private custom user fields visible to all users?!

sak · Worker Joined: Jul 06, 2005 Posts: 167

I just noticed that custom fields set as private in RNYA are visible to all users. Is this intended? I just upgrade to 2.4 and they are still visible.

If this is intended, that's cool. I need to like IMMEDIATELY fix this though. I have to protect my users' information right away. Can someone tell me how to do this?

Palbin · Posted: Sat Sep 19, 2009 4:50 pm

I just made a custom field called color and I only see it as a user(me) or admin. I do not see it as anonymous. Are you sure it is not just you that is seeing becuase you are still logged into admin? Sorry have to ask.

Palbin · Posted: Sat Sep 19, 2009 4:53 pm

I see the problem now. I thought this problem was taken care of already Mad

Give me a few minutes.

Palbin · Posted: Sat Sep 19, 2009 5:14 pm

Ok I thought I saw the problem, but I can't reproduce it. I know that this was a problem in 2.3, but are you sure they are showing in 2.4?

Per above are you logged into admin?

Palbin · Posted: Sat Sep 19, 2009 5:44 pm

OK, Sorry! I finally got it. I don't want to mention publicly why it was so difficult to find, but here is the solution.

Find line 105 of /modules/Your_Account/public/userinfo.php

Code:

if (is_admin($admin) OR (is_user($user) AND $usrinfo['username'] == $username)) {

Change to:

Code:

if (is_admin($admin) OR (is_user($user) AND $usrinfo['username'] == $userinfo['username'])) {

sak · Worker Joined: Jul 06, 2005 Posts: 167

I'm just logged-in as a regular user right now. Using a different browser to make sure that cookies/etc aren't coming into play. I even tried accessing admin.php to make sure I wasn't somehow accessing admin features since it's from the same IP. admin.php brings up the login, so I must not have any access to admin.

Looks like a standard user can still see my custom "private" fields. By standard user I mean logged-in as a registered user. Anonymous can NOT see the private fields but a user can at this point.

For the upgrade, I just upgraded my files and ran the db updater - no issues came up with the upgrade - very smooth and easy Smile

edit: posted while you were posting. I will try the above fix right now.

sak · Worker Joined: Jul 06, 2005 Posts: 167

Worked like a charm - thank you so much!