Announcement

Collapse
No announcement yet.

No Download Permission for attachements for guests will be ignored by "Share Photos"

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • No Download Permission for attachements for guests will be ignored by "Share Photos"

    Dear Support

    I created a vBulletin Board. As often seen I created permissions for guest users so they are not able to download attachements. Basically this works if you add normal attachements. I was suprised that this does not work if you add photos by the function "Share photos". This will be shown always even guests do not have download permission.

    Did I miss something? How I can prevent guests to see full images from such "shared photos"? (Those photos will be shown with a light box).

    Another question would be how I can enable the light box for images which are simple attached to a topic (not with the "Share Photos" function).

    Any help would be appreciated.

    kind regards
    Roger

    Info regarding my installation:
    1. vBulletin Version: 5.5.1
    2. PHP Version: 7.1.28
    3. MySQL Version: 5.7.22
    4. Any Addons installed: None
    5. Does the issue occur in a default style? Yes
    6. Does the issue occur using the English language provided? Yes
    7. Error message on the screen' n/a
    8. Browser and Browser version used. Chromimum 73.0.3683.86, Firefox 66.0.3
    9. Did you clear the browser cache and did the error continue? Yes
    10. A list of steps that can be used to recreate the issue. Create new topic and "Share Photos"; even guest users do not have download permissions for attachements they can see the photos
    11. If the issue is an Invalid Server response, the web server and PHP logs that correspond with its timestamp. n/a

  • #2
    There are two download permissions for vBulletin 5...
    1. Can download non-image attachments.
    2. Can download image attachments.

    In a default installation, the second is set to Yes for Guest Users.
    Translations provided by Google.

    Wayne Luke
    The Rabid Badger - a vBulletin Cloud customization and demonstration site.
    vBulletin 5 Documentation - Updated every Friday. Report issues here.
    vBulletin 5 API - Full / Mobile
    I am not currently available for vB Messenger Chats.

    Comment


    • #3
      Hi Wayne

      Originally posted by Wayne Luke View Post
      There are two download permissions for vBulletin 5...
      1. Can download non-image attachments.
      2. Can download image attachments.
      Yes I know that this is the case in the default installation. That is the reason why I adapted the rights of the "Guest Group"; This group is not allowed to download non-image attachements nor image attachements. But guests are still able to see images. Please note that guests are not able to download/view images which where inserted with the normal "Image" button function of the post editor. It happens only if a user uses the "camera" icon with the label "Share Photos". You will get a preview of the photos which can be seen by guests and guests are also able to click on those previews to get the full size image. In my opinion this should not be possible.

      cheers,
      Roger

      Comment


      • #4
        This is probably by design. You can create a improvement request here: https://tracker.vbulletin.com/vbulletin5/
        Translations provided by Google.

        Wayne Luke
        The Rabid Badger - a vBulletin Cloud customization and demonstration site.
        vBulletin 5 Documentation - Updated every Friday. Report issues here.
        vBulletin 5 API - Full / Mobile
        I am not currently available for vB Messenger Chats.

        Comment


        • #5
          Originally posted by Wayne Luke View Post
          This is probably by design. You can create a improvement request here: https://tracker.vbulletin.com/vbulletin5/
          Are you kidding? This means that the permission system is inconsistent depending on how you upload data to the forum? That's really bad - in my opinion there shouldn't be a difference. Independent where you download stuff always the same rights should be applied.

          So then I try to create a improvement request. Additional I try to fix this in my installation by modifying the core accordingly.

          cheers,
          Roger

          Edited: Filled improvement request: VBV-19327 - Enforce permissions also for albums (Download permission not respected for images in galleries/albums)
          Last edited by anothervbuser; Thu 25th Apr '19, 12:31pm. Reason: Added improvement request

          Comment


          • #6
            Agree and voted.
            vB Mods That Rock!

            Comment


            • #7
              The Gallery content type is specifically for sharing images. It doesn't require text at all. So a Guest User wouldn't see anything if they opened these topics if they couldn't see the images. Albums are something different. You can work around this by not allowing gallery content to be created in channels that guests have access to. Restrict the sharing of galleries to channels for your registered users. This is controlled by the "Can Create Photo Gallery" permission in the Channel Permissions page.

              Albums are different from Gallery content. Albums only exist on the User's Profile. There is a separate permission to hide these. "Can View User Albums". Usergroups -> Usergroups Manager. Edit the Guest User (called Unregistered / Not Logged In in older versions of the software) usergroup to change this.
              Translations provided by Google.

              Wayne Luke
              The Rabid Badger - a vBulletin Cloud customization and demonstration site.
              vBulletin 5 Documentation - Updated every Friday. Report issues here.
              vBulletin 5 API - Full / Mobile
              I am not currently available for vB Messenger Chats.

              Comment


              • #8
                The gallery photos disappear from a post but the text remains. click the text and the photos show. How do you remove the text so nothing is available?

                Click image for larger version

Name:	092FBD09-1208-45AE-B0C9-475924A8835D.jpeg
Views:	43
Size:	33.3 KB
ID:	4413892
                Last edited by Carrfixr; Fri 26th Apr '19, 7:38am.
                vB Mods That Rock!

                Comment


                • #9
                  Originally posted by Carrfixr View Post
                  The gallery photos disappear from a post but the text remains. click the text and the photos show. How do you remove the text so nothing is available?
                  That would be an actual bug and isn't how the issue was originally described. Nor is it how it is described in the Improvement Request.

                  Translations provided by Google.

                  Wayne Luke
                  The Rabid Badger - a vBulletin Cloud customization and demonstration site.
                  vBulletin 5 Documentation - Updated every Friday. Report issues here.
                  vBulletin 5 API - Full / Mobile
                  I am not currently available for vB Messenger Chats.

                  Comment


                  • #10
                    Maybe you can possibly upgrade the tracker to include this
                    vB Mods That Rock!

                    Comment


                    • #11
                      Originally posted by Carrfixr View Post
                      Maybe you can possibly upgrade the tracker to include this
                      I would suggest it's a different issue, because it's an actual bug. It should have its own tracker entry.

                      In my view it should go further and include phrasing that displays a message such as 'This post contains images. Log in or Sign Up to view them'.
                      MARK.B | vBULLETIN SUPPORT

                      TalkNewsUK - My vBulletin 5.5.2 Demo
                      AdminAmmo - My Cloud Demo

                      Comment


                      • #12
                        Originally posted by Mark.B View Post

                        I would suggest it's a different issue, because it's an actual bug. It should have its own tracker entry.

                        In my view it should go further and include phrasing that displays a message such as 'This post contains images. Log in or Sign Up to view them'.
                        Or have it say nothing at all since I want to block a certain usergroup from viewing images. Customize able for the situation?
                        vB Mods That Rock!

                        Comment


                        • #13
                          I used this - https://forums.rabidbadger.io/rabidb...ts-from-guests

                          Will have to see if I can get it to work with Photo Galleries.
                          Translations provided by Google.

                          Wayne Luke
                          The Rabid Badger - a vBulletin Cloud customization and demonstration site.
                          vBulletin 5 Documentation - Updated every Friday. Report issues here.
                          vBulletin 5 API - Full / Mobile
                          I am not currently available for vB Messenger Chats.

                          Comment


                          • Carrfixr
                            Carrfixr commented
                            Editing a comment
                            Yea I have that already up from long ago. Sounds like a possible plan if you can

                          • anothervbuser
                            anothervbuser commented
                            Editing a comment
                            Security by Obscurity? Not the solution I thought about.

                        Related Topics

                        Collapse

                        Working...
                        X