It would benifit the bbPress community as a whole if Matt or MDA (or anyone else with access to the repository) could put up some kind of notice on the Private Messaging plugin page that tells about the security risks.

I think a contact form which is send to the "hidden" user email address is a much better solution

That would indeed be an awesome feature to have.

I think a contact form which is send to the "hidden" user email address is a much better solution

I assume just the function from

function pm_new_message( $id_receiver, $id_sender, $pmtitle, $message ){

}

You replace just that section to the } with the CK rewrite?

PS thanks for this, security issue=bad

Thanks.

function pm_new_message( $id_receiver, $id_sender, $pmtitle, $message ){
	global $bbdb, $bb_table_prefix;

	$created_on = bb_current_time('mysql');
	$id_receiver = intval($id_receiver);
	$id_sender = intval($id_sender);    

	$pmtitle=substr(strip_tags($pmtitle),0,64);
	remove_filter('pre_post', 'post_regulation');
	$message=substr($message,0,2048);
	$message=force_balance_tags($message);
	$message=apply_filters('pre_post',$message,0,0);
	$message=apply_filters('post_text',$message,0);	

	$bbdb->query("INSERT INTO ".$bb_table_prefix."privatemessages
		(id_sender, id_receiver, pmtitle, message, created_on)
		VALUES
		('$id_sender', '$id_receiver', '$pmtitle',  '$message','$created_on')");

	$to = bb_get_user_email($id_receiver);
	$pm_link = bb_get_option('uri') . 'message.php?id=' . $bbdb->insert_id;
	$message = __("You have a new private message: %1$s \nFrom: %2$s \n\n%3$s ");
	mail( $to, bb_get_option('name') . ':'  . __('Private Message'),
		sprintf( $message, $pmtitle, get_user_name($id_sender), $pm_link ),
		'From: ' . bb_get_option('from_email')
	);

}

Can you tell me where specifically to put your email notification hack? I'm not well versed in PHP or coding in general (outside of HTML/CSS). Thanks!

Also you'd have to send the email notification BEFORE you do the escape if you send the message or title in the message (or save the original to different strings).

That said, I also added Anne's notification hack, and we're not getting any notifications.

Try adding this before the $bbdb->query

$pmtitle=mysql_real_escape_string($pmtitle);
$message=mysql_real_escape_string($message);

and see if it helps or if it just add slashes to your text instead and breaks it.

It may also be a quote problem but I thought the bbpress pre/post text filters should encode quote or any other problematic characters.

I'm running bbPress 0.9.0.3 with Private Messaging 0.80.

Thanks for the warning and the security update, _ck_.

Btw, what did detective's mod add? I'm not even sure what I'm using...

Anyway while I was replacing pm_new_message with ck's mod I decided to hack email notification in there at the end (formatting stolen shamelessly from the existing notification plugin):

$to = bb_get_user_email($id_receiver);
	$pm_link = bb_get_option('uri') . 'message.php?id=' . $bbdb->insert_id;
	$message = __("You have a new private message: %1$s \nFrom: %2$s \n\n%3$s ");
	mail( $to, bb_get_option('name') . ':' . __('Private Message'),
		sprintf( $message, $pmtitle, get_user_name($id_sender), $pm_link ),
		'From: ' . bb_get_option('admin_email')
	);

I think we're getting close to that actually. BuddyPress has a PM plugin on its roadmap... maybe that can be adapted for bbPress.

Now, perhaps a 'show/hide email' option would be nice, but PM? Ick. It makes you (the site owner) responsible for people being asshats in a way you can't easily monitor.

its like if you the PM feature part of BBPress, than you could update it easier with the newer releases. it doesnt make sense , but anyway..

It's also technically possible to do the whole thing inside of one single file for easy maintenance and make it part of the profile tabs. Look at bb-reputation to see the trick to making profile tabs within a single file, it requires a "wrapper".

I'm just worried because 85 people downloaded the PM plugin this week! I know we can't do anything about those 85 users, but maybe we can do something to help next week's 85 downloaders?