Messaging settings on user account page even with no permission / access [#967420]

I'm pretty sure this is a bug... :)

I've only given a particular role on a site any permissions for the Messaging or Notifications modules (eg administer notifications, manage own subscriptions), but when logged in with an account that only has the "authenticated" role it still shows the "Messaging settings" fieldset in the user account editing form.

This is a problem for me as at the moment only administrators of the site (which have their own "admin" role) should be able to do anything with the Messaging module.

It looks changing messaging.module line 125 from
if ($category == 'account' && ($list = messaging_method_list($user))) {
to
if ($category == 'account' && ($list = messaging_method_list($user)) && user_access("maintain own subscriptions")) {
is the fix.

I'll submit a patch if this is in fact a bug and this is the right solution.

Comment	File	Size	Author
#5	messaging-manage-own-send-method-967420-5.patch	1.28 KB	JoeMcGuire

Comments

Comment #1

jdln commented 24 November 2010 at 11:53

I have the same issue. Can someone confirm the change to the messaging.module is the way to go?
Thanks

Comment #2

jeni_dc commented 5 February 2011 at 19:54

I agree that the suggested modifications above would be a good idea. I ended up using http://drupal.org/project/formfilter to get rid of the fieldset instead of modifying the module. Kind of a heavy handed approach, though, that adds it's own set of issues.