Profile viewable by non logged in users (guests) Profile viewable by non logged in users (guests)
 

News:

cpg1.5.48 Security release - upgrade mandatory!
The Coppermine development team is releasing a security update for Coppermine in order to counter a recently discovered vulnerability. It is important that all users who run version cpg1.5.46 or older update to this latest version as soon as possible.
[more]

Main Menu

Profile viewable by non logged in users (guests)

Started by kjohn, December 24, 2007, 02:18:24 AM

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

kjohn

Perhaps I missed a related post, but I could not see where this issue has occurred for anyone else or perhaps it is my own ignorance.  User's profile information (specifically the custom profile fields) appear to be viewable by anyone without regard to log-in status.  First, is it supposed to be like this?  Second, is it possible for me to restrict these fields in some way?

I am running the latest version with Highslide, MiniCMS, Onlinestatus and require full name mods (which I extended to birthdate - all custom profile fields).

Any assistance is appreciated.

Nibbler

Yes, that is intentional. If you want to hide them from anonymous users then you can mod profile.php.

find


$display_profile_form_param = array(
    array('text', 'username', $lang_register_php['username']),
    array('text', 'reg_date', $lang_register_php['reg_date']),
    array('text', 'group', $lang_register_php['group']),
    array('text', 'user_profile1', $CONFIG['user_profile1_name']),
    array('text', 'user_profile2', $CONFIG['user_profile2_name']),
    array('text', 'user_profile3', $CONFIG['user_profile3_name']),
    array('text', 'user_profile4', $CONFIG['user_profile4_name']),
    array('text', 'user_profile5', $CONFIG['user_profile5_name']),
    array('text', 'user_profile6', $CONFIG['user_profile6_name']),
    array('text', 'pic_count', $lang_register_php['pic_count']),
    array('thumb', 'user_thumb'),
    );


after that, add


if (!USER_ID) array_splice($display_profile_form_param, 3, 6);


To remove the additional profile fields.

kjohn

Many thanks!

Now I understand; your suggestion works perfectly and I can pick and choose what fields are available for guests to see.