Many messages are sent to users without registration
When you block the sender it is blocked
When I search for the email in user accounts, it is not found
How was this message sent even though it was not registered?
You can only reply after registering
It is already activated

Do you have it via settings in plugin?
In theory it is possible that mailing function is not secured 

Do you have it via settings in plugin?
In theory it is possible that mailing function is not secured 

Where is the postal job secured?

@7ala
In functions.php find this code:
// MANAGE MESSAGE INSERT INTO DATABASE
function im_insert_message($thread_id, $message, $type, $file, $notify = true ) {

Replace it with:
// MANAGE MESSAGE INSERT INTO DATABASE
function im_insert_message($thread_id, $message, $type, $file, $notify = true ) {
  if(im_param('only_logged') == 1 && !osc_is_web_user_logged_in()) {
    return false;
  }

That should do it, plugin does not contains other methods for creating/sending messages.

found this
// MANAGE MESSAGE INSERT INTO DATABASE
function im_insert_message($thread_id, $message, $type, $file ) {
   $thread = ModelIM::newInstance()->getThreadById( $thread_id );
   $item = Item::newInstance()->findByPrimaryKey( $thread['fk_i_item_id'] );
after change
// MANAGE MESSAGE INSERT INTO DATABASE
function im_insert_message($thread_id, $message, $type, $file, $notify = true ) {
   if(im_param('only_logged') == 1 && !osc_is_web_user_logged_in()) {
$thread = ModelIM::newInstance()->getThreadById( $thread_id );
     $item = Item::newInstance()->findByPrimaryKey( $thread['fk_i_item_id'] );
     return false;
   }
Is this correct
Thank you all

@7ala
Does not look to be correct.
You should escape function in case it fails that condition.

@7ala
In functions.php find this code:

Code: [Select]

// MANAGE MESSAGE INSERT INTO DATABASE
function im_insert_message($thread_id, $message, $type, $file, $notify = true ) {

Replace it with:

Code: [Select]

// MANAGE MESSAGE INSERT INTO DATABASE
function im_insert_message($thread_id, $message, $type, $file, $notify = true ) {
  if(im_param('only_logged') == 1 && !osc_is_web_user_logged_in()) {
    return false;
  }

That should do it, plugin does not contains other methods for creating/sending messages.

Where can I find the location of this file?
jobs.php

@7ala
oc-content/plugins/instant_messenger/function.php   

@7ala
oc-content/plugins/instant_messenger/function.php   

please
What is the correct structure of the code? 

// MANAGE MESSAGE INSERT INTO DATABASE
function im_insert_message($thread_id, $message, $type, $file, $notify = true ) {
  if(im_param('only_logged') == 1 && !osc_is_web_user_logged_in()) {
    return false;
  }

It looks clear, there is just new block of code inside function.

 

Thank you very much
For the capacity of your hearts
And the speed of your response

@7ala
 

Unfortunately
There are still messages being sent without registration
I did this and same problem

// MANAGE MESSAGE INSERT INTO DATABASE
function im_insert_message($thread_id, $message, $type, $file, $notify = true ) {
  if(im_param('only_logged') == 1 && !osc_is_web_user_logged_in()) {
    return false;
  }
  $thread = ModelIM::newInstance()->getThreadById( $thread_id );
  $item = Item::newInstance()->findByPrimaryKey( $thread['fk_i_item_id'] );

Also there is a strange problem
If a message is sent from a registered user to another user
A letter arrives in the mail
In the mail there is a direct link to the conversation
Supposedly when you click on the direct link
If you are not logged into the site before, you will be directed to the login page
Unfortunately, this link opens the conversation even if you are not logged in 
Thank you all

@7ala
plugin allows conversation for non-logged as well. In url you should see secret code that authenticates user.

I find the problem here in this code
<?php if(osc_is_web_user_logged_in() && $item['fk_i_user_id'] <> osc_logged_user_id() || !osc_is_web_user_logged_in()) { ?>
  <h2 class="im-head"><?php _e('Start conversation', 'instant_messenger'); ?></h2>
Messages are still coming from unregistered users

Also, how can the user be directed to the login page?