Message Subjects that the user has no permissions to see are in the TItle of the view page. [#2020323]

Permissions are:
"Read private messages" for authenticated users and admins.
"Read all private messages" for admins only

As an admin I sent a private message to user Lisa (Auth-only user) with the Subject "Hi Lisa from Admin".
That message was then viewable by both the admin and Lisa at http://testing/messages/view/6
This is great. However. I logged out completely then logged back in as RandomJoe (Auth-only user), then when I went to http://testing/messages/view/6 , I could not see the message (which is good), however IN THE TITLE was "Hi Lisa from Admin".
RandomJoe does not have permission to see any part of a private message between admin and Lisa.

Clearing the cache "fixes" it, only for the problem to re-emerge the next time a message is created. So maybe the title is being generated from a cache that is accessible to all auth users?

Comment	File	Size	Author
#4	privatemsg_title_display.png	204.89 KB	work77
#1	2020323-simpletest.patch	1.81 KB	ptmkenny
#1

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

ptmkenny CreditAttribution: ptmkenny commented 15 June 2013 at 15:14

Version:

7.x-1.3

» 7.x-1.x-dev

File	Size
2020323-simpletest.patch	1.81 KB

I wrote some tests for this but I was unable to reproduce the behavior on my machine. Test patch attached.

Comment #2

ptmkenny CreditAttribution: ptmkenny commented 15 June 2013 at 15:14

Status:

Active

» Needs review

Comment #3

ptmkenny CreditAttribution: ptmkenny commented 15 June 2013 at 15:38

Status:

Needs review

» Active

Do you have any caching (Varnish, Drupal page caching, etc.) enabled? I have been unable to reproduce this in my local dev environment (MAMP) and the Simpletest passes as well.

Comment #4

work77 CreditAttribution: work77 commented 15 June 2013 at 21:50

File	Size
privatemsg_title_display.png	204.89 KB

I just checked again with a fresh installation, and it's still doing it. Just to add a little info. I'm running the Drupal Commons distro. Not sure if that makes a difference. In this screenshot, you can see that Access is Denied to this user, yet the Firefox tab shows the subject, "To Lisa from Admin". I haven't done any troubleshooting beyond that. As for caching, all I know is nothing under "Caching" at q=admin/config/development/performance appears to be enabled. (nothing is checked)

http://postimg.org/image/415u59gh9/