aboutsummaryrefslogtreecommitdiff
path: root/mod
diff options
context:
space:
mode:
Diffstat (limited to 'mod')
-rw-r--r--mod/messages/start.php13
1 files changed, 11 insertions, 2 deletions
diff --git a/mod/messages/start.php b/mod/messages/start.php
index e17640098..95ebffbdb 100644
--- a/mod/messages/start.php
+++ b/mod/messages/start.php
@@ -85,8 +85,17 @@ function messages_page_handler($page) {
// supporting the old inbox url /messages/<username>
$user = get_user_by_username($page[0]);
if ($user) {
- $page[1] = $page[0];
- $page[0] = 'inbox';
+ // Need to make sure that the username of the parameter is actually
+ // the username of the logged in user. This will prevent strange
+ // errors like grabbing the 'read' parameter and looking up
+ // a user with username 'read' and finding it and redirecting
+ // to that other person's inbox.
+
+ if ($user->username == elgg_get_logged_in_user_entity()->username) {
+ // OK, so it is our username and not someone else's
+ $page[1] = $page[0];
+ $page[0] = 'inbox';
+ }
}
if (!isset($page[1])) {