MyBB Community Forums

Hi the community,

Excluding the fact (already reported) the function "reply to all" returns an SQL Error, when we fix it by this code :

					$comma = '';
					foreach($recipients['to'] as $recipient)
					{
						if($recipient == $mybb->user['uid'])
						{
							continue;
						}
						$recipientids .= $comma.$recipient;
						$comma = ', ';
					}

(added the $comma, no to return an SQL error... )

There are not all the recipients who should appear who are appearing.

For the example, some one sent a MP to me and another guy, after fixing the SQL error, if I click on "reply to all", only the other guy is in the recipient list.

And if we have a look at this code :

			else if($mybb->input['do'] == 'replyall')
			{
				$subject = "Re: $subject";

				// Get list of recipients
				$recipients = unserialize($pm['recipients']);
				if(isset($recipients['to']) && is_array($recipients['to']))
				{
					$comma = '';
					foreach($recipients['to'] as $recipient)
					{
						if($recipient == $mybb->user['uid'])
						{
							continue;
						}
						$recipientids .= $comma.$recipient;
						$comma = ', ';
					}
				}
				$comma = '';
				$query = $db->simple_select('users', 'uid, username', "uid IN ({$recipientids})");
				while($user = $db->fetch_array($query))
				{
					$to .= $comma.htmlspecialchars($user['username']);
					$comma = ', ';
				}
			}

It seems logical, in the code above, we can see that only the recipients located in the recipients list of the MP received are put into the new recipients list...

And since the code located juste before this snippet is in a else if(), it isn't executed, and the "normal" recipient, is not added...

This code should fix this issue :

			else if($mybb->input['do'] == 'replyall')
			{
				$subject = "Re: $subject";
				
				$uid = $pm['fromid'];
				if($mybb->user['uid'] == $uid)
				{
					$to = $mybb->user['username'];
				}
				else
				{
					$query = $db->simple_select('users', 'username', "uid='{$uid}'");
					$to = $db->fetch_field($query, 'username');
				}
				$to = htmlspecialchars_uni($to);

				// Get list of recipients
				$recipients = unserialize($pm['recipients']);
				if(isset($recipients['to']) && is_array($recipients['to']))
				{
					$comma = '';
					foreach($recipients['to'] as $recipient)
					{
						if($recipient == $mybb->user['uid'])
						{
							continue;
						}
						$recipientids .= $comma.$recipient;
						$comma = ', ';
					}
				}
					$comma = (!empty($to)) ? ', ' : '';

				$query = $db->simple_select('users', 'uid, username', "uid IN ({$recipientids})");
				while($user = $db->fetch_array($query))
				{
					$to .= $comma.htmlspecialchars($user['username']);
					$comma = ', ';
				}
			}

Oh, it seems the second bug has been reported too, sorry, I searched...