Index: buddylist.module
===================================================================
--- buddylist.module	(revision 727)
+++ buddylist.module	(working copy)
@@ -137,7 +137,7 @@
     );
 
     // 'view only' tabs
-    $viewAccess = (($id == $user->uid) || user_access('view buddy lists'));
+    $viewAccess = buddylist_view_access($user->uid,$id);
     $items[] = array(
       'path' => 'buddylist/'. $id .'/buddies',
       'title' => t('@Buddies', buddylist_translation()),
@@ -417,7 +417,7 @@
     buddylist_setmsg_received($thisuser);
   }
 
-  if ($type == 'view' && user_access('view buddy lists')) {
+  if ($type == 'view' && buddylist_view_access($user->uid, $thisuser->uid)) {
     // if thisuser has friends, show friends
     $cnt = variable_get('buddylist_prof_buddies', 5);
     $i = 0;
@@ -1235,6 +1235,13 @@
   drupal_goto();
 }
 
+function buddylist_view_access($uid, $bid) {
+  return ($uid == $bid) || buddylist_is_buddy($uid,$bid) || user_access('view buddy lists');
+}
+function buddylist_is_buddy($uid,$bid) {
+  $isbuddy = db_result(db_query("SELECT * FROM {buddylist} WHERE uid = %d AND buddy = %d",$uid, $bid));
+  return $isbuddy;
+}
 /**
  * Confirm and add a buddy.
  */