Hello, I have a client who would like to use the private messaging function but as sensitive information will be being discussed it has to be secure between the user and the admin (not public in any way).

Can this be achieved within C5.6? I have set the basic site and have three users communicating via /profile/messages. The issue as I can see at the moment is the url for a message is say /index.php/profile/messages/view_message/inbox/3/ if I change the end number to 2 ie /index.php/profile/messages/view_message/inbox/2/ I can skip between users even though I am logged in as user 3.

How do I secure the profile page and messages for the logged in user only just like 'My Account' within the concrete5.org site?

Many thanks
Warren