If I create a user "blockeduser" and they do something that creates a message and then I block them it is still possible for an anonymous user (without "access user profiles" and without "administer users") to see the username of that user by visiting http://d6.local/heartbeat/message/2

Drupal core will hide usernames of blocked users, seems this module should do the same and perhaps hide messages of blocked users.

Comments

Stalski’s picture

Hmm, that should be corrected indeed. Stupid mistake.
Thx for the report.