Quick PM Sending (pop-up) v2

Quick PM Sending
---------------------------------------

Description:
This hack normally adds an option in the menu when you click on an Username. When you click on it, vb will give you a pop-up with the content just like the page that you use to send a new PM with full functions as the original one, which is design for users with have to mass PM others in thread with different PM's content and that persons don't have to reload that thread again again each time, lessen time is lessen costed You might find out its handy in someway.

Updated:
New newpm.php has cleared unwanted script and reduced extra queries when executing
Security Fixed
v2 includes pm sent with template and fixed security in newpm.php
v2.01 includes new bug XSS found in vb 3.0.* refer to this announcement here https://vborg.vbsupport.ru/showthread.php?t=74035 *Thank Erwin for heads-up

Note: If you want a better look for the page indicated your message has been sent then just see the pm_sent_with_template.txt file.

Installating Instruction & Screenshot are in attachments. Enjoy And don't forget to click install if you use this hack

[Lionel]

why would I get a javascript error in there? That happened why after I did a copy n paste

[Lionel]

My problem is at line 116 character 2 object expected. Problem is that line is just plain html. But I could say that it pops up everytime I start typing in the editor's body textarea. Which function or which editor brings that up? And at what point? I am using the WYSIWYG

[Lionel]

I found the reason... I installed the excellent character counter hack, so I needed to adjust your templates accordingly.

[Erwin]

This hack has a potential huge security hole - there is no internal usergroup permission check, so unregistered members can use newpm.php to send PMs. I would add some sort of check in the newpm.php file itself, plus use templates to prevent unregistered users from accessing the link.

[Lionel]

@erwin

if I put the below in newpm.php, will that be sufficient?

if (!$vboptions['enablepms'])
{
eval(print_standard_error('pm_adminoff'));
}

// check permission to use private messaging
if ($permissions['pmquota'] < 1 OR !$bbuserinfo['userid'])
{
print_no_permission();
}

//check if the user will receive PMs
if (!$bbuserinfo['receivepm'])
{
eval(print_standard_error('pm_turnedoff'));
}

[AnhTuanCool]

Originally Posted by Erwin

This hack has a potential huge security hole - there is no internal usergroup permission check, so unregistered members can use newpm.php to send PMs. I would add some sort of check in the newpm.php file itself, plus use templates to prevent unregistered users from accessing the link.

Did you even test it?

I've just logged out of my board and try to access /newpm.php?do=newwpm&userid=... and I get the page said needed to login, although I haven't changed anything from the one I posted here.

[Lionel]

that would not hurt to incorporate the above. It checks for quotas, pm enabled etc...

[Erwin]

Originally Posted by AnhTuanCOol

Did you even test it?

I've just logged out of my board and try to access /newpm.php?do=newwpm&userid=... and I get the page said needed to login, although I haven't changed anything from the one I posted here.

Obviously.

Unregistered visitors on my site were sending PMs and it took us a day to figure out it was this hack. Serves me right for not checking the code properly.

[integra99]

I changed the pmsent template a bit...

<script language="Javascript">
<!--
alert("$vbphrase[pm_sent]");
self.close();
//-->
</script>

[integra99]

Erwin, I had the same problem. I had to add in..

if (!($permissions['forumpermissions'] & CANVIEW) OR ($bbuserinfo['userid'] == '0')) {
	print_no_permission();
}