Hi
I think this is a bug (not sure if it's by design)
user contact form is open only for registered users.

my logic says that if i give anonymous users "access user profile" permission
this would give an anonymous user permissions to access the user profile & contact a user by his contact form if his contact checkbox is marked in his profile

i have looked at the contact.module

function contact_menu($may_cache) {
....

    if (arg(0) == 'user' && is_numeric(arg(1))) {
      global $user;
      $account = user_load(array('uid' => arg(1)));
      if (($user->uid != $account->uid && $account->contact) || user_access('administer users')) {
        $items[] = array('path' => 'user/'. arg(1) .'/contact',
          'title' => t('Contact'),
          'callback' => 'contact_user_page',
          'type' => MENU_LOCAL_TASK,
          'access' => $user->uid,
          'weight' => 2,
        );
      }
    }
  }

I guess this line is causing this behavior - only for logged in users

'access' => $user->uid,

is this by design , or by mistake ?

Avior

Comments

webernet’s picture

Status: Active » Closed (works as designed)

This is by design. There is an existing issue to consider changing this behavior.