A client reported that profile edit links were appearing on every profile for logged out users.

These links did nothing but obviously should not appear.

Strangely the problem did not occur on my localhost but only on a live server.

Apparently

$vars['entity']->canEdit()

was returning true in profile/views/default/profile/userdetails.php

even though there was no logged-in user. This seems a bit scary.

I fixed the problem by replacing the

$vars['entity']->canEdit()

references with

isloggedin() && $vars['entity']->canEdit()

In another case (for editing the profile icon), the check was:

($_SESSION['user']->guid == page_owner())

which was also mysteriously returning true, so I replaced it with

isloggedin() && ($_SESSION['user']->guid == page_owner())

Has any one else seen these problems?

They seem to be server dependent (or perhaps influenced by the mix of plugins), which is why I would like some feedback before posting anything to Trac.