#123577 by spatz4000 (originally by tostinni for Drupal 5): do not allow...

#123577 by spatz4000 (originally by tostinni for Drupal 5): do not allow hidden profile fields to be browsed by non-admins

modules/profile/profile.module

@@ -462,8 +462,8 @@ function profile_browse() {
       drupal_not_found();
       return;
     }
-    // Do not allow browsing of private fields by non-admins.
-    if (!user_access('administer users') && $field->visibility == PROFILE_PRIVATE) {
+    // Do not allow browsing of private and hidden fields by non-admins.
+    if (!user_access('administer users') && ($field->visibility == PROFILE_PRIVATE || $field->visibility == PROFILE_HIDDEN)) {
        drupal_access_denied();
        return;
     }