Email message rights bug

[jortb]

Hello Admidio people, I would like to report a bug.

We want a member administration for our sports club and Admidio seems very nice. We try to setup the system such that only the board members and webmasters have all the rights. We have four sports in our Martial art club and we want for instance the Jiu Jitsu commissioner only be able to mail or see the mail adresses of the members who do Jiu Jitsu.

This works quite well with the Message-Email module, you cannot mail all 'members' but you can mail Jiu Jitsu (picture 1). However you always seem to be able to mail all individual members and see their mail adresses, we cannot have this (picture 2). Are there plans to fix this issue?

[weissst]

Hello jortb,

i'm on this topic and I hope i can fix it within the next 2 weeks... so it will be in the next version of Admidio.

br
Stefan

[weissst]

Hello,

I made some changes in the script... can you maybe exchange the attached file in your installation and give me a short feedback if the problem is solved.

br
Stefan

messages_write.zip

(6.2 KiB) 474-mal heruntergeladen

[jortb]

Not it's still bugged.

The User 'Sportco' in our case should only be able to mail members of 'Jiu Jitsu' and not all 'active members'. But somehow you are ALWAYS able to mail active members, which is bad for us.

Somehow you can always send email to individual active members of alle roles you are in. Eventhough I set the settings of members to "Nobody can email this group"\

edit: It's even worse, you can always mail EVERYONE in this menu, even if you do not share a group. The top part seems to be fine, but the 'Active members' is just a big loop hole in the options to limit users to see each others email adress/ send email.

[jortb]

This part somehow is broken, it always seems to show ALL active users... somehow it doesn't seem to show the former users though when not allowed...? But for the webmaster user it is also broken because some Active users show up in the former group.

line 409:

while ($row = $gDb->fetch_array($result))
{
if ($row['mem_active'] > 0)
{
$active_list[]= array($row['usr_id'], $row['last_name'].' '.$row['first_name']. ' ('.$row['email'].' )', $gL10n->get('LST_ACTIVE_MEMBERS'));
}
elseif ($gPreferences['mail_show_former'] == 1)
{
$passive_list[]= array($row['usr_id'], $row['last_name'].' '.$row['first_name']. ' ('.$row['email'].')', $gL10n->get('LST_FORMER_MEMBERS'));
}
}

$list = array_merge($list, $active_list, $passive_list);

I removed the last 'array_merge' command, to remove the bug. But I can imagine it can be a useful feature, it needs some limitations.

[weissst]

Hello jortb,

the lines you write about are changed in the file i attached in my last post...
so please try this file in your installation and check if it is better.

br
Stefan

[jortb]

I copied the file and it was still broken.