1
Hi,
Having some concerns about the fact that anyone can do this:
http://example.com/userinfo.php?uid=1and find out the webmaster username, or do it for any user id, plus the fact that ideally I would like to restrict _all_ access to usernames unless the $xoopsrank was equal, I decided to do a bit of searching on the forums in regards to these matters. The solution to this (for me) has now, in fact, already answered by
Dave_L , however as I had done the research here and already collated the various methods to address these issues, I thought it might be helpful to summarise other solutions.
I have given credit to whoever supplied the following, if I have made a mistake somewhere, pls advise.
Preventing anonymous users from viewing profilesQuote:
From Dave_L
You can prevent anonymous users from viewing profiles with a simple hack to userinfo.php:
le="color: #000000"><?php include 'mainfile.php'; include_once XOOPS_ROOT_PATH.'/class/module.textsanitizer.php'; $xoopsUser or redirect_header('index.php', 3, _NOPERM); #*#NOVIEW_USER_PROFILE# $uid = intval($_GET['uid']);
Suppress only certain fields in user profileQuote:
From Dave_L
If you want to suppress only certain fields, you could use the same concept:
le="color: #000000"><?php if ($xoopsUser) { $xoopsTpl->assign('user_icq', $thisUser->getVar('user_icq')); } else { $xoopsTpl->assign('user_icq', '(not available)'); }
Only allow webmasters to see webmaster profilesQuote:
From Dave_L
In userinfo.php, after $uid has been defined:
le="color: #000000"><?php // (not tested) $current_user_is_webmaster = is_object($xoopsUser) && in_array(XOOPS_GROUP_ADMIN, $xoopsUser->getGroups()); $member_handler =& xoops_gethandler('member'); $selected_user_is_webmaster = in_array(XOOPS_GROUP_ADMIN, $member_handler->getGroupsByUser($uid)); $selected_user_is_webmaster and !$current_user_is_webmaster and redirect_header('index.php', 3, _NOPERM);
Prevent access to user pagesFrom
MithrandirQuote:
At the top of userinfo.php (after mainfile.php)
le="color: #000000"><?php if (!$xoopsUser) { redirect_header('index.php', 2, _NOPERM); }
How to hide members email idFrom
StewdioQuote:
Open and edit userinfo.php on line 91
$xoopsTpl->assign('lang_email', _US_EMAIL);
Just comment out the line:
//$xoopsTpl->assign('lang_email', _US_EMAIL);
Deleting fields shown in user profilesFrom
tlQuote:
You will have to modify userinfo.php and edituser.php files (maybe other files)
comment out the lines you want rid of, something like the following in edituser.php file
le="color: #000000"><?php // $edituser->setVar('user_aim', $user_aim); // $edituser->setVar('user_yim', $user_yim); // $edituser->setVar('user_msnm', $user_msnm);
Stop guests from viewing registered user profilesFrom
ajaxbrQuote:
Open userinfo.php and find
le="color: #000000"><?php $xoopsOption['pagetype'] = 'user'; include 'mainfile.php'; include_once XOOPS_ROOT_PATH.'/class/module.textsanitizer.php';
Then add the following (from admin.php) just below it, so that it's between the above and "$uid = intval($HTTP_GET_VARS['uid']);"
Code to add:
le="color: #000000"><?php include XOOPS_ROOT_PATH."/include/cp_functions.php"; if ( !$xoopsUser ) { redirect_header('index.php',3,_AD_NORIGHT); exit(); }
This hardcodes that only members can view profiles, no matter where people find the users profiles links (well, I might be wrong, I feel so wrong tonite) but I guess it's a little broken because it'll display "_AD_NORIGHT" instead of the language string in the redirect page. But I'm way too tired to try to figure out why.
From
MithrandirQuote:
You don't need to include cp_functions.php
just the if (!$xoopsUser) clause will do - the language constant can be replaced with _NOPERM
From
Dave_LQuote:
Here's a more concise way of doing it:
le="color: #000000"><?php $xoopsUser or redirect_header('index.php', 3, _NOPERM);
From
ajaxbrQuote:
Perhaps something like
le="color: #000000"><?php $uid = uid(); $xoopsrank = rank(uid) if !($xoopsrank == "Webmaster" || $xoopsrank == "Moderator" || $xoopsrank == "Masterator") { redirect_header('index.php',3,_NOPERM); exit(); }
Stopping anonymous visitors viewing user infoFrom
Dave_LQuote:
Here's my hack for that:
userinfo.php:
le="color: #000000"><?php include_once XOOPS_ROOT_PATH.'/class/module.textsanitizer.php'; $xoopsUser or redirect_header('index.php', 3, _NOPERM); $uid = intval($HTTP_GET_VARS['uid']);
Blocking access for annoymous usersFrom
MithrandirQuote:
at the top of userinfo.php - below the include statements - add this:
le="color: #000000"><?php if (!$xoopsUser) { redirect_header('index.php', 3, 'You have got to register to access this page'); //Alternatively, use _NOPERM for localised message }
This will block access for non-registered users - but any registered user will be able to see it, independent of group memberships.
Display realname instead of username in new members blockFrom
Dave_LQuote:
Edit modules/system/blocks/system_blocks.php, and in the function b_system_newmembers_show (line 269 in version 2.0.5.2), change:
$block['users'][$i]['name'] = $newmembers[$i]->getVar('uname');
to:
$block['users'][$i]['name'] = $newmembers[$i]->getVar('name');
Hope that helps someone, it certainly helped solve a few problems for me.

Thanks,
Peter