The contact form of blocked users is still valid, but in general they can't sign on and thus can't disable their contact form.
I'd just change it

function _contact_user_tab_access($account) {
  global $user;
  if (!isset($account->contact) || empty($account->status)) { // here
    $account->contact = FALSE;
  }
  return
    $account && $user->uid &&
    (
      ($user->uid != $account->uid && $account->contact) ||
      user_access('administer users')
    );
}

So administers can still use the blocked users contact form.
Another way to do it

function _contact_user_tab_access($account) {
  global $user;
  if (!isset($account->contact) || (empty($account->status) && empty(variable_get('blocked_contact',0)))) { // here
    $account->contact = FALSE;
  }
  return
    $account && $user->uid &&
    (
      ($user->uid != $account->uid && $account->contact) ||
      user_access('administer users')
    );
}

with the blocked_contact being a setting somewhere to allow the current workflow, ie contact by anyone with contact permission of blocked user's profiles.

Also, this is also likely an issue with 7.x but I don't have a 7.x dev box or anything so can't see atm, thus I set it to 6.14. though.. http://api.drupal.org/api/function/_contact_personal_tab_access/7 . It's also not part of the last adding permission for personal contact form patch, ie. http://drupal.org/files/issues/58224.031.patch (http://drupal.org/node/58224).

I can make a patch but it'd be against 6-1.4.

Hope this isn't a duplicate issue; Searched 6.x&7.x for contact.module on words 'banned' and 'blocked'.

CommentFileSizeAuthor
#14 contact_blocked_users.patch1.86 KBbleen
#10 contact_blocked_users.patch1.85 KBbleen
#8 contact_blocked_users.patch1001 bytesbleen

Comments

hefox’s picture

hefox commented
Title: Contact forum for blocked users » Contact form for blocked users

Oops u.u;;;

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
Title: Contact form for blocked users » Users should not be able to contact blocked users
Version: 6.14 » 7.x-dev
Category: feature » bug

Seems valid, although users with admin permissions should still be able to contact them. Bumping to a bug report and adding to my D7 list to get fixed there first.

hefox’s picture

hefox commented

=)

(BTW, I have no idea if this has been fixed on d7 or if there's issues, but two related issues in d6
the contact forum enable checkbox on user_profile_form contains a link to user's contact forum despite not having access without 'administer users' to it, ie. $user->uid != $account->uid.
Default theme_username links to blocked user's accounts, despite general user's not having access to it; my guess is that may be fixed, since theme_username has changed greatly.).

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented

@hefox: That issue is being dealt with in #345541: Link to contact form in user account and e-mails leads to 403..

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented

Waiting for the cleanups to the access function in #525504: Anonymous user should not have contact form to land before this.

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
Issue tags: +Needs backport to D6, +Needs tests

Adding tags.

bleen’s picture

bleen commented
Status: Active » Needs review
StatusFileSize
new contact_blocked_users.patch1001 bytes

#525504: Anonymous user should not have contact form has landed ...

this patch should do the trick. Please to review

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented

Can we add a small test for this to make sure regular users cannot access blocked user contact form but 'administer users' can?

bleen’s picture

bleen commented
StatusFileSize
new contact_blocked_users.patch1.85 KB

same patch as #8 but with two new tests:

- admins can still contact blocked users
- normal folk cannot contact blocked users

Tests are not my forte, so please give them an extra glance

dries’s picture

dries commented

Not sure this is valid. I can easily think of a use case where it would be good if blocked users could still be contacted.

bleen’s picture

bleen commented

@Dries: by non-admins?

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
Status: Needs review » Needs work 
+++ modules/contact/contact.test	13 Jan 2010 02:45:38 -0000
@@ -347,6 +347,20 @@ class ContactPersonalTestCase extends Dr
+    $this->contact_user = $this->drupalCreateUser();
+    $this->contact_user->status = 0;

I don't think this would actually persist? I think we would need to use user_save().

+++ modules/contact/contact.test	13 Jan 2010 02:45:38 -0000
@@ -347,6 +347,20 @@ class ContactPersonalTestCase extends Dr
+    $this->drupalLogin($this->admin_user);

$this->admin_user is already logged in, so we shouldn't need to re-login. Helps saves a step for tests.

Powered by Dreditor.

bleen’s picture

bleen commented
Status: Needs work » Needs review
StatusFileSize
new contact_blocked_users.patch1.86 KB

how's about this

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
Status: Needs review » Reviewed & tested by the community

Looks good, tested locally, and the bot likes. As expected, admin users can still contact blocked users, so it's a good fix.

webchick’s picture

webchick
she/they
Primary language English
Location Vancouver 🇨🇦
commented
Status: Reviewed & tested by the community » Fixed

Great, committed to HEAD!

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.