Sorry if this is the wrong place to post this. I was going to try to post this as a bug, but the profile module doesn't show up on the project list dropdown on the bug post page.
That said, I think I've come across a potential problem in the profile.module distributed with drupal 4.6.3.
// $Id: profile.module,v 1.90.2.2 2005/06/01 04:30:07 unconed Exp $
Briefly stated:
in function_profile_admin_add, a call to profile_validate_form is followed by two more validations designed to prevent duplicate titles and duplicate field names.
in function_profile_admin_edit, there is also a call to profile_validate_form, but afterwards it is NOT followed by the previously mentioned checks for duplicates.
It seems to me (and I'll say now that I'm not an expert), that one could create a new profile field, then go back and edit it, change the title and name to be the same as an already existing field, and the module would try to save it. The actual save might in some cases be prevented at the database level (name is a unique key, but not title), but even so the edit validation should be made to catch this error before it gets that far.
Forgive me if I've interpreted the code incorrectly, or if I should have posted this somewhere else (if so, please let me know where).
Steve
PS: As long as I'm here, does anyone know if the 4.7 version of this module is going to include any additional field types, and if so what ones?