Private Message System (Page 5 of 14)

Hmmm... fixed it anawayz :
file: /message_send.php
line: 186

// Add subject
//$subject = "RE: " . $message['subject'];
//modified by Rasmus Anthin:
$subject = $message['subject'];
if(strncmp($subject, "RE: ", 4))
    $subject = "RE: " . $subject;

worx fine too.

I've found a security issue with this mod that allows users to read every PM (if they know what they are doing!)

I'm sure it shouldn't be too hard to fix but will contact Chacmool.
You might want to consider disabling this mod if PM privacy is important on your board.

No, this is on an unmodified install of the pm system.
I've emailed Chacmool about it.

Oh, thanks alot! I've made the changes in the code and put a new version here.
Download the file and replace message_list.php OR change it manually:

In message_list.php find:

    // Set user
    $result = $db->query('SELECT status FROM '.$db->prefix.'messages WHERE id='.$id) or error('Unable to get message status', __FILE__, __LINE__, $db->error());
    list($status) = $db->fetch_row($result);
    $status == 0 ? $where = 'u.id=m.sender_id' : $where = 'u.id=m.owner';

    $result = $db->query('SELECT m.id AS mid,m.subject,m.sender_ip,m.message,m.smileys,m.posted,m.showed,u.id,username,registered,email,title,url,icq,msn,aim,yahoo,location,use_avatar,email_setting,num_posts FROM '.$db->prefix.'messages AS m,'.$db->prefix.'users AS u WHERE '.$where.' AND m.id='.$id) or error('Unable to fetch message and user info', __FILE__, __LINE__, $db->error());
    $cur_post = $db->fetch_assoc($result);
    
    if ($cur_post['showed'] == 0){
        $db->query('UPDATE '.$db->prefix.'messages SET showed=1 WHERE id='.$id) or error('Unable to update message info', __FILE__, __LINE__, $db->error());
    }

Change to:

    // Set user
    $result = $db->query('SELECT status,owner FROM '.$db->prefix.'messages WHERE id='.$id) or error('Unable to get message status', __FILE__, __LINE__, $db->error());
    list($status, $owner) = $db->fetch_row($result);
    $status == 0 ? $where = 'u.id=m.sender_id' : $where = 'u.id=m.owner';

    $result = $db->query('SELECT m.id AS mid,m.subject,m.sender_ip,m.message,m.smileys,m.posted,m.showed,u.id,username,registered,email,title,url,icq,msn,aim,yahoo,location,use_avatar,email_setting,num_posts FROM '.$db->prefix.'messages AS m,'.$db->prefix.'users AS u WHERE '.$where.' AND m.id='.$id) or error('Unable to fetch message and user info', __FILE__, __LINE__, $db->error());
    $cur_post = $db->fetch_assoc($result);

    if ($owner != $cur_user['id'])
        message($lang_common['No permission']);

    if ($cur_post['showed'] == 0){
        $db->query('UPDATE '.$db->prefix.'messages SET showed=1 WHERE id='.$id) or error('Unable to update message info', __FILE__, __LINE__, $db->error());
    }

Chacmool -

The change listed above is for V1.07 of your mod - what changes were made in the package for V1.06?  I set up a forum back in late April and installed this mod, so I'm assuming that I installed V1.05.

Just need to know what the changes were for V1.06 so that I can make them manually along with the change listed above.

(I read your Changelog with the V1.07 package, but it goes from 4/18 to 6/21, so I wasn't able to see what was changed for sure in V1.06.)

i installed your mod by your instructions and i get this error when i try to load the forums now. any ideas? if you need more info please keep in mind that i'm not a coder and will only be able to give you as much info as i know/can.

i did but all i got was a blank page, is this supposed to happen? thanks for the speedy reply.

EDIT: i got it mostly working now... i will report back ina couple minutes with a screenshot or 2 of my new issue.

update: all fixed! i had these files:

   admin_options.php       
   functions_navlinks.php 
   header_new_messages.php
   profile_delete.php     
   profile_quicksend.php   
   viewtopic_PM-link.php   

in their own folder and not in the /include folder.

so far everything works. thanks for the cool mod.

i just noticed why i had them in their own folder, your instructions appear to want them in their own folder:

i had to put them just in the /include folder for it to work(and it works fine now). so just a heads up.

Private_Message_System-v1.0.7

i can show you a shot of the folder if you'd like...

Chacmool!

if ($owner != $cur_user['id'])
        message($lang_common['No permission']);

if you add above code to message_list.php, you cannot read even your own message! need not to be added.