Adding permission checks to determine if user can alter messages or post comments

Well, there are two different issues here:
- The 'reply to message' for users without comments rights, yeah, that permission checking is missing in mail2web.
- The ability to post comments when users are not authorized. We are submitting stuff through mailhandler, so this should be the module checking permissions for it. Are we using latest mailhandler version? (it got some security fixes recently)

So we should be definitely fixing the first one, and look into mailhandler integration for the second, that may need some fixes on our side too.

About the patch, it has an important flaw, I don't think it will work: It checks permissions against the current logged in user, but it *should check permissions against the user account receiving/sending the email*, so it needs to pass the $account parameter around for permission checking.

Moreover, we should make some distinction between 'post comments', and 'post comments without approval' permissions, so we set the comment status acordingly.

I think this issue is important, so I've raised priority to critical.

Jose ad Darren thanks for the work on the D6 port and the work on this patch.

I finally got around to testing notifications/messaging/mailhandler and Mail 2 Web is next. So when ya'll are ready I can help test it.

R,
Coby

Two parts to this that I see:

Outbound
This patch is for the hook_message_alter which will be for output - outbound emails. I would like to be able to choose which content types get M2W applied. I guess that would be a separate feature request and do not want to hijack this from darren. But implementing this idea could also include permission checks.

Inbound
I am learning the Drupal API, so this could be way off base: I just found out that I can add "status: COMMENT_PUBLISHED" to the default commands in the M2W mailhandler mailbox settings and force comments to be published without moderation. That is because the status for comments has a different context than status for a node, which might be boolean? Can't remember. Anyway, I need to look at the code in mailhandler but there might need to be some tweaks to allow for an admin to set this in the UI and then code to support permission checks on inbound as well.

Thoughts?

R,
Coby

Hi Darren and Coby,

Coby - based on your breakdown of the problem, I've just tested inbound for Drupal 5 and Drupal 6 using the latest mailhandler stable releases, and it seems to handle all cases. All cases includes posting w/o approval, posting but w/ moderation, and no posting.

It seems that we just need to handle outbound and making sure the delimiter line "Reply ABOVE this LINE..." is only added to messages that are sent to people who have the ability to post comments. I am going to take a look at this now.

thanks
Ian

Hi Darren and Coby,

I've committed a smaller fix for this, and all it does is checks whether the user has 'post comments' permission. I tested and in Drupal if you do not have 'post comments' permission, but you do have 'administer comments' or 'post comments without approval' you still cannot post comments. It seems you must have the 'post comments' permission. Therefore, I only check for this, and do so inline in the message_alter hook. I figure if you get a notification, then you must have access to that content. Of course, there are ways to get around this, but I think that points out an issue further up in the chain. Let me know if there are further issues or if I am overlooking something w/ this simplified approach.

This will appear in the next release in a few days for 5.x and 6.x.

thanks, and thanks for the patch/testing.

Ian

Switch to mailcomment project. Mail2web is now known as "mailcomment" due to a trademark issue with the name mail2web.