The 'read privatemsg' permission is ignored when sending private messages. Specifically:

  • You can send messages to users who can never read them
  • The autocomplete will returns users who do not have permission to read messages (thus exposing usernames that may be preferred kept private)
CommentFileSizeAuthor
#3 privatemsg-write-permissions-1993204-2.patch3.27 KBtorrance123
#1 privatemsg-write-permissions-1993204-1.patch3.27 KBtorrance123

Comments

torrance123’s picture

torrance123 commented
Status: Needs work » Needs review
StatusFileSize
new privatemsg-write-permissions-1993204-1.patch3.27 KB

The attached patch adds tests for this bug.

Status: Needs review » Needs work

The last submitted patch, privatemsg-write-permissions-1993204-1.patch, failed testing.

torrance123’s picture

torrance123 commented
Status: Needs work » Needs review
StatusFileSize
new privatemsg-write-permissions-1993204-2.patch3.27 KB

Status: Needs review » Needs work

The last submitted patch, privatemsg-write-permissions-1993204-2.patch, failed testing.

ptmkenny’s picture

ptmkenny commented

Meta issue: http://drupal.org/node/138950

berdir’s picture

berdir
Primary language German
Location Switzerland
commented

I've been away from Privatemsg for a long time, so I can't say for sure, this is also why I haven't responded.

Agreed that this seems to make sense, there are also other issues about this, see #5.

So what we need now is a fix for the failing tests ;)

Wondering if we want to take these related issues together, because with e.g. the permission rename referenced in the other issue, this becomes much clearer and this two patches will conflict quite a bit.

berdir’s picture

berdir
Primary language German
Location Switzerland
commented
Status: Needs work » Closed (duplicate)

Ah, getting confused. Please don't open separate issues for test patches. Closing as duplicate of #1928502: Can send messages to users who do not have 'read' permission. Upload a test-only patch with a test-only.patch suffix there first, second a patch with the tests and a fix.