reply to messages from deleted users lead to "access denied" page

[Crimson]

Username: crimson

I received this email from a spam message:

You have been sent a notification from Mahara ePortfolio System. Message
follows:
------------------------------------------------------------------------

Subject: New message from nancy wilson

nancy wilson has sent you a message. To view this message, visit

http://mahara.org/user/sendmessage.php?id=6530&replyto=879010

...

The issue is that link doesn't work - it gives me access denied:

"Access Denied
You do not have access to view this page

You cannot send this user a message"

Also, navigating to http://mahara.org/account/activity/ then clicking on "New message from nancy wilson" then "More...' (same link as above) gives the same issue.

[Richard Mansfield (richard-mansfield)]

The link doesn't work because the user was deleted and you can't send a reply to a deleted user. I guess the solution is to provide a page for reading messages that's independent of the reply page.

[Sean Brennan (the-ioniser)]

I think that if a user deletes their account they probably don't want any messages regardless.
If an admin has deleted their account, there could be many reasons. but I still don't think the user deserves to receive messages through mahara.

I think a simple rewording of the error message to justify this would be sufficient.
Opinions?

[Crimson (ben-crimson)]

Agreed. The important thing from my perspective is to know what has happened to the message. Without an explanation it looks like a permissions issue, which isn't the case.

[Kristina Hoeppner (kris-hoeppner)]

Agreed as well. I think a special error message like below would be good:

You cannot access this message because the user was either suspended or the user account does not exist anymore.

[Sean Brennan (the-ioniser)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Suspended users can still receive messages.
so the message will simply be.

You cannot access this message because the user account does not exist
anymore.

On 02/02/11 19:01, Kristina Hoeppner wrote:
> Agreed as well. I think a special error message like below would be
> good:
>
> You cannot access this message because the user was either suspended or
> the user account does not exist anymore.
>

- --
Regards,
Sean Brennan

<email address hidden>
Cell:0274729712
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJNScLYAAoJEBacL8dH3zIGjJEP/RUfby+ciGUXkxATYpBSkJRa
87/6yIP36j5JBrTB3uJB4w2GkgargJ0seWvwgWjh7a5bL02tpHkIfiSrmlJKFNbS
WRpxsNXCv9zR+nLN25dcEfATHo2WmnK2s2FBZord8Q1DYpryj10BBAc+lPMwCtsJ
utaQEZboBKI5moadKpqLXl6rK7pLSSibKN+UHnXa1p4x9yV5lQMAxWZmOfOuGXwh
DEkyjXwBG247AgUzvh2C94l0d1cu1qS2jAlUt1M6mqK4PBddILi3LBVKoHj3rgEP
ue96C0dqI5c7u8P9TJwaoeDUdm61E/j9c1ScRkBGkt92WdoI5ajTgRsxN037E16K
THjf2OSUWew+S4WzeEk5h5TqoyeOUI820Jxsv3l0ayNIfgfD7Bbb3aRFfHubksLK
XtmGurhDYff4ecP7v4+uiZj9zbGsVWEYiaEupXDSsEEAN+FLkki/q92SL3oHGMNY
xM0ZPa5GVs8Kxd9jeb9G6XZJuys3Ih10WBVJOx0FJGZrTEUAEP4c63Zd6VzcftNh
ODCmvrk/DwGFqV5oTTk2wi6pcPvEizZdE3igcy06cAoGIIXWMQHERjdrtm6FQPfP
3R1SCpwFciAB9d6iq69SjRnWJDBhU+J+KRCXdH3LEGJvHCf7aGdLKg5j1RmpAfBW
YiFMAvXRHddtDG41mog/
=Fbl3
-----END PGP SIGNATURE-----

[Sean Brennan (the-ioniser)]

fix committed on
http://www.gitorious.org/~ioniser/mahara/ionisers-mahara/commits/lp503598-deleted-users-to-access-denied

sorry about the spam email before. Ill strip out all the mess next time.

[Richard Mansfield (richard-mansfield)]

Sean,

That patch isn't quite right. If you look at where the string 'cantmessageuser' is used, you'll see that the same string gets displayed when you can't send a message to a user for any reason.

The user might still exist, but may have set their message preference on the settings page to turn all messages off or to only allow messages from friends.

[Sean Brennan (the-ioniser)]

revised commit
http://www.gitorious.org/~ioniser/mahara/ionisers-mahara/commits/lp503598-deleted-users-to-access-denied_revised

[Richard Mansfield (richard-mansfield)]

Sean, much better!

You should throw a UserNotFoundException rather than access denied in the case where the user doesn't exist, and just say the user was not found, or maybe the user doesn't exist, rather than doesn't exist *anymore*, because we don't really know whether they ever existed. Though if you really wanted to make that distinction, you could check the deleted column.

Also in the other case, you've added "they have requested to not recieve emails", but I don't think we shouldn't say 'email' there because we also don't know whether their notification preference is email or internal, you just can't send them a message at all.

[Sean Brennan (the-ioniser)]

I have revised this patch as to the suggestions.

[Hugh Davenport (hugh-davenport)]

https://reviews.mahara.org/866

[Mahara Bot (dev-mahara)]

Reviewed: https://reviews.mahara.org/866
Committed: http://gitorious.org/mahara/mahara/commit/1481257e1a3fa181033a92f98f0ea942c074c640
Submitter: Richard Mansfield (<email address hidden>)
Branch: master

commit 1481257e1a3fa181033a92f98f0ea942c074c640
Author: Hugh Davenport <email address hidden>
Date: Wed Nov 16 15:46:34 2011 +1300

    Show an error when user tries to send a message to a deleted user

    Bug #503598

    Change-Id: Ic003295a1c13b96fbda30af13305b565faf2fb16
    Signed-off-by: Hugh Davenport <email address hidden>