I just sent a message without being logged in, effectively allowing me to make a message look like it came from any email I enter into the field. Is there some option I can change to remove this ability?
I guess this could be a possible mod/new feature so move if you wish to.
I am rebuilding efiction! Join us on irc! #efiction at
Please be more specific. What kind of "message"?
Any message, the content doesn't matter. It's the 'contact' link. It currently does not inform me to log in when I click on it while logged out. I thought having it like this would be a bit better of a security measure.
I am rebuilding efiction! Join us on irc! #efiction at
First of all there's plenty of places in the script that send "messages." Contact the author, reviews, etc. You didn't say you were talking about the contact form, and I'm not a mind reader.
Generally, it's considered good form for your website to display at least some way for visitors to contact you (without making them log in). Otherwise visitors who are having trouble logging in have no way to contact you, for instance. It's a necessary evil to leave the contact form accessible to the public. If you've got the CAPTCHA turned on then the contact form is as secure without being logged in as it would be if you were. It's the same mechanism protecting both forms.
If you're still committed to keeping non-members from contacting you, open contact.php and on the blank line at line 36 add:
if(!$loggedin) accessDenied( );
I will again say to those that may follow, this is a bad idea. It makes your site less legitimate in the eyes of visitors, and allows your site visitors no way to contact you if there's a problem.
Well contacting me is one thing, but each other was my issue. I guess they share the same code. Then a way to split this apart would be useful. Thanks for the code.
I am rebuilding efiction! Join us on irc! #efiction at
See and that's why I said be specific. No the two don't share the same code, but you didn't specify what "contact" you meant so I assumed the general one. You can keep non-members from using the "contact" link in an author's profile by doing the same thing in user/contact.php just above:
if(!$uid) $output .= write_error(_ERROR);
