Please upgrade here. These earlier versions are no longer being updated and have security issues.

Bug in user permissions new conversations

steamsteam www.planamigo.org - #1 foro planes amigo
edited September 2016 in Vanilla 2.0 - 2.8

Hi,

I have Unconfirmed user rol. Users must confirm their emails before becoming full members.
On admin Dashboard this rol doesn't have Conversations checked.

Unconfirmed user can see "Message" boton in other members profile and when it clicking has page not found.

I think this boton user doesn't have to see like doesn't see boton add discussion.

Is there event something like MessagesController Before Add Handler ? To control shown form to Unconfirmed user

Comments

  • RiverRiver MVP
    edited September 2016

    @steam said:
    Hi,

    I have Unconfirmed user rol. Users must confirm their emails before becoming full members.
    On admin Dashboard this rol doesn't have Conversations checked.

    Unconfirmed user can see "Message" boton in other members profile and when it clicking has page not found.

    I think this boton user doesn't have to see like doesn't see boton add discussion.

    it has been fixed in the master regarding the display of button,

    https://github.com/vanilla/vanilla/blob/master/applications/conversations/settings/class.hooks.php#L102

    was:
    if (!$Sender->EditMode && Gdn::session()->isValid() && Gdn::session()->UserID != $Sender->User->UserID) {

    should be:

    if (!$Sender->EditMode &&
     Gdn::session()->UserID != $Sender->User->UserID &&
     Gdn::session()->checkPermission('Conversations.Add')
     ) {
    

    Pragmatism is all I have to offer. Avoiding the sidelines and providing centerline pro-tips.

    steam
Sign In or Register to comment.