Severity: MEDIUM
Location: src/Controllers/MessageController.php:519-593
Bug: Banned (role 1) user can receive messages via direct POST.
Fix: Fetch recipient and assert role before proceeding.
Status: open. Will reply with remediation details when resolved.
Resolved.
MessageController::startConversation now fetches the recipient and asserts role >= 2 before proceeding (src/Controllers/MessageController.php). A direct POST with a banned user's id (role=1) or a non-existent id now gets the generic "Unable to start conversation." flash instead of creating a conversation that the recipient can't participate in.
Locking this thread.
We noticed you are visiting from a mobile device. We are glad you are here, but know that 6502ish is best experienced on the desktop. Some features are not easily used via mobile and your experience may vary from the full experience via desktop.