A whisper is posted as a message if the user is not staff/moderator/admin when using the API

Thank you for reporting this @jviotti. A 403 error will now be returned if a non-staff users tries to create a whisper via the api.

https://github.com/discourse/discourse/commit/5b5b5a5931469945b6ab9d3f38b11bad83e4cf72

8 Likes