I have user A and B, user A blocked user B. user B tries to send message to both 'user B and user A'. since user A is blocking user B, user B should not be able to send messages to user A. however since user B is sending a partially valid message (by including himself in the recepients list), he somehow bypass user block validation and ends up sending message to user A.

marking as critical :((

CommentFileSizeAuthor
#3 privatemsg.block_fix.patch1.68 KBberdir

Comments

litwol’s picture

litwol commented
Version: » 6.x-1.x-dev
berdir’s picture

berdir
Primary language German
Location Switzerland
commented
Status: Active » Closed (duplicate)

$message was not passed by reference to _privatemsg_validate_message, so $message still contained all recipients after the call. Fixed that in #375999: #288183 followup: Developer friendlify privatemsg_new_thread API. as it is tightly related to the other changes.

berdir’s picture

berdir
Primary language German
Location Switzerland
commented
Status: Closed (duplicate) » Needs review
StatusFileSize
new privatemsg.block_fix.patch1.68 KB

#375999: #288183 followup: Developer friendlify privatemsg_new_thread API. will take longer than I first thought, here is a very simple patch that should fix the user blocking thing.

- pass $message by reference to _privatemsg_validate_message()
- only print allowed recipients after the message has been sent

litwol’s picture

litwol commented
Status: Needs review » Fixed

changes @recipients to !recipients to prevent t() render it in plain_check()

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.