allplayers is full of player objects, not their account names. You're using them like accounts right now though. My suggestions packed into code:
PHP Code:
function onActionServerSide(cmd, arg) {
switch (cmd) {
case "send":
for (temp.pl: allplayers) {
if (pl.level.name == nil)
continue;
pl.sendPM(arg);
}
break;
}
}
I'm also assuming here that you're sending the message as an argument with the trigger instead of storing it in a client.var. I removed the chat notification because it'd be useless anyway since you'd only see the last one. I also added a check to see if the player level doesn't exist which usually means that the player is an RC instance; stuff gets pretty annoying when all RCs are getting messages constantly.
I didn't touch the clientside part, but word of advice: don't recreate the GUI objects all the time. Create them once and then hide/show them.