Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.
Steps
1) Enable Write new private messages for auth users
2) Enable Write private messages to relationships for auth users
3) Set Requires Approval for UR
4) Set Only allow sending messages between confirmed relationships. and Only suggest confirmed relationships as message recipients
5) Log in as auth user1
6) Send a friend request to user2
7) Go to messages
8) Type in user2
9) fill in message and send - message created
Comment | File | Size | Author |
---|---|---|---|
#1 | user_relationships-privmsg_approved_test_only-1368666-1.patch | 6.03 KB | JvE |
#1 | user_relationships-privmsg_approved-1368666-1.patch | 7.01 KB | JvE |
Comments
Comment #1
JvE CreditAttribution: JvE commentedThe issue is that user_relationship_privatemsg_privatemsg_block_message() does not check if approval is required for a relationship.
I added test coverage for this issue to expose the flaw (patch #1).
And I added a fix for the issue (patch #2).
Comment #2
mike.roberts CreditAttribution: mike.roberts commentedThanks for this patch! I ran into this bug thinking it was our own privacy module that we've built that was allowing this to happen, but after setting up a vanilla drupal install and enabling these two modules, I noticed it was happening there as well. Testing this patch to see if it fixes the bug. Will report back.
Comment #3
mike.roberts CreditAttribution: mike.roberts commentedI guess I'm a little late on reporting back...
The patch fixed the issue on a regular Drupal install but unfortunately not on our project. But, it works for normal websites! So there's that.
Comment #4
DuaelFrThank you !
Comment #5
BerdirWow, a patch with tests *and* a test-only patch in the UR issue queue :p I must be dreaming :)
Nice work, commited and pushed!