Permissions for Notices

[Kesha]

Hi all,

Using vBulletin 4. When creating a Notice with the viewing permissions set as "User is browsing forum X", we have discovered a situation in which Y user, whom does not have access to said forum, knew the URL and was able to see the Notices that were set up specifically for authorized viewers of forum X.

I was just wondering if this was a bug, or if this permission toggle doesn't work quite the way we were expecting it to.

[Wayne Luke]

It isn't related to permissions at all. The action is "User is browsing forum X". It doesn't say they have to have permission to view the forum. Notices aren't set to permissions. They would see the notice above a No Permission message.

If the information needs to be secure, use a topic within the forum.

[Kesha]

But on a point of technicality, if the user can't browse forum X due to permissions, then why should they be able to see things only meant for that forum?

[Mark.B]

But on a point of technicality, if the user can't browse forum X due to permissions, then why should they be able to see things only meant for that forum?

It's just not built that way....it's not intended as a secure permission-based system, it's designed so you can display a certain notice in a certain forum. Such as, an announcement relating to a certain model of car, in that model of car's forum within a general car forum.