hi,
I've a simple issue: an anonymous user can guess how many users I have in my site. I believe this is a security issue, because personally i don't want my competitors to know how many users i have in my site.

here's how it can be done:
Anonymous user enters following url:

http://www.example.com/user/XXX/edit

if there're XXX number of users in example.com, then he will see "access denied"

otherwise he'll see "page not found"

any advice? this is really a matter for me, i need to find a solution..

thanks

Comments

mikey_p’s picture

mikey_p commented

You could add a module that has a custom function for handling access or load functions for the user edit pages, using hook_menu_alter(). However, it's not really a security issue in any way.

kars-t’s picture

kars-t commented
Status: Active » Fixed

Hi

I am closing this issue to clean up the issue queue. Feel free to reopen the issue if there is new information and the problem still resides. If not please make sure you close your issues that you don't need any more.

Maybe you can get support from the local user group. Please take a look at this list at groups.drupal.org.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.