[buddypress-trac] [BuddyPress Trac] #6504: Messages viewable to any logged out visitor

[buddypress-trac]

#6504: Messages viewable to any logged out visitor
-----------------------------------+------------------------------
 Reporter:  CodeMonkeyBanana       |       Owner:
     Type:  defect (bug)           |      Status:  new
 Priority:  normal                 |   Milestone:  Awaiting Review
Component:  Component - Messaging  |     Version:
 Severity:  major                  |  Resolution:
 Keywords:  has-patch              |
-----------------------------------+------------------------------

Comment (by CodeMonkeyBanana):

 I think that removing the nopriv might not be enough as a user can log in
 to their own account and then manipulate post request to still view stuff
 they shouldn't.  I don't have proof of that yet, I will put code up
 tomorrow if needed.

--
Ticket URL: <https://buddypress.trac.wordpress.org/ticket/6504#comment:4>
BuddyPress Trac <http://buddypress.org/>
BuddyPress Trac