Kevin Clark wrote:Pony99CA wrote:Yes, but the point was that you could view PMs for a user without database access
Except that you said
Pony99CA wrote:Resetting the password will be more difficult. You would have to have database access
I'm aware of what I said. I added that for completeness in case anybody wondered how you would restore the password. The main point was still that an admin could view a user's PMs without database access.
Kevin Clark wrote:Yes it's easy to change someone elses password and log in as them but ultimately it's not much use to you.
Who knows how much use it is? The original poster didn't say
why they wanted to know whether it was possible to view others' PMs. Maybe I'm an admin of a stock trading forum where a user has a good record in the market, so I think looking at that user's PMs would give me an advantage.
I was just pointing out that it
could be done (and without database access if the admin is willing to send an E-mail to the user whose PMs he checked; heck, the admin could just do nothing and let the user think he'd forgotten the password and force him to use the password reset feature). I'm not sure why you're being so dismissive of the point, especially as nobody had raised it here.
Kevin Clark wrote:Kevin Clark wrote:Pony99CA wrote:By the way, why isn't there an option in Quick Tools to delete all PMs for a user? I assume deleting a user also deletes his PMs, but what if you just want to delete the PMs without resorting to SQL across two tables (phpbb_privmsgs and phpbb_privmsgs_to)?
Why would you need to delete someone else's PMs?
Maybe somebody is cleaning up space used by inactive users. If somebody hasn't logged in for a few years, they probably don't need their PMs. You might not want to delete the user, but they could have a full PM box.
Or, as TptMike suggested, what if somebody was advertising? Yes, you could put them in a group with no PM ability, but that wouldn't delete all of the advertising PMs in the boxes.
Steve