[OmerE]

Hi,

Few issues with this:

1. It is trivial to get around the PM limits check, simply use BCC when writing the message - the code only checks recipients, not BCC recipients
2. The add-on only checks the main user group, and not membergroups, when testing for which groups it is OK to send PM to despite limit

Suggested fix for both issues, replace body of private_insertpm_process plugin with below (tested in 3.8 but should be similar in 3.6/3.7/4.x):

PHP Code:

if ($vbulletin->options['apboupc_global_enable'] AND $vbulletin->options['apboupc_pms'])
{
    if (!is_member_of($vbulletin->userinfo, split(',', $vbulletin->options['apboupc_pm_excludedgroups'])) AND ($vbulletin->options['apboupc_pm_amount'] !='0') AND ($vbulletin->userinfo[posts] < $vbulletin->options['apboupc_pm_amount']))
    {
        $recs = &$pmdm->info['recipients'];
        foreach($recs as $userid => $user) {
            if(!is_member_of($user, split(',', $vbulletin->options['apboupc_pm_allowed']))) {
                $db->hide_errors();
                $apboupc_get_allowedrecs = $vbulletin->db->query_read("SELECT userid, username, usergroupid FROM `" . TABLE_PREFIX . "user` AS user WHERE `usergroupid` IN (".$vbulletin->options['apboupc_pm_allowed'].") ");
                while ($apboupc_allowedrecs = $vbulletin->db->fetch_array($apboupc_get_allowedrecs))
                {
                    $apboupc_allowedrec[] = $apboupc_allowedrecs['username'];
                    $allowed_recipients .= ', <a href="private.php?do=newpm&u='.$apboupc_allowedrecs['userid'].'">'.fetch_musername($apboupc_allowedrecs).'</a>';
                }
                $db->show_errors();
                $allowed_recipients = substr($allowed_recipients, 1);
            
                standard_error(fetch_error('error_postcount_too_low_pm', $vbulletin->options['apboupc_pm_amount'], $vbulletin->userinfo[posts], $allowed_recipients));
            }
        }
    }
} 


Note this will still only list 'possible target users' with usergroup equal to exclusion group; this is intentional in our case, but YMMV.