okay, think i came up with a decent solution to this. in the webloginpe.snippet.php(and the snippet code in the modx manager) change:
case 'viewprofile':
if (in_array('viewprofile', $disableServices)){return;}
$wlpe->ViewUserProfile($_REQUEST['username'],$inputHandler);
return $displayViewProfileTpl;
break;
to this:
case 'viewprofile':
if (in_array('viewprofile', $disableServices)){return;}
//$wlpe->ViewUserProfile($_REQUEST['username'],$inputHandler);
$tmpViewProfileArray = array('userid'=>$_REQUEST['userid'], 'username'=>$_REQUEST['username']);
$wlpe->ViewUserProfile($tmpViewProfileArray,$inputHandler);
return $displayViewProfileTpl;
break;
which passes over an array of the username(if given) and the user’s id, which is passed in a GET variable called ’userid’. this new data is passed in an array, so within the function(next step) you can check to see if it’s getting this new data with the is_array() function, so if it’s not an array it’ll maintain the old functionality.
then in the ViewUserProfile function in webloginpe.class.phpchange:
function ViewUserProfile($username,$inputHandler=array())
{
global $modx;
$web_users = $modx->getFullTableName('web_users');
$web_user_attributes = $modx->getFullTableName('web_user_attributes');
$findID = $modx->db->query("SELECT * FROM ".$web_users." WHERE `username` = '".$username."'");
to this:
function ViewUserProfile($username,$inputHandler=array())
{
global $modx;
$web_users = $modx->getFullTableName('web_users');
$web_user_attributes = $modx->getFullTableName('web_user_attributes');
############
## NEW STUFF
############
if(is_array($username)){
$newQuery = "SELECT * FROM ".$web_users." WHERE `id` = '".$username['userid']."'";
$username = $username['username'];
}else{
$newQuery = "SELECT * FROM ".$web_users." WHERE `username` = '".$username."'";
}
################
## END NEW STUFF
################
$findID = $modx->db->query($newQuery);
which makes the query lookup the user by their id, rather than by username.
now in your chunk (&usersTpl) which displays the user list, change:
<a href = "[~[*id*]~]?service=viewprofile&username=[+view.username+]">
to this:
<a href = "[~[*id*]~]?service=viewprofile&userid=[+view.internalKey+]">
so it passes over the user’s id in the url, rather than the username which they use to login with.
this seems to work great for viewing the profiles, i’m not sure if it messes up the built in messaging through WebLoginPE, as i’m not using that feature on this project. and i know this isn’t doing anything to make anything more secure, i just know many clients i’ve worked with never want their users’ `username` field displayed anywhere on the site.
☆ A M B ☆
