diff --git a/phpBB/includes/ucp/ucp_pm_compose.php b/phpBB/includes/ucp/ucp_pm_compose.php
index e9c67bcccf..a0bb036b87 100644
--- a/phpBB/includes/ucp/ucp_pm_compose.php
+++ b/phpBB/includes/ucp/ucp_pm_compose.php
@@ -125,7 +125,7 @@ function compose_pm($id, $mode, $action)
 
 			if ($action == 'quotepost')
 			{
-				$sql = 'SELECT p.post_id as msg_id, p.post_text as message_text, p.poster_id as author_id, p.post_time as message_time, p.bbcode_bitfield, p.bbcode_uid, p.enable_sig, p.enable_smilies, p.enable_magic_url, t.topic_title as message_subject, u.username as quote_username
+				$sql = 'SELECT p.post_id as msg_id, p.forum_id, p.post_text as message_text, p.poster_id as author_id, p.post_time as message_time, p.bbcode_bitfield, p.bbcode_uid, p.enable_sig, p.enable_smilies, p.enable_magic_url, t.topic_title as message_subject, u.username as quote_username
 					FROM ' . POSTS_TABLE . ' p, ' . TOPICS_TABLE . ' t, ' . USERS_TABLE . " u
 					WHERE p.post_id = $msg_id
 						AND t.topic_id = p.topic_id
@@ -203,6 +203,14 @@ function compose_pm($id, $mode, $action)
 			trigger_error('NO_MESSAGE');
 		}
 
+		if ($action == 'quotepost')
+		{
+			if (($post['forum_id'] && !$auth->acl_get('f_read', $post['forum_id'])) || (!$post['forum_id'] && !$auth->acl_getf_global('f_read')))
+			{
+				trigger_error('NOT_AUTHORIZED');
+			}
+		}
+
 		$msg_id			= (int) $post['msg_id'];
 		$folder_id		= (isset($post['folder_id'])) ? $post['folder_id'] : 0;
 		$message_text	= (isset($post['message_text'])) ? $post['message_text'] : '';