[GeekDrew]

I installed this, but didn't like a few things. I'm using 3.6.4, and I had the serialized "to" field issue. I also didn't like that I had to promote someone to superadministrator just to review private messages -- because that let them have authority over administrators, which I did not want.

In order to change the security check, I did this:

In \includes\config.php

Find:

    //    ****** SUPER ADMINISTRATORS ******
    //    The users specified below will have permission to access the administrator permissions
    //    page, which controls the permissions of other administrators
$config['SpecialUsers']['superadministrators'] = '1';

Below that, add:

	//	****** PRIVATE MESSAGE ADMIN ******
	//	The users specified below will have permission to view all user PMs
$config['SpecialUsers']['privatemessageadmin'] = '1';

In \admin\read_pms.php

Find:

if (!in_array($vbulletin->userinfo['userid'], preg_split('#\s*,\s*#s', $vbulletin->config['SpecialUsers']['superadministrators'], -1, PREG_SPLIT_NO_EMPTY)) ) {

Replace that with:

if (!in_array($vbulletin->userinfo['userid'], preg_split('#\s*,\s*#s', $vbulletin->config['SpecialUsers']['privatemessageadmin'], -1, PREG_SPLIT_NO_EMPTY)) ) {

That takes care of the security issue -- now you can add user IDs to the privatemessageadmin variable, to give them permission to use Read PMs, but not give them full superadmin rights.

Next, to change the unserialization issue...

In \admin\read_pms.php

Find:

	//print_label_row('To', htmlspecialchars($pm['touserarray']));
	$to = is_array(unserialize($pm['touserarray'])) ? implode(", ", array_values(unserialize($pm['touserarray']))) : null;
	$to = ($to == 'Array') ? htmlspecialchars($pm['touserarray']) : $to;
	print_label_row('To' , $to);

Replace that with:

	$myarray = array_values(unserialize($pm['touserarray']));
	if (is_array($myarray[0])) print_label_row('To' , htmlspecialchars(implode(", ", array_values($myarray[0]))));
	if (is_array($myarray[1])) print_label_row('BCC' , htmlspecialchars(implode(", ", array_values($myarray[1]))));

And that takes care of the unserialization issue.

All of the above worked beautifully for me on 3.6.4... your mileage may vary.