[RSS Feed/News] Reporting from a user's profile respects user privacy settings

[XenForo]

PHP:

public function actionReport(ParameterBag $params)
{
   $user = $this->assertViewableUser($params->user_id);
   if (!$user->canBeReported($error))

assertViewableUser is being called with $basicProfileOnly = false

This means the members/report route only works if the user's privacy settings allow accessing the full profile page.

It doesn't make much sense to gate this behind a profile visibility check, as it is handy for...

Read more

ادامه مطلب...