Having to check a site to read private messages can be a hassle. Likewise, many users may not want to get these messages in their email.

I suggest having an RSS Feed to a user's private messages, so that the user doesn't have to visit the site to check messages.

Comments

litwol’s picture

litwol commented
Version: 4.6.x-1.x-dev » 6.x-1.x-dev
Status: Active » Postponed (maintainer needs more info)

I personally like this feature, however it bears much security implications. for example sending out RSS about your _private_ messages may allow some one else to intercept it. but i guess we can limit rss notifications to subject only.

anyway, this feature needs some discussion to make sure we are not introducing a security hole if we decide to include it.

naheemsays’s picture

naheemsays commented

IMO "subject only" would be too much too - its the equivalent of allowing others to see your messages listing page.

Think of messages where the message is the subject. (body more or less saying "as above?").

litwol’s picture

litwol commented

what about some vague things like 'you received N new messages since your last RSS update. possibly include from whom? people that use budy system may benefit from things like 'you received 3 messages from your buddies and N messages from other people' :-p

fuzzy_texan’s picture

fuzzy_texan commented

The recent_changes module has dealt with the same problem. The result was either you have an unauthenticated feed and have these issues to do with security. Or you make it an authenticated RSS feed (via HTTP auth or Secure Site) which would solve all these problems.

Authenticated RSS feeds are definitely more complex, and increase the barrier to entry to using feeds (requires a feed reader that can handle authentication) but when you're dealing with something as sensitive as Private Messages, I think you have to do it that way.

References:
Recent changes module: http://drupal.org/project/issues/recent_changes
Issue regarding security and recent changes module: #226304: Access checking broken!
HTTP Auth module: http://drupal.org/project/issues/httpauth
Secure Site module: http://drupal.org/project/securesite

berdir’s picture

berdir
Primary language German
Location Switzerland
commented
Version: 6.x-1.x-dev » 6.x-2.x-dev
Status: Postponed (maintainer needs more info) » Active
oadaeh’s picture

oadaeh commented
Issue summary: View changes
Status: Active » Closed (won't fix)

This issue is being closed because it is against a branch for a version of Drupal that is no longer supported.
If you feel that this issue is still valid, feel free to re-open and update it (and any possible patch) to work with the 7.x-1.x branch (bug fixes only) or the 7.x-2.x branch.
Thank you.