MyBB Community Forums

Current code in functions_post.php.

Quote:        if($mybb->settings['enablepms'] == 1 && (($post['receivepms'] != 0 && $usergroup['canusepms'] != 0 && $mybb->usergroup['cansendpms'] == 1 && my_strpos(",".$post['ignorelist'].",", ",".$mybb->user['uid'].",") === false) || $mybb->usergroup['canoverridepm'] == 1))

Grabs the $usergroup['canusepm'] in order to show the PM button.  However that is previously set by display group.

    // Get the usergroup
    if($post['userusername'])
    {
        if(!$post['displaygroup'])
        {
            $post['displaygroup'] = $post['usergroup'];
        }
        $usergroup = $groupscache[$post['displaygroup']];
    }
    else
    {
        $usergroup = $groupscache[1];
    }

I consider this a bug because the ability to see the PM button in postbit should depend on if the user has "canusepms" on any of a members groups and not the display group.

I agree, good catch!

I think that is how it is supposed to be, right? I mean, permissions are never supposed to be based on display group, afair.

Quote:I mean, permissions are never supposed to be based on display group, afair.

Correct, that's why this is a bug.

$usergroup['canusepm'] is being set by the display group when it should not be.

Hi,

Thank you for your report. We have pushed this issue to our Github repository for further analysis where you can track our commits and progress with fixing this bug. Discussions regarding this bug may also take place there too.

Follow this link to visit the issue on Github: https://github.com/mybb/mybb/issues/3175

Thanks for contributing to MyBB!

Regards,
The MyBB Group