Feeling Lucky
No Code Attached Yet
[#29548] - [4.0] Manager User cannot select users to private message
- Closed
- 24 Feb 2022
- Medium
- Build: master
- # 29548
Steps to reproduce the issue
Configure Joomla 4 permissions to Messaging to ALLOW everything for Manager user eg:
Login as a manager user
Navigate in the left menu to Private Messaging
Click New to compose a message
Expected result
Ability to select a recipient
Actual result
No ability to select a recipient
joomla-cms-bot
- | Labels |
Added:
?
|
||
Quy
- | Status | New | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2022-02-24 15:07:45 |
| Closed_By | ⇒ | Quy | |
| Labels |
Added:
No Code Attached Yet
Removed: ? |
||
So what #29545 teaches is that, not being able to select users is the correct thing here, however it makes no sense that a user with access to com_messages but no access to com_users should even be able to get to this screen at all.
Therefore the solution to this issue is for an ACL check to be made on this page, to block writing of a message and a ACL check on send to check to prevent #29558 but at the same time allowing the viewing of messages (because that's what allowing com_messages and denying com_users allows users to do, just read, not send)