I might be missing something here but here is my problem:

I want private messages to be visible only to the participants of a specific conversation. For example, if userA sends a message to userB, I want only the 2 of them to be able to see the conversation. In the permissions of the module, there is a permission called: "read all private messages". Here is my problem:

- When this permission is disabled for my authenticated users, the /user/me/messages path returns an error: "You are not authorized to access this page."
- When this permission is enabled for the authenticated users, the /user/me/messages path returns the proper page but users can also see other users' private messages.

Am I missing something really obvious here?

Comments

FortEZ’s picture

FortEZ commented
Status: Active » Closed (fixed)

Resolved. The /user/me/messages path was the wrong approach. The /messages path works properly.

berdir’s picture

berdir
Primary language German
Location Switzerland
commented

Yes, user/%user/messages is actually only for reading messages of other users. However, we're still discussing how to improve usability of that issue, please read and comment on #832716: "Write new message" link doesn't appear at /user/[uid]/messages.

Also, #561036: Conflicting URL scheme would allow to change /messages to something else, including something below /user/%user. However, I'm not yet sure if I want to commit that patch since it increases complexity and has various technical issues.

PS: Oh, and when "closing" an issue, it is common to mark it as fixed instead of closed. Then it remains visible for ~2 weeks and is then automatically closed.

FortEZ’s picture

FortEZ commented
Status: Closed (fixed) » Fixed

Thanks a lot for the info

fixed :)

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.