel] [bug] User info should not be visible without permission
by Anonymous 12 Apr '05

12 Apr '05

Issue status update for http://drupal.org/node/4166 Project: Drupal Version: cvs Component: user system Category: bug reports Priority: critical Assigned to: killes(a)www.drop.org Reported by: mic Updated by: Anonymous Status: patch Attachment: http://drupal.org/files/issues/user_16.patch (706 bytes) Sorry, here's a patch. Anonymous Previous comments: ------------------------------------------------------------------------ November 17, 2003 - 05:23 : mic When anonymous visitors do not have "Access userlist" permission, they can still view all the public info in user profiles. Drupal sites that are created for a group of friends or for an organization want to protect their e-mail addresses, telephone numbers and so on, while making these accessible to fellow members. This could be a critical feature request, but since I think it's an error, I'm sending you this as bug. (I don't have CVS, so I'm hoping someone else will make the simple correction needed to the user module) ------------------------------------------------------------------------ February 3, 2004 - 04:41 : daBrado Attachment: http://drupal.org/files/issues/user-module-add-view-permission.patch (1.54 KB) I made a patch that fixed this by adding a new permission, "access users". This is everything this patch does: Add new permission, "access users" If a user does not have the "access users" permission, s/he cannot read another user's profile at all, and instead gets an "access denied" page. I hope I did this in the proper way. ------------------------------------------------------------------------ April 21, 2004 - 19:25 : Dries I think we should not introduce a new permission but merge with the existing 'access user list' permission (or rename it to 'access users'). Marking this "won't fix" until the patch has been udpated. ------------------------------------------------------------------------ May 28, 2004 - 01:26 : daBrado Attachment: http://drupal.org/files/issues/user-module-add-view-permission_0.patch (1.88 KB) Another patch, this time renaming the permission "access user list" to "access users", and adding a check in the user viewing function to only allow users with this permission to view the user information. ------------------------------------------------------------------------ July 5, 2004 - 14:31 : Anonymous Attachment: http://drupal.org/files/issues/user-module-add-view-permission_1.patch (1.86 KB) Here is a patch again, now for CVS. Does the same thing as above. It is a very simple patch. If it seems proper, I hope that can be included before it goes stale. ------------------------------------------------------------------------ July 9, 2004 - 01:08 : daBrado Attachment: http://drupal.org/files/issues/user-module-add-view-permission_2.patch (1.33 KB) The previous patch was accepted, but then for some reason reversed as part of another CVS commit. So, here is a new patch that brings back the "access users" permission. It controls whether or not a user may view other users info. ------------------------------------------------------------------------ September 22, 2004 - 15:53 : Bèr Kessels Attachment: http://drupal.org/files/issues/access_users_perm.patch (6.46 KB) A new and revised patch. It adds an "access users" permission ------------------------------------------------------------------------ September 22, 2004 - 17:02 : killes(a)www.drop.org I'd like to see this patch applied to cvs before the 4.5 release. Now that we can protect our nodes from unauthorized access it just makes sense to protect our user data as well. In the future I'd like to see scheme where the user (as in end-user) is able to selet which of his data gets published. ------------------------------------------------------------------------ September 23, 2004 - 00:52 : rkendall I would like this too ------------------------------------------------------------------------ October 14, 2004 - 22:46 : drumm Can the name be changed to 'view user profiles'? ------------------------------------------------------------------------ October 18, 2004 - 08:19 : Bèr Kessels It can, but I used "access" for consistancy. we have "access newsfeeds", "access comments", "access etc". This patch is critical for corporate sites btw. A corporate site that has its customers information lying on the streets (so to say) is not-done. Ber ------------------------------------------------------------------------ November 27, 2004 - 12:49 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user-access.patch (5.96 KB) Updated for CVS. I assumed that "admin users" implies "access users" in user_admin. ------------------------------------------------------------------------ March 1, 2005 - 16:30 : killes(a)www.drop.org Does not apply anymore, Ber can you have a look at it? ------------------------------------------------------------------------ March 7, 2005 - 08:19 : Bèr Kessels Attachment: http://drupal.org/files/issues/user_access_0.patch (9.74 KB) New patch. Should apply to HEAD. ------------------------------------------------------------------------ April 7, 2005 - 20:29 : killes(a)www.drop.org It's a patch (which still applies and wants into core). ------------------------------------------------------------------------ April 8, 2005 - 17:10 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user_access_bug_1.patch (11.45 KB) Ok, updated patch. Includes changes to format_name to only display unlinked username for non-privileddged users. 'acccess users' is now 'access user profiles'. The search users tab won't get displayed either if you are not allowed to seee user profiles. The patch got even tested. ------------------------------------------------------------------------ April 8, 2005 - 17:19 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user_access_bug_2.patch (11.26 KB) Further testing revealed a bug in the older parts of the patch... ------------------------------------------------------------------------ April 8, 2005 - 19:02 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user_access_bug_3.patch (11.35 KB) Another iteration: Users should alwys be allowed to see their own user page. ------------------------------------------------------------------------ April 11, 2005 - 22:49 : Steven Committed to 4.6/HEAD. ------------------------------------------------------------------------ April 11, 2005 - 23:04 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user-db.patch (2.56 KB) We found that users should not wonder why they cannot see other users' pages anymore. DB update required. Patch for HEAD attached, 4.6 to follow. ------------------------------------------------------------------------ April 11, 2005 - 23:11 : killes(a)www.drop.org Attachment: http://drupal.org/files/issues/user-db_0.patch (2.45 KB) ------------------------------------------------------------------------ April 12, 2005 - 04:25 : Anonymous Won't the way the upgrade numbers don't match up between 4.6 and HEAD eventually cause problems for 4.6 users that upgrade to 4.7? ------------------------------------------------------------------------ April 12, 2005 - 05:20 : Dries Where the access checks for the blocks required? ------------------------------------------------------------------------ April 12, 2005 - 14:02 : Dries Also, people can't update their own profile information with this patch. Marking this critical.

1 0