It is currently possible for any user, no matter what role, to get a list of all courses another user is enrolled in, as long as they are not hidden assignments.

Would like the capability to define 'Courses' as a hidden user field under Admin->Users->Permissions->User Policies. If courses isselected, users will not be able to see other users' course listing unless they have the moodle/user:viewhiddendetails capability.

I have attached the diffs to do this, against /admin/settings/users.php & /user/view.php. Diffs generated against 1.9 + (Build: 20080307).

Discussion is at http://moodle.org/mod/forum/discuss.php?d=91910