Anonymous user access to personal contact forms [#702058]

I got the impression from http://drupal.org/node/58224#comment-2504626 that the ability to allow anonymous user access to personal contact forms was included in this module. I can't seem to find any permission or user option that would allow this for all, specific, or no users. Am I missing something?

I, like many other Drupal users, really need this facility.

Any help will be greatly appreciated.
Mel

Comments

Comment #1

heather CreditAttribution: heather commented 4 February 2010 at 17:37

Mel,

I think this has been committed to 7 and this project is to track backporting to 6, as far as I can see... it's in progress.

Check out: http://drupal.org/project/contact_anon

- Heather

Comment #2

antelrope CreditAttribution: antelrope commented 11 February 2010 at 05:59

The module,
Anonymous Contact > http://drupal.org/project/contact_anon
has nothing to do with allowing anonymous users access to a registered user's personal contact form.
Instead, it allows contacting a user without knowing what user is being contacted.

I too am wishing for a way to let anonymous users contact registered users. My hope is that there will be a way for anyone to browse to a user's profile, click their contact link, and send them a message via the form.

Can anyone clarify if this is a feature that is currently being implemented in this backport?

Comment #3

Dave Reid

he/him

English

Nebraska USA

CreditAttribution: Dave Reid commented 11 February 2010 at 06:06

It will be implemented here. Originally I was going to implement it as a part of contact_anon, but since then I've decided its much better it lives as a backport within this project.

Comment #4

Mel55113 CreditAttribution: Mel55113 commented 15 February 2010 at 00:48

Dave,

I downloaded the January 21, 2010 - 14:19 version of contact 6.x-2.x-dev. It does, in fact, allow anonymous users to contact individual users but it has two serious problems that prevent using it:

1. An anonymous user is given the option to send themselves a copy of the message, and it works!

2. After an anonymous users sends the message they are redirected to /users/username. Fortunately, this gets an unauthorized access response but this is unacceptable for a production site.

Mel

Comment #5

antelrope CreditAttribution: antelrope commented 15 February 2010 at 17:30

Hi mel,
could you provide some more information.
Why shouldn't an anonymous user be able to send themselves a copy of the message that they send?
Also, what sort of usage scenario would let an anonymous user access an authenticated user's personal contact form but not access an authenticated user's profile page?

Comment #6

Mel55113 CreditAttribution: Mel55113 commented 15 February 2010 at 18:29

Antelrope,

If an anonymous user can send themselves a copy of the message then the email address of the recipient may be exposed to them. At the least they get information about the site that they don't need, e.g., the recipient's uid. I believe there have been some discussions why anonymous users shouldn't be able to send themselves copies, but I don't have the time to track them down right now.

In the scenario where I would use this the link to the personal contact from would be generated in a view, e.g., officers of an organization. All public information about the (authorized) user comes from a custom node type, not a profile field. For the site where I most want to have anonymous users use personal contact forms there is probably no need to even have authenticated users have the capability to view other user's profile information.

I hope this helps,
Mel

Comment #7

antelrope CreditAttribution: antelrope commented 15 February 2010 at 21:57

That is very helpful, thank you mel. The first step in solving a problem is understanding it fully.
I need the option for anonymous users to be granted permission to access an authenticated user's personal contact page for my drupal 6 site and so am working on a patch myself.
The patch and a list of changes are in this thread. > http://drupal.org/node/714546
If you would be willing to help test and provide feedback, I would very much appreciate it.

I'm hoping to expand the configuration options for contact in several ways that should address your issues well, I think.
My to do list includes the following items:
-- Add configuration option to redirect to a specific url after a message is sent succesfully.
-- Add an option to allow or dissallow an authenticated user, who is accessing the contact form of another authenticated user, the option of changing their name/email address. The options being 'can change both', 'can change neither', 'can change name only', or 'can change email only'. This is to address isssue;
Don't allow registered users to change their name or e-mail in contact forms > http://drupal.org/node/601776
-- Change the formatting of all copy messages to only include information sent by the sender. Already my patch has the functionality of keeping the recipients email address hidden from the sender.
-- Add a permissions options for allowing a user to send themselves a copy of a message sent via the personal contact form as well as a seperate permission for the site wide contact form. This will enable restricting an anonymous user or a user of any arbitrary role from sending themselves a copy.

I'm hoping to get some or all of this code into core eventually, if not, it will need to become it's own module, I think. Perhaps a veteran drupal coder can clarify what the best approach is.