Block allows messages to be sent from guest

[marxjohnson]

Block allows messages to be sent from guest

[bret-miller]

OK, to further suggest this is a security issue, I am able to use the URL from the block to send a message from a different computer without ever logging into the site or displaying the course. The URL (without domain name) is:
https://xxxx/blocks/messageteacher/message.php?courseid=8&referurl=https%3A%2F%2Fxxxx%2Fcourse%2Fview.php%3Fid%3D8&recipientid=5

[marxjohnson]

I've attempted to reproduce this, but cannot. message.php calls require_login(), so any attempts to access the page (either loading the form via AJAX or directly entering the URL) are redirected to the login form.

[bret-miller]

I hate to post this here, but [redacted] gives me the message page without logging in.

[marxjohnson]

Got it, thanks. I didn't have guest access enabled while I was testing. I'll look into it.

[marxjohnson]

I've just pushed a fix which checks for moodle:site/sendmessage capability. The guest user doesn't have this by default, so this should fix the problem. Please can you test it and confirm for me?

[bret-miller]

Well, it didn't help. I took the time to look at the code and I don't understand why it's not blocking the message form. That should throw an access exception when using guest access, but it's not--at least not visibly.

[marxjohnson]

The only reason I can think that it would allow the page to be viewed by guest is if, for some reason, the Guest role has the moodle:site/sendmessage capability enabled.

[bret-miller]

It doesn't. I checked. It was "not set". I changed it to "prohibit" in case that would help, but it didn't help either.