FriendsOfFlarum / byobu

Well integrated, advanced private discussions for your Flarum forum.
https://discuss.flarum.org/d/4762-flagrow-by-bu-well-integrated-advanced-private-discussions
MIT License
54 stars 33 forks source link

User is able creating a PD without being a recipient #168

Open PatrickRoethlisberger opened 2 years ago

PatrickRoethlisberger commented 2 years ago

Bug Report

Current Behavior A user is able to create a private discussion without being a recipient when he deletes himself in the initial recipient's selection.

Steps to Reproduce

  1. Create a new PD
  2. Remove own user from recipients
  3. Post discission

Expected Behavior The user is prevented from creating PDs that he is not part of.

Environment

Possible solution(s) Prevent user from removing himself/ display a warning when a user tries to delete himself that he's not able adding himself back again

Additional Context Posts from discussion which user 6 created and invited users 2 and 4 while removing himself:

DB [flarum]> select id,user_id,type,content from posts where discussion_id = 123;
+-------+---------+--------------------+--------------------------------------------------------------------+
| id    | user_id | type               | content                                                            |
+-------+---------+--------------------+--------------------------------------------------------------------+
|  1234 |       6 | comment            | <t><p>Content</p></t>                                              |
|  1235 |       6 | recipientsModified | {"new":{"users":[2,4],"groups":[]},"old":{"users":[],"groups":[]}} |
+-------+---------+--------------------+--------------------------------------------------------------------+
DavideIadeluca commented 3 weeks ago

Thanks @PatrickRoethlisberger for your bug report. While your environment is very old compared to today, I'm still able to reproduce the issue today with version 1.3.6 of fof/byobu. This definitely needs to be fixed!