How do I prevent the user autocomplete page from listing all the account names?

Question

I am building a site where users have access to all the user profiles. When users access (for example) site.com/user/autocomplete/a or site.com/user/autocomplete/b, the site returns all the usernames starting with those letters.

Is there a way to limit the number of returned usernames? When I access https://drupal.org/user/autocomplete/a as logged-in user, I don't get the complete list of usernames starting with a.

Note: I DO want both the autocomplete function and give access to user profiles BUT, I also want to prevent URLS like 'user/autocomplete/a', 'user/autocomplete/b' …etc from listing all account names. Drupal.org has achieved this, and I am trying to find a way to do it on my website.

Answer 1

The callback function used by default on Drupal for the user autocomplete page (user_autocomplete()) always return a maximum of 10 usernames starting with the string it receives as argument.

function user_autocomplete($string = '') {
  $matches = array();
  if ($string) {
    $result = db_select('users')->fields('users', array('name'))
      ->condition('name', db_like($string) . '%', 'LIKE')
      ->range(0, 10)
      ->execute();
    foreach ($result as $user) {
      $matches[$user->name] = check_plain($user->name);
    }
  }
  drupal_json_output($matches);
}

This is even true for Drupal 4.7.

function user_autocomplete($string) {
  $matches = array();
  if ($string) {
    $result = db_query_range("SELECT name FROM {users} WHERE LOWER(name) LIKE LOWER('%s%%')", $string, 0, 10);
    while ($user = db_fetch_object($result)) {
      $matches[$user->name] = check_plain($user->name);
    }
  }
  print drupal_to_js($matches);
  exit;
}

If the user autocomplete page returns more than 10 usernames, it's probable the callback function has been changed by a third-party module to return more results or even all the usernames starting with the given string.