Contacting blocked users [#115180]

Comment	File	Size	Author
#6	contact_disabled_user_fix.patch	5.54 KB	kaerast

Comment #1

kaerast commented 2 February 2007 at 00:11

I can reproduce this in 5.1. Logged in as administrator, sending a message to a disabled user. No error message is displayed, and Drupal attempts to send the email. However the following is generated in Postfix's mail.log:

Feb  2 00:03:36 example postfix/pickup[17881]: AC3EB221C0C2: uid=33 from=<www-data>
Feb  2 00:03:36 example postfix/cleanup[26387]: AC3EB221C0C2: message-id=<20070202000336.AC3EB221C0C2@example.com>
Feb  2 00:03:36 example postfix/cleanup[26387]: AC3EB221C0C2: to=<unknown>, relay=none, delay=0, status=bounced (No recipients specified)

I'd therefore assume that Drupal is failing to detect the user's email address when the user is disabled, isn't detecting this, and so is trying to send to a blank email address without logging anything.

I believe the correct behaviour should be:

check if user is disabled
if user is disabled, check if user is administrator
if user is administrator allow form to be sent
otherwise generate an error message.

Log in or register to post comments

Comment #2

seanberto commented 4 February 2007 at 20:39

Maybe I'm not understanding your point about checking if the user is the administrator. Is that to check if the sender is the administrator or the recipient user (who may or may not be blocked)?

I think it makes sense to allow the administrator to be able to use the contact form to communicate with blocked users. For example, to communicate the reason that the user has been blocked.

-s

Log in or register to post comments

Comment #3

kaerast commented 4 February 2007 at 23:17

We need to check whether the user sending is an administrator. We don't want just anybody sending messages through the contact form of a disabled user, but it is vital that the administrators are able to send emails to disabled users.

Log in or register to post comments

Comment #4

kaerast commented 5 February 2007 at 04:08

This issue is caused by line 360 of contact.module which will only load the recipient user object if it is enabled. I propose we change this to something along the lines of:

$account = user_load(array('uid' => arg(1)));
// check if the recipient account is enabled, or the sender is an administrator
if ($account->Status == 1 || user_access('administer site configuration')) {

  // stuff to send message

} else {
  drupal_access_denied();
}

I've just looked at Drupal 4.7.4, and this issue also exists there, so it's been around for a while. My proposed solution should work in 4.7.4 as well as it does in 5.x, so I'd like to see it backported too.

Right, I should probably get on with testing this and developing a patch.