--- a/gpp/messages/forms.py	Tue May 03 02:56:58 2011 +0000
+++ b/gpp/messages/forms.py	Thu May 05 02:58:44 2011 +0000
@@ -39,11 +39,12 @@
          self.rcvr_user = User.objects.get(username=receiver)
       except User.DoesNotExist:
          raise forms.ValidationError("That username does not exist.")
-      if self.user.username.lower() == receiver.lower():
+      if self.user == self.rcvr_user:
          raise forms.ValidationError("You can't send a message to yourself.")
       return receiver
 
-   def save(self, sender, parent_msg=None):
+   def save(self, parent_msg=None):
+      sender = self.user
       receiver = self.rcvr_user
       subject = self.cleaned_data['subject']
       message = self.cleaned_data['message']

--- a/gpp/messages/static/js/tabbed_messages.js	Tue May 03 02:56:58 2011 +0000
+++ b/gpp/messages/static/js/tabbed_messages.js	Thu May 05 02:58:44 2011 +0000
@@ -18,6 +18,8 @@
             $('#id_receiver').val(msg.sender);
             $('#id_subject').val(msg.re_subject);
             $('#id_message').val(msg.re_content);
+            $('#msg_compose_form').append('<input type="hidden" name="reply_to" value="' +
+               $msgDialog.msgId + '" />');
          }
       },
       ajaxOptions: {
@@ -140,7 +142,7 @@
       data: $(form).serialize(),
       dataType: 'html',
       success: function (data, textStatus) {
-         $('#ui-tabs-1').html(data);
+         $(selectedTab.panel).html(data);
       },
       error: function (xhr, textStatus, ex) {
          alert('Oops, an error occurred. ' + xhr.statusText + ' - ' + 

--- a/gpp/messages/views.py	Tue May 03 02:56:58 2011 +0000
+++ b/gpp/messages/views.py	Thu May 05 02:58:44 2011 +0000
@@ -198,8 +198,19 @@
 
     if request.method == "POST":
         compose_form = ComposeForm(request.user, request.POST)
+
+        # Is this a reply to another message?
+        parent_msg_id = request.POST.get('reply_to')
+        if parent_msg_id:
+            parent_msg = get_object_or_404(Message, id=parent_msg_id)
+            if (request.user != parent_msg.receiver and
+                request.user != parent_msg.sender):
+                return HttpResponseForbidden()
+        else:
+            parent_msg = None
+
         if compose_form.is_valid():
-            compose_form.save(sender=request.user)
+            compose_form.save(parent_msg=parent_msg)
             messages.success(request, 'Message sent.')
             return HttpResponseRedirect(reverse('messages-index_named', args=['compose']))
     else:

--- a/gpp/templates/messages/compose_tab.html	Tue May 03 02:56:58 2011 +0000
+++ b/gpp/templates/messages/compose_tab.html	Thu May 05 02:58:44 2011 +0000
@@ -9,7 +9,7 @@
    {% endfor %}
 </ul>
 {% endif %}
-<form action="{% url 'messages-compose' %}" method="post">{% csrf_token %}
+<form action="{% url 'messages-compose' %}" method="post" id="msg_compose_form">{% csrf_token %}
 <table>
 {{ compose_form.as_table }}
 <tr>