Make "Messages" Tab on own user pages available for users and "admins" with "read all messages" permission

Thanks, works great! I didn't apply the patch as I don't know how to do it but I copied the changes manually.

So - what's the status of this? At the moment my users can't read their messages because I can't display the messages Tab without them also being able to read everyone's messages - which is obviously way too open. How do I get Private messages to work properly?

Versions:
Drupal core: 7.19
Private messages: 7.x-1.3

as a work around, i created a custom "Messages" tab on the user/* page (Views or template.php) and redirected the custom URL to /messages (.htaccess or redirection module). Not ideal, but good until this gets hopefully fixed.

#1: user-message-tab-1772236-2.patch queued for re-testing.

Potentially related issue: http://drupal.org/node/1217280

The tests check out now, which is good. However, I think that if such functionality is going to be added to the module that there need to be simpletests added as part of the patch to ensure that users cannot read others' messages, etc.

@rsmylski Yes, I understand that there are checks in various places in the module, but the test file also needs to be modified to test against these new changes. If we add a new way (access callback) to access messages, we need to make sure that not just now but in the future permissions are enforced properly, and adding tests is one way to do that.

Re-roll #1 against 2.x-dev (since that is the new features branch) with preliminary tests. I'm not sure if hard-coding UIDs violates a best practice with respect to the tests, but it's a start anyway.

Additional related issues (both have patches that are not as far along):
https://drupal.org/node/1217280
https://drupal.org/node/1443172

#14: privatemsg-user-message-tab-1772236-13.patch queued for re-testing.

Re-roll for latest dev

Closed #1217280: Can't Change Privatemsg path in Admin settings anymore and #1443172: View own messages in 'user/%/messages as duplicates.

As is, this patch is suitable for admins to quickly check which private messages a user has sent, but the links (Inbox, Sent Messages) are not printed, so it is a poor interface for regular users.

Which is what I've been saying all along, yes :)

And which is why the initial patches in #1443172: View own messages in 'user/%/messages did not duplicate the interface, they simply redirect to /messages, which is a change that I was ok with. I'd suggest to invert the closed status and continue with #1443172-13: View own messages in 'user/%/messages

Ignore message in error

fixed typos

As per #22, closing this thread and re-opening #1772236: Make "Messages" Tab on own user pages available for users and "admins" with "read all messages" permission. I'm sorry I missed the previous comments.

Note that if "me aliases" module is enabled, then the $account_id value passed into the access callback is "me", rather than the account id. This causes the path /user/me/messages to fail with patch #19 applied.

I'm working on a patch for this.

See attached patch re #26.

A quick review for the function privatmsg_tab_access

+++ b/privatemsg.module
@@ -316,6 +316,34 @@ function privatemsg_menu_local_tasks_alter(&$data, $router_item, $root_path) {
+  if (!user_access('read privatemsg', $user)) {

Why add the $user variable

+++ b/privatemsg.module
@@ -316,6 +316,34 @@ function privatemsg_menu_local_tasks_alter(&$data, $router_item, $root_path) {
+function privatemsg_tab_access($account_id){
+  global $user;
+  if (!$user->uid){
+    // Disallow anonymous access, regardless of permissions
+    return FALSE;
+  } ¶
+
+  if (!user_access('read privatemsg', $user)) {
+    // Disallow access, if permission to read messages is not given
+    return FALSE;
+  }
+  ¶
+  if (($user->uid == $account_id) || ($account_id == 'me') || user_access('read all private messages')) {
+    // Allow access if user wants to access own messages page OR user has ¶
+    // permission to read all messages
+    return TRUE;
+  }
+  else {
+    return FALSE;
+  };
+}
+

Where do you check if the user is the admin user or has administer permission.

If a user has the permission "read all messages" that must imply that the user has the permission "read privatemsg".

Closing per #22 and #24