Habitica: flags.chatRevoked does not prevent user sending private messages (PMs)

[Alys]

When a user's chat permissions need to be revoked, they are given a true value for flags.chatRevoked. This stops them posting to any guild or the Tavern.

It should also stop them sending private messages to any player.

[CrystallineCat]

I'm working on this.

So far I've changed api.sendPrivateMessage to yield the same error as api.postChat. This seems to work locally.

Still to do, AFAICT:

• make the error message localizable (also in api.postChat)
• make an automated test (similar to the one for api.postChat)

I'm new to this, so please tell me if I'm missing anything.

[CrystallineCat]

Hmm... sending another user gems allows for a message. Should flags.chatRevoked block the ability to send gems entirely, or only the message, or leave it as is?

[SabreCat]

Sending Gems shouldn't be altered. Unless we worry about someone sending constant 1-Gem gifts from a subscriber-grade hoard as a spamming tactic?

[khipkin]

Maybe disallow custom messages and instead send a bland, default message? I personally wouldn't mind getting spammed with 1-Gem gifts from anyone as long as the messages weren't upsetting.

[deilann]

I think when someone's been harassing you, any way they can reach you is
not okay. If you've blocked someone, they should not be able to gift gems.
So when someone's blocked entirely, they should not be able to gift gems,
except _maybe_ to party members.

On Tue, Sep 6, 2016 at 9:23 AM, Kaitlin Hipkin [email protected]
wrote:

Maybe disallow custom messages and instead send a bland, default message?
I personally wouldn't mind getting spammed with 1-Gem gifts from anyone.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/HabitRPG/habitrpg/issues/7971#issuecomment-245006430,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AF--ruP3LAH74Xgo_LRje7_gTRAFpnczks5qnZOBgaJpZM4J08NR
.

Currently Reading
https://www.goodreads.com/user/email_signature_destination/35215676?utm_medium=reading_link&utm_source=email_signature
[image: Book Cover]
https://www.goodreads.com/user/email_signature_destination/35215676?utm_medium=cover&utm_source=email_signature

[Alys]

For simplicity and safety, flags.chatRevoked should block the ability to send gems entirely. @CrystallineCat excellent question! I hadn't thought of that option.

Chat permissions are often revoked when bad messages are posted to chat areas, and we can't necessarily trust those users to behave appropriately. I do like khipkin's idea of a default message, but even that might be upsetting to a player who's been harassed. Also, the revoked player could change their profile name to something inappropriate, and that would show on the message that the gift recipient received.

A revoked player could also create a new account to bypass the revocation, and send their own gems to the new one, so we want to discourage that too.

[khipkin]

I have been more than convinced that blocked users should not be able to send gems at all. Sorry, @deilann, for my insensitive comment above; many abusive people would gladly pay gems in order to continue harassing their victim(s), and that must be prevented.

Also @Alys, good points that users could change their display names to something inappropriate or just transfer gems to a new account.

[CrystallineCat]

Thanks for the replies! :)

Looks like api.transferGems doesn't actually check for the user being blocked, either. I've now factored out the checks from api.sendPrivateMessage into a function and use that in both APIs for consistency. I've also made tests for the new restrictions.

I forgot to put the issue number into the commit this time, so here is a link: https://github.com/CrystallineCat/habitrpg/commit/53fd0ac3fd310fa36e6d7022156885ed4b791b6c

However, I'm not sure about couple of things:

• Should gems be sendable to a user that opted-out of messaging?
• Should messages be sendable to yourself? There's a check in api.transferGems to disallow sending gems to yourself, but no corresponding check in api.sendPrivateMessage.
• Should the new function be exposed through the API, to allow, e.g. the UI to check if sending a message to a certain person is allowed?

[Alys]

@CrystallineCat

• "Should gems be sendable to a user that opted-out of messaging?" -- That's a really interesting question with good points on both side. I recommend that we consider it to be out of scope for this issue because it could take a while to settle on an answer, and we want this issue fixed fairly soon if possible. I am definitely glad you asked though! Would you like to make a new issue for it? Describe the current behaviour and your query about it. I'll then mark it for suggestion-discussion and add my thoughts.
• "Should messages be sendable to yourself?" - definitely yes. This question comes up occasionally, so could you please add a comment next to the code that permits it, in the PR for this issue? The comment can be something like:
  // we allow a player to message themself so they can test how PMs work or send their own notes to themself
• "Should the new function be exposed through the API, to allow, e.g. the UI to check if sending a message to a certain person is allowed?" -- I personally think it should be. My belief is that since you can use the API to send messages, you should be able to use the API first to find out if the message would be sendable (before you type it!!). I think that would be good for usability. However if other admins disagree, pay attention to them, not me.