Member Profiles publicly visible through google search

[eengert]

We have a problem with http://www.essp-ny.org where you can google a member's name and google will serve up a direct link to the member's profile details.  This is obviously very concerning and we need to find a way to secure this immediately.

The url that google is indexing is:  http://www.essp-ny.org/index.php?option=com_civicrm&task=civicrm/contact/view/print&reset=1&print=1&cid=xxx where "xxx" is the contact ID.  This is a Joomla website.

This displays all of the person's contact info publicly.  Can anyone tell me how to prevent this?

[petednz]

it isn't just the profile that is exposed though is it - i can also get to http://www.essp-ny.org/index.php?option=com_civicrm&task=civicrm/dashboard&reset=1

which suggests to me that your joomla permissions are too open unless there are specific features you are trying to make open that normally are not required.

[eengert]

Joomla permission in global configuration are set to the defaults.  I'm not sure what I would need to change there.  I tried denying access to various actions for the Public group, but it didn't seem to have any impact so I set it back to the defaults (which is "not set").

Can you be more specific about what you think I should try changing in the permissions?

[eengert]

Ok, I found where to set the Joomla permissions for CiviCRM components.  They were indeed too wide open.  Denying access to various actions has solved the problem. 

Thanks.

[Michael McAndrew]

You probably want to get google and various other search engines to remove the offending search results as well.  They have a form you fill in...