To replicate this issue:

  • set the permissions for the user module's "access user profiles" to be accessible to admins, only
  • log in as a non-admin user and set that user's profile to allow their "Personal contact form"
  • as that same non-admin user, post a comment to a forum, blog, whatever—i.e., ensure that there's a "contact the author" link available
  • log out and log in as a different non-admin user
  • use the aforementioned "contact the author" link to access that user's "Personal contact form" and send that user a message
  • observe that, when the message has been sent, you are sent to that user's profile page (i.e., the user whose "Personal contact form" you'd just used) but, since you don't have access that user's profile page, you receive a "whatever the site's configured to do with access-denied errors" page

It appears that, in contact.pages.inc

  // Back to the requested users profile page.
  $form_state['redirect'] = "user/$account->uid";

should first employ a permissions check and, if the target user's profile page is not accessible, use an alternate/accessible redirect.

CommentFileSizeAuthor
#10 interdiff-299216-8-10.txt592 bytesjacob.embree
#10 contact-redirect-access-denied-299216-10-D7.patch1.88 KBjacob.embree
#8 contact-redirect-access-denied-299216-8-D7.patch1.83 KBjacob.embree
#5 299216-contact-redirect-access-denied-D7.patch4.22 KBdave reid
#3 299216-contact-redirect-access-denied-D7.patch4.71 KBdave reid

Comments

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
Status: Active » Closed (duplicate)

Will be fixed with #58224: Allow anonymous users access to a members personal contact form

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
Version: 6.4 » 7.x-dev
Assigned: Unassigned » dave reid
Status: Closed (duplicate) » Active

Actually, I think I prefer to fix this separately. Assigning myself and marking back to active.

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
Status: Active » Needs review
Issue tags: +Needs backport to D6, +Needs backport to D5
StatusFileSize
new 299216-contact-redirect-access-denied-D7.patch4.71 KB

Patch attached for review, including tests!

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
Status: Needs review » Needs work

For users without access user profiles permission, this should really redirect back to the homepage instead of staying on the contact form. This is what the site-wide contact form does in order to prevent confusion if the sent e-mail triggers flood control on the contact form. Will re-roll tomorrow.

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
Status: Needs work » Needs review
StatusFileSize
new 299216-contact-redirect-access-denied-D7.patch4.22 KB

Revised patch that uses:

-  // Back to the requested users profile page.
-  $form_state['redirect'] = "user/$account->uid";
+  // Jump to home page or the user's profile rather than back to user's contact
+  // form to avoid contradictory messages if flood control has been activated.
+  $form_state['redirect'] = user_access('access user profiles') ? 'user/' . $account->uid : '';

Status: Needs review » Needs work

The last submitted patch failed testing.

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented

The fix part of this landed as a part of #601250: Allow anonymous users to use personal contact forms but should still have some tests written for it.

jacob.embree’s picture

jacob.embree commented
Assigned: dave reid » Unassigned
Issue summary: View changes
Status: Needs work » Needs review
StatusFileSize
new contact-redirect-access-denied-299216-8-D7.patch1.83 KB

Here's a reroll of the test.

Status: Needs review » Needs work

The last submitted patch, 8: contact-redirect-access-denied-299216-8-D7.patch, failed testing. View results

jacob.embree’s picture

jacob.embree commented
Status: Needs work » Needs review
StatusFileSize
new contact-redirect-access-denied-299216-10-D7.patch1.88 KB
new interdiff-299216-8-10.txt592 bytes

Status: Needs review » Closed (outdated)

Automatically closed because Drupal 7 security and bugfix support has ended as of 5 January 2025. If the issue verifiably applies to later versions, please reopen with details and update the version.