-3

I am building a site where users have access to all the user profiles. When users access (for example) site.com/user/autocomplete/a or site.com/user/autocomplete/b, the site returns all the usernames starting with those letters.

Is there a way to limit the number of returned usernames? When I access https://drupal.org/user/autocomplete/a as logged-in user, I don't get the complete list of usernames starting with a.

Note: I DO want both the autocomplete function and give access to user profiles BUT, I also want to prevent URLS like 'user/autocomplete/a', 'user/autocomplete/b' …etc from listing all account names. Drupal.org has achieved this, and I am trying to find a way to do it on my website.

  • 2
    Don't use autocomplete? Don't give access to user profiles? I'm not sure how you want to facilitate searching for users but not showing users. – Kevin Oct 11 '17 at 17:16
  • 3
    If you want to hide usernames but provide another way to search for users, look at the Real Name module: drupal.org/project/realname – Patrick Kenny Oct 11 '17 at 17:22
  • I am curious to see what drupal.org is using to prevent this – Agi Stopolis Oct 11 '17 at 20:19
  • You don't want to have the user autocomplete functionality? – Adrian Cid Almaguer Oct 12 '17 at 14:29
  • I DO want both the autocomplete function and give access to user profiles BUT, I also want to prevent URLS like 'user/autocomplete/a', 'user/autocomplete/b' …etc from listing all account names. Drupal.org has achieved this, and I am trying to find a way to do it on my website – Agi Stopolis Oct 13 '17 at 2:03
1

The callback function used by default on Drupal for the user autocomplete page (user_autocomplete()) always return a maximum of 10 usernames starting with the string it receives as argument.

function user_autocomplete($string = '') {
  $matches = array();
  if ($string) {
    $result = db_select('users')->fields('users', array('name'))
      ->condition('name', db_like($string) . '%', 'LIKE')
      ->range(0, 10)
      ->execute();
    foreach ($result as $user) {
      $matches[$user->name] = check_plain($user->name);
    }
  }
  drupal_json_output($matches);
}

This is even true for Drupal 4.7.

function user_autocomplete($string) {
  $matches = array();
  if ($string) {
    $result = db_query_range("SELECT name FROM {users} WHERE LOWER(name) LIKE LOWER('%s%%')", $string, 0, 10);
    while ($user = db_fetch_object($result)) {
      $matches[$user->name] = check_plain($user->name);
    }
  }
  print drupal_to_js($matches);
  exit;
}

If the user autocomplete page returns more than 10 usernames, it's probable the callback function has been changed by a third-party module to return more results or even all the usernames starting with the given string.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.