Here is the code I see in views_menu() function:
$items['admin/views/ajax/autocomplete/user'] = array(
'page callback' => 'views_ajax_autocomplete_user',
'theme callback' => 'ajax_base_page_theme',
'access callback' => 'user_access',
'access arguments' => array('access user profiles'),
'type' => MENU_CALLBACK,
'file' => 'includes/ajax.inc',
);
And here is the code I see in this module:
/**
* Implements hook_menu_alter().
*
* Disable the callback for the views module when users don't have access user
* profiles permission.
*/
function username_enumeration_prevention_menu_alter(&$items) {
if (module_exists('views')) {
$items['admin/views/ajax/autocomplete/user']['access arguments'] = array('access user profiles');
}
}
So this looks like obsolete code/feature to me.
Comments
Comment #2
nicksanta commentedGreat observation - you are correct. Since #1069326: access arguments on admin/views/ajax/autocomplete/user ajax call was merged this code was redundant. Working on a fix now.
Comment #4
nicksanta commented