PM's being sent to additional people
 

Recently members of our forum have been receiving PM's that aren't meant for them. After some investigation into the issue I've found that the person that the message is intended for is still receiving it and it seem the extra person receiving it is just receiving a copy of the pm but I can't see any explanation or pattern for it.

The wrong person receiving the message isn't always the same person, the person who rightly receives the message isn't always the same and the type of message isn't always the same so as you can probably understand I'm hitting a brick wall at the moment.

It's happened for infraction pm's and pm's sent normally and even pm's that we ourselves create. By that I mean part of our script in our own site basically creates our own automated pm's to inform the members about an event on our site. I have double and triple checked that I'm doing this right and the function I use only gets called once per event so It's not creating these additional entries into the pm table.

Concerning the database the two pm's from the pm table share the same pmtext id as would be expected. It's almost as if the pm has been cc'd to the second person. But I can't see where this is being done. I've tried disabling some of our plugins/products but the ones that are left shouldn't affect the pm system at all.

Any help that could be given would be highly appreciated as its a bit of a security/privacy issue at the moment having people receive pm's that they shouldn't be.

EDIT: Sorry if this should be in the programming forum but as far as I can tell this is a bug/issue with vBulletin. Especially as it happens with all types of pm's: (ones I add into the DB myself, infraction ones and normal ones).

If you try to disable ALL plugins, does this still happen? Regardless of the fact that they touch the PM system. If it does, you might get a better response from Jelsoft in a bug report.

What plugins have you installed, can you try disabling each one and see if the problem still occurs?

At the moment I can't really go and disable all the plugins without knowing which one is causing the issue, we have a fairly large user base (over 30k) and they'd get pretty annoyed with losing any features they really like. I've disabled a few more today and waiting on a response on if the issue is still happening or not (as it doesn't happen with all pm's just seems to happen randomly though).

The products we currently have installed are the following (and I do know there are quite a few, they were installed before I got proper access in the admincp):

• AdminCP Top 10 Statistic
• Competitions
• Cyb - PayPal Donate (*)
• Delete Post when Giving Infraction
• e-steki Referrer Statistics
• IpInfo (*)
• Quick Reply Thread Management
• Real ip detection
• Split Useronline
• vB Ad Management (*)
• vRules

The ones with a (*) after are the ones I know for certain are outdated versions and as such will also be getting those upgraded over the next day or two to make sure that isn't causing the issue.

We also have three plugins that aren't linked to any of those products and two of which are custom ones we created to show extra info in our header (avatar and the other just runs a query to grab some info). The final extra plugin is used to show custom status icons for the forums.

If anyone has experienced any similar problems and knows if any of the above products are cauisng it then I'd appreciate being told. Otherwise I'll try disabling a few more of the above mentioned products and reporting back once that is done.

Can you try to disable the "delete post when give infraction" and see if it has any effect?