From 8dd305382d8a9bf38dad4a4a500a990b35e4d272 Mon Sep 17 00:00:00 2001
From: Marcel Werk <burntime@woltlab.com>
Date: Mon, 9 Jun 2014 19:01:41 +0200
Subject: [PATCH] Fixed missing permission validation

---
 com.woltlab.wcf/templates/user.tpl                    |  6 +++---
 com.woltlab.wcf/templates/userInformationHeadline.tpl |  6 +++---
 .../install/files/lib/data/user/UserProfile.class.php | 11 +++++++++++
 3 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/com.woltlab.wcf/templates/user.tpl b/com.woltlab.wcf/templates/user.tpl
index c9eb6a6592..32e75d42f3 100644
--- a/com.woltlab.wcf/templates/user.tpl
+++ b/com.woltlab.wcf/templates/user.tpl
@@ -153,9 +153,9 @@
 	<h1>{$user->username}{if MODULE_USER_RANK && $user->getUserTitle()} <span class="badge userTitleBadge{if $user->getRank() && $user->getRank()->cssClassName} {@$user->getRank()->cssClassName}{/if}">{$user->getUserTitle()}</span>{/if}</h1>
 	
 	<ul class="dataList">
-		{if $user->gender}<li>{lang}wcf.user.gender.{if $user->gender == 1}male{else}female{/if}{/lang}</li>{/if}
-		{if $user->getAge()}<li>{@$user->getAge()}</li>{/if}
-		{if $user->location}<li>{lang}wcf.user.membersList.location{/lang}</li>{/if}
+		{if $user->isVisibleOption('gender') && $user->gender}<li>{lang}wcf.user.gender.{if $user->gender == 1}male{else}female{/if}{/lang}</li>{/if}
+		{if $user->isVisibleOption('birthday') && $user->getAge()}<li>{@$user->getAge()}</li>{/if}
+		{if $user->isVisibleOption('location') && $user->location}<li>{lang}wcf.user.membersList.location{/lang}</li>{/if}
 		{if $user->getOldUsername()}<li>{lang}wcf.user.profile.oldUsername{/lang}</li>{/if}
 		<li>{lang}wcf.user.membersList.registrationDate{/lang}</li>
 		{event name='userDataRow1'}
diff --git a/com.woltlab.wcf/templates/userInformationHeadline.tpl b/com.woltlab.wcf/templates/userInformationHeadline.tpl
index 425d8eb0fd..72536d701d 100644
--- a/com.woltlab.wcf/templates/userInformationHeadline.tpl
+++ b/com.woltlab.wcf/templates/userInformationHeadline.tpl
@@ -3,9 +3,9 @@
 </div>
 <ul class="dataList userFacts">
 	{if $user->isAccessible('canViewProfile')}
-		{if $user->gender}<li>{lang}wcf.user.gender.{if $user->gender == 1}male{else}female{/if}{/lang}</li>{/if}
-		{if $user->getAge()}<li>{@$user->getAge()}</li>{/if}
-		{if $user->location}<li>{lang}wcf.user.membersList.location{/lang}</li>{/if}
+		{if $user->isVisibleOption('gender') && $user->gender}<li>{lang}wcf.user.gender.{if $user->gender == 1}male{else}female{/if}{/lang}</li>{/if}
+		{if $user->isVisibleOption('birthday') && $user->getAge()}<li>{@$user->getAge()}</li>{/if}
+		{if $user->isVisibleOption('location') && $user->location}<li>{lang}wcf.user.membersList.location{/lang}</li>{/if}
 	{/if}
 	<li>{lang}wcf.user.membersList.registrationDate{/lang}</li>
 	
diff --git a/wcfsetup/install/files/lib/data/user/UserProfile.class.php b/wcfsetup/install/files/lib/data/user/UserProfile.class.php
index e728df0793..f720cecd68 100644
--- a/wcfsetup/install/files/lib/data/user/UserProfile.class.php
+++ b/wcfsetup/install/files/lib/data/user/UserProfile.class.php
@@ -774,6 +774,17 @@ class UserProfile extends DatabaseObjectDecorator implements IBreadcrumbProvider
 		return $option->optionValue;
 	}
 	
+	/**
+	 * Returns true, if the active user has access to the user option with the given name.
+	 *
+	 * @param	string		$name
+	 * @return	boolean
+	 */
+	public function isVisibleOption($name) {
+		$option = ViewableUserOption::getUserOption($name);
+		return $option->isVisible();
+	}
+	
 	/**
 	 * Returns the formatted username.
 	 *
-- 
2.20.1