# People misusing possible loopholes when PMs are disabled?
**URL:** https://meta.discourse.org/t/people-misusing-possible-loopholes-when-pms-are-disabled/111445
**Category:** Support
**Created:** [3월 13, 2019, 4:38오전 UTC](https://meta.discourse.org/t/people-misusing-possible-loopholes-when-pms-are-disabled/111445 "2019-03-13T04:38:10Z")
**Posts on this page:** 17
**Page:** 1
### Author:  [@tmoko](https://meta.discourse.org/u/tmoko)
#### Post date: [3월 13, 2019, 4:38오전 UTC](https://meta.discourse.org/t/people-misusing-possible-loopholes-when-pms-are-disabled/111445/1 "2019-03-13T04:38:11Z")
(Firstly I’m sorry for my previous misunderstandings on here.) So I’m helping out with an older forum I used to moderate. PMs have been globally disabled for users (`enable personal messages` is turned off) because it’s a site for younger users. But there seems to be two loopholes:
- **Data export archive from system.** A user exports an archive of their posts and invites others to the PM. I’m not sure if this is still possible to do
- **‘Request membership’ button on groups**. This was the more recent of loopholes used after groups were set up.
We discovered this from `/u/system/messages` as some of the messages had been either initiated by system or closed by system after reaching max replies.
Is there any other way to completely prevent people from misusing these loopholes?
Some suggestions- Maybe the archive export PM could automatically be closed by system? And maybe the request membership option could be disabled when PMs are disabled?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [3월 13, 2019, 4:44오전 UTC](https://meta.discourse.org/t/people-misusing-possible-loopholes-when-pms-are-disabled/111445/2 "2019-03-13T04:44:07Z")
Yeah … if `enable_personal_messages` is off we should disable all `invite` functionality for all non-staff.
Very interesting people found these abuse vectors.
@techAPJ can you add to your list?
---
### Author:  [@HAWK](https://meta.discourse.org/u/HAWK)
#### Post date: [3월 13, 2019, 4:44오전 UTC](https://meta.discourse.org/t/people-misusing-possible-loopholes-when-pms-are-disabled/111445/3 "2019-03-13T04:44:44Z")
> [@sam](#):
>
> Very interesting people found these abuse vectors.
So much this! I’m stunned.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [3월 13, 2019, 4:50오전 UTC](https://meta.discourse.org/t/people-misusing-possible-loopholes-when-pms-are-disabled/111445/4 "2019-03-13T04:50:53Z")
Oh yes, fascinating. Thanks for bringing this to our attention, we will get those loopholes closed straight away.
---
### Author:  [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [3월 13, 2019, 5:13오전 UTC](https://meta.discourse.org/t/people-misusing-possible-loopholes-when-pms-are-disabled/111445/5 "2019-03-13T05:13:11Z")
> [@tmoko](#):
>
> A user exports an archive of their posts and invites others to the PM.
I am unable to repro this on latest version. As a non-staff user I was not able to invite other users.
> [@tmoko](#):
>
> ’Request membership’ button on groups
Okay so in this case if a group has “Allow users to send membership requests to group owners” enabled in group setting then pressing on + Request button initiates a PM with group owner. No other user can be invited by non-staff user (who requested access).
Just to confirm @sam the group + Request button should be hidden if `enable_personal_messages` is disabled (regardless of group “Allow users to send membership requests to group owners” setting enabled)?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [3월 13, 2019, 5:14오전 UTC](https://meta.discourse.org/t/people-misusing-possible-loopholes-when-pms-are-disabled/111445/6 "2019-03-13T05:14:01Z")
> [@techAPJ](#):
>
> As a non-staff user I was not able to invite other users.
Were you TL2, you must be TL2 to earn invite privilege.
---
### Author:  [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [3월 13, 2019, 5:15오전 UTC](https://meta.discourse.org/t/people-misusing-possible-loopholes-when-pms-are-disabled/111445/7 "2019-03-13T05:15:19Z")
Yes, tested on local as TL3 non-staff user.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [3월 13, 2019, 5:15오전 UTC](https://meta.discourse.org/t/people-misusing-possible-loopholes-when-pms-are-disabled/111445/8 "2019-03-13T05:15:57Z")
What version of Discourse are you on @tmoko?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [3월 13, 2019, 5:20오전 UTC](https://meta.discourse.org/t/people-misusing-possible-loopholes-when-pms-are-disabled/111445/10 "2019-03-13T05:20:50Z")
`+ Request` should still work, but you should not be allowed to invite users to the message.
---
### Author:  [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [3월 13, 2019, 5:21오전 UTC](https://meta.discourse.org/t/people-misusing-possible-loopholes-when-pms-are-disabled/111445/11 "2019-03-13T05:21:36Z")
Okay, that is already the case. Verified as TL3 non-staff user on latest version.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [3월 13, 2019, 5:29오전 UTC](https://meta.discourse.org/t/people-misusing-possible-loopholes-when-pms-are-disabled/111445/12 "2019-03-13T05:29:05Z")
Yeah I am not seeing how this is possible given:
>
---
### Author:  [@tmoko](https://meta.discourse.org/u/tmoko)
#### Post date: [3월 15, 2019, 2:31오전 UTC](https://meta.discourse.org/t/people-misusing-possible-loopholes-when-pms-are-disabled/111445/13 "2019-03-15T02:31:02Z")
> [@codinghorror](#):
>
> What version of Discourse are you on @tmoko?
We’re currently on 2.3.0beta5.
> [@sam](#):
>
> `+ Request` should still work, but you should not be allowed to invite users to the message.
Okay I’ve had a closer look and this seems to be the case from the messages (I thought multiple users were in a few but it was discobot). I guess I was super alarmed at first sorry, here’s what I realise after:
- the ones inviting other people to the data export seem to have been initiated around 2016-2017, I can’t find any recent ones using this, though people were still able to converse with this (latest post November 2018)
- as for initiating messages via the request memberships button, the most recent initiated I’ve come across was started 8 days ago, conversation still continued 4 days ago.
- it’s still a concern since two people were still able to have a private conversation using this. If our only option though is to not use groups then that’s okay, I’ll let them know it should be disabled. I didn’t realise this would be a risk if users were allowed to be group owners though (didn’t know request membership created a PM). perhaps I should have been more careful, though extremely frustrating that this was exploited so much.
- people are still using these PMs, that’s something for us to address. though it’s difficult to visit PMs from checking `/u/user/messages` to close old PMs/check that no one is misusing old PMs.
Thanks for looking into this.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [3월 15, 2019, 6:19오전 UTC](https://meta.discourse.org/t/people-misusing-possible-loopholes-when-pms-are-disabled/111445/14 "2019-03-15T06:19:02Z")
> [@tmoko](#):
>
> I didn’t realise this would be a risk if users were allowed to be group owners though
So this is largely because the users in question were group owners?
---
### Author:  [@tmoko](https://meta.discourse.org/u/tmoko)
#### Post date: [3월 15, 2019, 9:10오전 UTC](https://meta.discourse.org/t/people-misusing-possible-loopholes-when-pms-are-disabled/111445/15 "2019-03-15T09:10:17Z")
Yes, in this case. We didn’t know unfortunately. I feel awful seeing people so ashamed about their PMs.
Is it possible for some automatic way (e.g. command line) to close all currently open PMs? If it is, I’ll ask the other staff to contact support since our forum is hosted by [discourse.org](http://discourse.org)
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [3월 15, 2019, 9:53오전 UTC](https://meta.discourse.org/t/people-misusing-possible-loopholes-when-pms-are-disabled/111445/16 "2019-03-15T09:53:52Z")
We can help you with a [data explorer](https://meta.discourse.org/t/32566?silent=true) query.
@rishabh can you help?
You will still have to close manually but at least it should be easy to find
---
### Author:  [@rishabh](https://meta.discourse.org/u/rishabh)
#### Post date: [3월 15, 2019, 1:22오후 UTC](https://meta.discourse.org/t/people-misusing-possible-loopholes-when-pms-are-disabled/111445/18 "2019-03-15T13:22:58Z")
Here’s a [Data Explorer](https://meta.discourse.org/t/32566?silent=true) query that will [list all open PMs - sorted by recent activity](https://meta.discourse.org/t/list-all-open-pms/275045)
Once you run it, you’ll see a list of PMs sorted by `topic.updated_at` along with the reply count and the original poster info. You can click on each link and close the PMs manually.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [4월 15, 2019, 11:59오전 UTC](https://meta.discourse.org/t/people-misusing-possible-loopholes-when-pms-are-disabled/111445/20 "2019-04-15T11:59:40Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.