Another thing with the can_invite_to
, users with TL below the SiteSetting.min_trust_to_send_messages
can circumvent creating new PMs by inviting users to PMs created by system (and possibly discobot) when PMs are enabled.
Yes, our users are a creative bunch.
Example repro (I’ve verified this works on our forum):
- Have private messages enabled
- Have
SiteSetting.min_trust_to_send_messages
= TL4 - Create user with TL2
- Go to /u/:username/activity
- Click
Download All
button - @system will message you with a download link
- Notice there’s a “Invite others…” button in message
- Invite another user to message