Hoping some advanced MOD coder can give clues on this

[outofsync]

Hi there,

I'm having a problem which is puzzling me: The email icon of users is shown to guests and to new registered users in my board (the PM icon is hidden to them -as it should be- but the email is shown to everybody, guests and new registered users included). My board is configured to use the "direct" email method (ie: email not through the board, but with actual email addresses).

I'm posting this question here, hoping that some advanced coder with phpBB3 internals knowledge could give me some clue on what might be the reasons for this behaviour. The only manual editing I did in the board was in ucp_profile_profile_info.html, in order to hide MSN, Yim, Location, Ocuppation, and other profile fields that we don't want to have in our board, but I tested it removing the "commenting out" that I had performed, and it doesn't fix the problem. Also, I installed AutoMOD and "Group on Registration and Custom Profile Fields".

You can read the support thread I had with Steve. He helped me a lot, but, we weren't able to suspect what could be the culprit of this behaviour:

http://www.phpbb.com/community/viewtopi ... &t=2100636

Please, if you have some clue on what might be causing this, tell me.

[outofsync]

One more thing, if it helps:

If I enable "users send e-mail via board" in email settings, the email icon is still shown to guests and newly registered users, but however, it they click on it, they are told they don't have permission to send email. So, permissions are set correctly... where could be the cause for the email icon being shown to them?

[RMcGirr83]

In viewtopic.php (I am assuming you are talking about when you view a topic). The icon displays no matter the permissions of the user

on or about line 1149

Code: Select all

			if (!empty($row['user_allow_viewemail']) || $auth->acl_get('a_email'))
			{
				$user_cache[$poster_id]['email'] = ($config['board_email_form'] && $config['email_enable']) ? append_sid("{$phpbb_root_path}memberlist.$phpEx", "mode=email&u=$poster_id") : (($config['board_hide_emails'] && !$auth->acl_get('a_email')) ? '' : 'mailto:' . $row['user_email']);
			}

so if a user has an email address, then it will show. You can try to change this line

Code: Select all

if (!empty($row['user_allow_viewemail']) || $auth->acl_get('a_email'))

to this

Code: Select all

			if ($user->data['user_id'] != ANONYMOUS && (!empty($row['user_allow_viewemail']) || $auth->acl_get('a_email')))

then the icon shouldn't display to guests.

[outofsync]

Thanks a lot!! I thought my installation was broken, so I'm happy that's not the case

Btw, is it possible to check if the current user can send email instead of checking if it's the anonymous user? If that's possible, then this modification will also hide the email icon for newly registered users on my board.

[RMcGirr83]

change it to this

Code: Select all

if ((!empty($row['user_allow_viewemail']) && $auth->acl_get('u_sendemail')) || $auth->acl_get('a_email'))

which will then check to see if the user (any user) has the permission set to send emails.

[outofsync]

change it to this

Code: Select all

if ((!empty($row['user_allow_viewemail']) && $auth->acl_get('u_sendemail')) || $auth->acl_get('a_email'))

which will then check to see if the user (any user) has the permission set to send emails.

It works great. Thanks a lot!!

I suggest that this should be the default behaviour in phpBB3, because otherwise there's a security hole: Users that are not allowed to send email can see the email addresses of other users by placing the mouse pointer over the email icon. If the user is not allowed to send email, then the email icon shouldn't appear.

Thanks a lot RMcGirr83!!!

[RMcGirr83]

You're very welcome. The same sort of thing occurs when viewing a members profile so if you want to hide it there as well

OPEN

memberlist.php

FIND (on or about line 1610)

Code: Select all

	if (!empty($data['user_allow_viewemail']) || $auth->acl_get('a_user'))

and change it to this

Code: Select all

	if ((!empty($data['user_allow_viewemail']) && $auth->acl_get('u_sendemail')) || $auth->acl_get('a_user'))

[outofsync]

Done. Works great. If this issue could be of interest to the phpBB dev team, please tell me how to tell them.

[RMcGirr83]

http://tracker.phpbb.com/browse/PHPBB3