Personal Contact Forms: Access Denied for Anonymous Users

Posted by Grinin on February 10, 2007 at 8:42am

First things first, I have searched the forums once already and found 2 posts dealing with this topic, however neither of them were answered. This being said, I decided to start a new thread to see if I could get a response.

My client (www.BHNBC.com) needs a directory listing of their employees. I created user accounts for each of the employees who will have their own "personal contact form". (Currently only JMBrydon, Valerie Dauphin, and Herbert Spahn have personal contact forms) Anyhow, when an anonymous users clicks on their name on the block which is linked to their personal contact form... It brings them to an error page which reads "Access denied"

The whole point of these forms, is so anonymous surfers who navigate to their site can contact them, without exposing their email addresses to spam robots.

I checked the access control permissions and anonymous users are allowed to use "site-wide" contact forms, as well as view user profiles. However the problem persists.

I will take all the help I can get on this problem, and I am very grateful for the great community of developers that drupal has.

Thanks, and I look forward to your replies.

Grinin

Comments

Lkely answer

Posted by agentrickard on February 10, 2007 at 1:12pm

This answer assumes you are using Drupal 5 and acting as User 1.

After you enable the Contact modules and adjust the Access Control, you have one more step.

By default, Personal Contact Forms are disabled -- but if you're acting as User #1, the site SuperAdmin, you have access to all features. That means you can see the forms, but no one else can.

The staff accounts that need contact forms need to enable those forms, under user/#/edit.

This is one reason why you shouldn't do site admin as user #1, it can throw you off because user 1 has complete access to everything, despite what Access Control rules are. See http://drupal.org/node/22284, Best Practices Guide.

The same is true for Drupal 4.7, I'm fairly certain.

--
http://ken.blufftontoday.com/
http://new.savannahnow.com/user/2
Search first, ask good questions later.

--
http://ken.therickards.com

Thats what I did first.

Posted by Grinin on February 12, 2007 at 5:04am

I understand as super-admin, I have access to everything, but I went user by user as I created them and checked the box that reads "personal contact form" on all the users that require it.

This being said, I don't understand why it does not work? Anonymous users have the permissions to use site wide contact forms, and I even gave them permission to access user profiles, in-case the personal contact forms inherited the permissions of "profiles"

I'm as lost as ever on this, because it seems like some pretty basic functionality.

I.T. Consultant by day... Drupal developer all the time.
http://chrisllorca.com

bug?

Posted by agentrickard on February 12, 2007 at 3:52pm

Could be a bug? What Drupal version are you running?

--
http://ken.blufftontoday.com/
http://new.savannahnow.com/user/2
Search first, ask good questions later.

--
http://ken.therickards.com

On my

Posted by Chad_Dupuis on February 10, 2007 at 2:14pm

On my http://www.yinyanghouse.com/ site I have allowed anonymous users to contact both sitewide and via individual contact forms. To do this I had to add some hacks to the contact module, and perhaps others, but it was all code I found in posts regarding this topic - oh, and I am running 4.7.

After the code changes, however, I found that I still had the issue that you describe in certain cases. What I found is this -- after a user has created an account (or the admin created it manually) no anonymous users can view their profile until the user had actually logged in and out one time. As I was testing this with accounts during the developmental stage, nobody had logged in except for the admin and one other account so it was confusing to track this down. I found that if I went into the database and set the time variables related to when a user logged in, etc. to anything but 0, then every profile was viewable and the contact forms worked as expected.

Cheers,

-Chad.
Yin Yang House Media Services Group

Hacking core

Posted by agentrickard on February 10, 2007 at 10:27pm

Hacking core is a Bad Idea. http://drupal.org/node/77487
--
http://ken.blufftontoday.com/
http://new.savannahnow.com/user/2
Search first, ask good questions later.

--
http://ken.therickards.com

So what am I supposed to do?

Posted by Grinin on February 13, 2007 at 5:55pm

Right now I have an upset client, who just wants his users to be able to go to their web site, click on their names and send them an email, without having to public their email addresses blah@blah.com so spammers can pick them up.

It seems like this is something that can be so easily fixed, but it should be something that works right out of the box for such a robust CMS as drupal is. I mean, it can do everything else, but anonymous users can't email site members?? That just doesn't seem right.

Should I report this as an official bug, or what? Because this seems to be some pretty standard site activity, that simply doesn't work.

Thanks,
Chris

I.T. Consultant by day... Drupal developer all the time.
http://chrisllorca.com

=-=

Posted by VM on February 13, 2007 at 6:10pm

After a user logs in for the first time, the profile and contact form should become active (and stay that way). log in as one of the users whos profile is inactive. Then logout, and test as anon user for this contact form.

I tried this suggestion when

Posted by Grinin on February 19, 2007 at 3:09am

I tried this suggestion when I posted this as a bug in Drupal 5.1 and it still did not work.

I logged in as each individual user, and was unable to access the personal contact form as an anonymous user.

Any help would be great.

Is there any way to escalate my bug?

I.T. Consultant by day... Drupal developer all the time.
http://chrisllorca.com

I am having the same issue.

Posted by greeneo on March 8, 2007 at 5:09pm

I am having the same issue. Anonymous visitors must be able to use contact forms.

Me too

Posted by jsurcombe on March 9, 2007 at 4:46pm

Sorry, me too - I'd love to be able to give anonymous visitors the ability to contact article editors just by clicking on the author's name and writing their feedback, but it doesn't seem to be possible.

Discussion

Posted by agentrickard on March 9, 2007 at 4:58pm

Discussion of the design logic is here: http://drupal.org/node/118708

Work on patches / solutions are here: http://drupal.org/node/58224

--
http://ken.blufftontoday.com/
http://new.savannahnow.com/user/2
Search first, ask good questions later.

--
http://ken.therickards.com

Same here... gues what...

Posted by maikr on March 15, 2007 at 9:38pm

Same thing happens overhere. Also with the Authenticated user type.

Side Wide Contact Form is enabled.
The option to default allow other users to contact the new user is also enabled.
Authenticated users have access to User Profiles.

No Personal Contact Form appears.

Then I thought, what;s the difference between this role and a Forum Admin role I did set up?
Well, the option to also maintain/edit user profiles.

So for testing I did enable it on the Authenticated User role... guess what?
The Personal Contact Form became active!

Could it be an if/then clause attached to the wrong option???

One other thing... users can only send a message to themselfs (?).
Sender (ofcourse) and recepient are the same and are not editable.

Best regards,
Maik

Available for 5.1

Posted by mrtoner on May 19, 2007 at 10:16pm

Grinin, your request has been heard: http://drupal.org/node/58224

_{--
Have you filed a support request in the {insert module/theme name here} issue queue? That's where you'll find users (and developers) familiar with your problem.}

privatemsg

Posted by wpoehner on June 5, 2007 at 4:19am

~~This could be a temporary fix.~~

http://drupal.org/project/privatemsg

Never mind...

I want Sitewide contact form , but

Posted by neel on July 4, 2007 at 8:10am

hello ,
I want to add sitewide contact form in contact page, but I dont want user's persional contact form. how to do this?

I am using private massage module for user's intraction. so I dont need persional contact form. how to do this?

You need to patch core to enable this kind of functionality

Posted by OpenChimp on March 25, 2009 at 12:13am

Apparently, this is by design (Anonymous users can't access personal contact forms). There are many patches available on http://drupal.org/node/58224 for those who really want to implement this feature.

Michael Thorne

This does seem to be a bug...

Posted by gmalsack on April 1, 2009 at 3:03am

I had the same problem. Through reading this post and several linked posts I found that if I enable the "Administer Users" permission on Authenticated Users, then other users of the system can access personal contact forms of any other user that allows this. It would appear the logic to enable personal contact forms is linked to the "Administer Users" permission rather than the "Access Users Profile" permission. If this is by design, I don't see the logic in this design, since many people may want to allow people to contact them via a contact page rather than an email, but would not want other users to be able to change their password, or email address. I'm running 6.10 and still have this issue.

Gregory Malsack

It's definitely a bug. I was

Posted by rhouse on April 21, 2009 at 5:30am

It's definitely a bug.

I was setting up a user (logged in as that authenticated user) and I ticked Personal Contact Form on the user setup page, the clicked on MY OWN "your personal contact form" and got access denied.

The logic here is screwy and from the age of this thread, it has been screwy for two years through two major drupal versions.

I'm seeing the same behavior

Posted by GloryFish on May 11, 2009 at 8:24pm

I'm seeing the same behavior. Authenticated users cannot access the personal contact form unless they are granted the Administer Users permission.

http://gloryfish.org
http://daswiener.com

Not a bug

Posted by greg.harvey on May 26, 2009 at 2:11pm

A *bug* is something that's supposed to work but doesn't. This is by design, so it can't be a bug. It's a *feature request* (you would like Drupal's core contact module to support anonymous user contact). And it's being worked on in D7. Someone has already noted above that the issue is here:
http://drupal.org/node/58224

If you can't wait, either:

1. Make your own D6 patch
2. Make a custom module (not recommended, but not hard either - see hook_mail and user object, user_load, etc. on the Drupal API site)
3. Find another solution, e.g. Webform - allow authenticated users to make their own Webforms and people can even say what fields they want on *their* contact form: http://drupal.org/project/webform

HTH =)

--
http://www.codeenigma.com/

How did you get this to work

Posted by pamreed on May 30, 2009 at 6:29am

Hi Grinin

I look at the website you have list above. It looks like you got it to work. Can you post back how you did it for others to implement. I am using Drupal 6. I would like to add the feature, to have link from a field named Contact to the user personal contact on my staff pages. Please give detail I am a newbie.

Thanks
Pam

I used the Webform module

Posted by rbeton on June 6, 2009 at 12:45pm

As the previous poster said, the contact module is designed to work between authenticated users. That's its purpose.

What you and I want is a web form for feedback messages - that's what the webform (http://drupal.org/project/webform) module does so that's what you need to add to your site.

Rick :-)

Works by changing access rules

Posted by Anibe on July 5, 2009 at 12:12pm

I have found the solution to allow anonymous users view the contact form without the need for any module or hack. I'm using Drupal 6.13.

After creating my form normally with user1, I went to user management menu and then permissions.

Look for the contact module in the table below and under the column for anonymous users, you can check the box for "access site-wide contact form". After saving the settings, the contact form was now available to anonymous users.

Yes

Posted by greg.harvey on July 5, 2009 at 9:26pm

That works for the SITE WIDE contact form, but this is about personal contact forms. However, there is a D6 patch for this now available in this thread I posted earlier on this page:
http://drupal.org/node/58224

DRUPAL 6.x USERS SEE THIS! http://drupal.org/node/58224

It is not yet an accepted, finished D6 patch, but it probably will be. Watch the issue to stay informed.

--
http://www.codeenigma.com/