I just noticed that I can read another users messages after they've been clicked on, by going through the "recent hits" in the logs.

I'm not sure if this is supposed to be there, but I see it as an issue, because its no longer "private" messages. Any user thats able to see the logs, can read anyone's privatemsg's.. most of the time, its the admin users that are allowed to read the logs/statistics, but its a bit unnerving knowing these aren't fully private (sure you can read the sql tables, but this is way easier to access by someone that isn't a server admin).

this is also on privatemsg 5.x.2.x-dev which I thought might be fixed in 3.0.

Comments

litwol’s picture

Component: Miscellaneous » Code
Category: support » task
Priority: Normal » Critical
litwol’s picture

Status: Active » Closed (won't fix)

Drupal 5 private message branch is no longer actively maintained (in fact it is actively unmaintained). Please upgrade to drupal 6 which is supported (and will continue to be supported).