# Missing "invite others..." button for staff moderators when PM is disabled

**URL:** <https://meta.discourse.org/t/missing-invite-others-button-for-staff-moderators-when-pm-is-disabled/65930>\
**Category:** Bug\
**Created:** [7월 10, 2017, 12:16오후 UTC](https://meta.discourse.org/t/missing-invite-others-button-for-staff-moderators-when-pm-is-disabled/65930 "2017-07-10T12:16:54Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![BaldvinTh](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/baldvinth/32/50395_2.png) [@BaldvinTh](https://meta.discourse.org/u/BaldvinTh)\
**Post date:** [7월 10, 2017, 12:16오후 UTC](https://meta.discourse.org/t/missing-invite-others-button-for-staff-moderators-when-pm-is-disabled/65930/1 "2017-07-10T12:16:54Z")

</div>

Greetings!

I’ve encountered a slight issue, not sure if this is by design for some reason, but it seems that staff moderators are not included in `can_invite_to(o,g)` when `SiteSetting.enable_private_messages` is disabled. This makes mods unable to invite other moderators or groups to private messages / warnings.

Lines [248-260 in guardian.rb](https://github.com/discourse/discourse/blob/master/lib/guardian.rb#L248-L260) seem to describe that administrators can ignore the enable\_private\_messages just fine, but staff moderators appear to be left out.

Would it be viable to replace `is_admin` with `is_staff` here?

```plaintext
  def can_invite_to?(object, group_ids=nil)
    return false unless authenticated?
- return true if is_admin?
+ return true if is_staff?
    return false unless SiteSetting.enable_private_messages?
    return false if (SiteSetting.max_invites_per_day.to_i == 0 && !is_staff?)
    return false unless can_see?(object)
    return false if group_ids.present?

    if object.is_a?(Topic) && object.category
      if object.category.groups.any?
        return true if object.category.groups.all? { |g| can_edit_group?(g) }
      end
    end

```

Reproduction steps:

As **admin**

- Have private messages disabled
- Send a message / warning to any user
- Invite moderators group to convo with “invite others…” button

As **staff moderator**

- Have private messages disabled
- Send a message / warning to any user
- Notice missing “invite other…” button, cannot involve other moderators / staff members

---

<div class="post-metadata">

**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\
**Post date:** [7월 10, 2017, 10:40오후 UTC](https://meta.discourse.org/t/missing-invite-others-button-for-staff-moderators-when-pm-is-disabled/65930/2 "2017-07-10T22:40:33Z")

</div>

What do you think @sam?

---

<div class="post-metadata">

**Author:** ![BaldvinTh](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/baldvinth/32/50395_2.png) [@BaldvinTh](https://meta.discourse.org/u/BaldvinTh)\
**Post date:** [7월 13, 2017, 2:04오후 UTC](https://meta.discourse.org/t/missing-invite-others-button-for-staff-moderators-when-pm-is-disabled/65930/3 "2017-07-13T14:04:53Z")

</div>

Another thing with the `can_invite_to`, users with TL below the `SiteSetting.min_trust_to_send_messages` can circumvent creating new PMs by inviting users to PMs created by system (and possibly discobot) when PMs are enabled.

Yes, our users are a creative bunch. 😛

Example repro (I’ve verified this works on our forum):

- Have private messages enabled
- Have `SiteSetting.min_trust_to_send_messages` = TL4
- Create user with TL2
- Go to /u/:username/activity
- Click `Download All` button
- @system will message you with a download link
- Notice there’s a “Invite others…” button in message
- Invite another user to message

---

<div class="post-metadata">

**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\
**Post date:** [7월 13, 2017, 7:41오후 UTC](https://meta.discourse.org/t/missing-invite-others-button-for-staff-moderators-when-pm-is-disabled/65930/4 "2017-07-13T19:41:48Z")

</div>

Yes we should patch that hole @eviltrout.. if PMs are disabled globally (which affects everyone but staff) they shouldn’t be able to do that!

Thanks for the detailed repro report!

---

<div class="post-metadata">

**Author:** ![BaldvinTh](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/baldvinth/32/50395_2.png) [@BaldvinTh](https://meta.discourse.org/u/BaldvinTh)\
**Post date:** [7월 14, 2017, 10:13오전 UTC](https://meta.discourse.org/t/missing-invite-others-button-for-staff-moderators-when-pm-is-disabled/65930/5 "2017-07-14T10:13:03Z")

</div>

I apologize if I caused some confusion. The issues are separate one with PMs disabled, the other with PMs enabled but required TL set to 4.

**Top report**

- Private messages disabled
- Staff can send send messages
- Admins can invite others, staff (moderators) cannot

**[Second post (with repro)](https://meta.discourse.org/t/missing-invite-others-button-for-staff-moderators-when-pm-is-disabled/65930/3)**

- Private messages enabled
- Min trust to create new posts set to TL4
- Users can circumvent “creating new posts” if they are TL2 with the “Invite others..” button on system messages