Published by Mijingo
tips icon image

EE Insider Tips
Sponsored by Mijingo's EE 2 Screencasts

ExpressionEngine mini-howtos created by the EE Insider community.

Gotcha: remember to hide your memberlist

  • Posted by johnniefp
  • April 05, 2010

Once you have set up your site you may find that your memberslist with screen_name is visible to all. To test this visit:
http://www.YOURDOMAIN.com/member/memberlist

Horrible isn’t it.

Anyway, to turn this off you have to do it per member group, in the back end go to:
CP Home

Emily H — 06:34 on 04.06.2010

What a coincidence that you’ve written about this today - I just stumbled upon this issue last week and spent some time writing it up on the forums but didn’t get round to spreading the word further afield.

I am glad you’ve written it up here but PLEASE PLEASE can you add your vote - and encourage others to add theirs - to this Feature Request to disable member list by Default.

johnniefp — 06:39 on 04.06.2010

Hello Emily,

>> PLEASE PLEASE can you add your vote
Done.

UltraBob — 20:36 on 04.08.2010

Voted on the forum, but also here is the SQL you need to do a quick fix: mark all the default accounts other than super user (banned, guest, member, pending) as unable to view it in one full swoop even for MSM sites:

SELECT can_view_profiles from exp_member_groups WHERE `group_id` > 1 AND `group_id` < 6;

Hope the content form doesn’t munge that too bad. 

Remove the AND `group_id` < 6 part if you want ALL accounts other than super admin blocked.

UltraBob — 20:41 on 04.08.2010

how embarrassing!  I posted the wrong SQL code here.  The one I posted above is for checking out the status of the selected rows.  Let me repost what I posted over at the forums:

Here is the SQL you need to do a quick fix: mark all the default accounts other than super user (banned, guest, member, pending) as unable to view it in one full swoop even for MSM sites:

UPDATE `exp_member_groups` SET `can_view_profiles`='n' WHERE `group_id` > 2 AND `group_id` < 6; 

Hope the content form doesn

Forrest — 05:11 on 01.29.2011

The one thing I don’t see on this is how to block the memberlist from public view. It is one thing to block it from member groups but what about the public in general? Other than changing the trigger word, I don’t see a way to turn it off from public viewing. I am hoping I am wrong on this.

Simon J — 05:08 on 02.02.2011

Forrest, you can do this by editing the Guests member group and under Member Account Privileges change “Can view public profiles” to “No”.

I want to add my vote to this being set to “No” for all member groups by default. This was being complained about as far back as 2007 and it STILL hasn’t been addressed. Really disappointing. I was shocked when I discovered this page lurking on a site I’d built.

pdxgene — 12:43 on 03.08.2012

Interestingly, after making this change for “Guest” users, the member list screen on our site is now restricted, i.e.:

[domain]/members/memberlist

However, deep links to sorted member lists appear to still be visible, for example:

[domain]/member/memberlist/0-total_posts-desc-20-0/

Still allows any visitor to view the list.

Does anyone know if this is a server-side caching issue, or something like that?  Or is it a hole in the permission scheme?

Thanks!