1
alienday
Not reveal probes of userinfo.php?uid=X
  • 2008/1/6 2:13

  • alienday

  • Just popping in

  • Posts: 16

  • Since: 2004/11/27


Is there a way to make user profiles only available to admin?

IE, I can iterate through every user by incrementing X below.

https://xoops.org/userinfo.php?uid=X

Thanks,

Jim

2
sarahmx
Re: Not reveal probes of userinfo.php?uid=X
  • 2008/1/6 3:09

  • sarahmx

  • Quite a regular

  • Posts: 381

  • Since: 2007/10/28



3
alienday
Re: Not reveal probes of userinfo.php?uid=X
  • 2008/2/20 5:00

  • alienday

  • Just popping in

  • Posts: 16

  • Since: 2004/11/27


Thanks. In the end I had to use the following in userinfo.php (just after ROOT PATH)

// Added following line to only allow admin to view profile.  User cannot view, but can edit.//
$xoopsUser or redirect_header('index.php', 3, _NOPERM);
$isAdmin = $xoopsUser->isAdmin();
$isAdmin or redirect_header('index.php', 3, _NOPERM);
// End modified file //

Ideally, I'd like to have only admin or user themself view. Without the first line above, a registered user gets a blank page instead of redirect.... Anyway, mission accomplished.

Jim