I'm posting here because there are more watchers and it's older.
I'm looking at 1.9.4, on XAMPP (Win XP, Apache 2.2.9, PHP 5.2.6).
I believe that the name and picture are supposed to link to a user's profile, and the envelope and number are supposed to open the messaging popup. As described, clicking the name or picture sends the user off to the profile of the sender, but in the context of a seemingly random course, to which the user may not have access.
Here's a suggestion for a quick fix to make it behave in the same way the Online Users block does. It will need some verifying, though.
/blocks/messages/block_messages.php @ line 45 in 1.9.4 is :
$this->content->text .= '<li class="listentry"><div class="user"><a href="'.$CFG->wwwroot.'/user/view.php?id='.$user->id.'&course=1'.$this->instance->pageid.'" title="'.$timeago.'">';
Replace that with :
$this->content->text .= '<li class="listentry"><div class="user"><a href="'.$CFG->wwwroot.'/user/view.php?id='.$user->id.'&course=1" title="'.$timeago.'">';
BTW, this bug can also be reproduced on Moodle.org: If I send myself a message the link is to http://moodle.org/user/view.php?id=442824&course=442824 and in the Online users Block it's to http://moodle.org/user/view.php?id=442824&course=1
Cheers,
Minh-Tam
The message address is incorrect, (course should = 1, not 11)