Hi, I have discovered in Chat 2.2.7 that individual forum moderators are unexpectedly able to view and action reports for chat messages despite having no chat moderator permissions. Looking at the code, the following permission check is done in Siropu\Chat\Report\Message.php:
PHP:
protected function canActionContent(Report $report)
{
$visitor = \XF::visitor();
return $visitor->hasPermission('siropuChat', 'reportMessages');
}
Changing a forum moderator's permission to report messages to Never works around this issue.
In my opinion it would be better to only allow chat message reports to be viewed/actioned when a user has an appropriate chat moderator permission, such as
editAnyMessage
or
deleteAnyMessage
. E.g.:
PHP:
protected function canActionContent(Report $report)
{
$visitor = \XF::visitor();
return $visitor->hasPermission('siropuChatModerator', 'editAnyMessage') || $visitor->hasPermission('siropuChatModerator', 'deleteAnyMessage');
}