mahara-contributors team mailing list archive

[Richard Mansfield <503598@xxxxxxxxxxxxxxxxxx>]

Sean, much better!

You should throw a UserNotFoundException rather than access denied in
the case where the user doesn't exist, and just say the user was not
found, or maybe the user doesn't exist, rather than doesn't exist
*anymore*, because we don't really know whether they ever existed.
Though if you really wanted to make that distinction, you could check
the deleted column.

Also in the other case, you've added "they have requested to not recieve
emails", but I don't think we shouldn't say 'email' there because we
also don't know whether their notification preference is email or
internal, you just can't send them a message at all.

-- 
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
https://bugs.launchpad.net/bugs/503598

Title:
  reply to messages from deleted users lead to "access denied" page

Status in Mahara ePortfolio:
  Confirmed

Bug description:
  Username: crimson

  I received this email from a spam message:

  You have been sent a notification from Mahara ePortfolio System. Message
  follows:
  ------------------------------------------------------------------------

  Subject: New message from nancy wilson

  nancy wilson has sent you a message.  To view this message, visit

  http://mahara.org/user/sendmessage.php?id=6530&replyto=879010

  ...

  The issue is that link doesn't work - it gives me access denied:

  "Access Denied
  You do not have access to view this page

  You cannot send this user a message"

  
  Also, navigating to http://mahara.org/account/activity/ then clicking on "New message from nancy wilson" then "More...' (same link as above) gives the same issue.