Version 3.4.8

upload/admin/applications/members/modules_public/messaging/send.php

@@ -3,19 +3,19 @@
 /**
  * <pre>
  * Invision Power Services
- * IP.Board v3.4.6
+ * IP.Board v3.4.8
  * Online list
- * Last Updated: $Date: 2012-12-13 08:29:08 -0500 (Thu, 13 Dec 2012) $
+ * Last Updated: $Date: 2015-04-24 13:16:25 -0400 (Fri, 24 Apr 2015) $
  * </pre>
  *
- * @author 		$Author: AndyMillne $
+ * @author 		$Author: bfarber $
  * @copyright	(c) 2001 - 2009 Invision Power Services, Inc.
  * @license		http://www.invisionpower.com/company/standards.php#license
  * @package		IP.Board
  * @subpackage	Members
  * @link		http://www.invisionpower.com
  * @since		12th March 2002
- * @version		$Revision: 11713 $
+ * @version		$Revision: 12627 $
  *
  */
 
@@ -492,6 +492,15 @@ class public_members_messaging_send extends ipsCommand
 
 		try
 		{
+			/* Make sure this was the user who owned the topic if they are editing a draft */
+			if( $topicID )
+			{
+				if( $this->messengerFunctions->canAccessTopic( $this->memberData['member_id'], $topicID ) !== TRUE )
+				{
+					throw new Exception( 'NO_PERMISSION' );
+				}
+			}
+
  			$this->messengerFunctions->sendNewPersonalTopic( $toMember['member_id'], $this->memberData['member_id'], $inviteUsers, $msgTitle, $msgContent, array( 'isDraft'  => $draft,
 																																							  'topicID'  => $topicID,
 																																							  'sendMode' => $sendType,
@@ -886,7 +895,7 @@ class public_members_messaging_send extends ipsCommand
  		
  		if ( $preview )
  		{ 
- 			$displayData['message'] = $_POST['Post-NS'];
+ 			$displayData['message'] = $_editor->htmlPurify( $_POST['Post-NS'] );
 
 			if( $this->request['_from'] == 'quickPM' )
 			{