Serious: Bug to enter private forums even if not allowed to!

[firewire]

When a user clicked on my username on the bottom of the starting page (active users), he saw that my last post was in the moderator's corner.

He clicked it... and logged in into the private forum without having the right to do so.
I am glad he told me (instead of just listening).

This is NO GOOD! Please fix it ASAP.
Thanks

[werehere]

How did he log into it? Do you have permissions set for his user group, so it is not visible?

[firewire]

Sure. The moderator forum is only visible for moderators.

As I told: I log in as admin, post something on the hidden moderator forum (permission are set, its not only hidden but excluded from search etc.).

Then a normal user comes, clicks on my name on the list of "last users seen" and gets:

Last post: something from firewire in MODERATOR FORUM.

Now he clicks the link to my post... and is able to read not only the post but the whole thread.

[werehere]

There is a fix that John posted and I installed that stops the following of the URL's. The private forums showing up in the profile is a known issue, but with the little fix he posted it stops anyone from actually entering the private forum.

It is posted here, and I believe the thread was started by WebStyles or myself. If I can find it real quick I will post the link.

[werehere]

Check these threads out:

[url]http://vbulletin.com/forum/showthread.php?threadid=600[/url]
[url]http://vbulletin.com/forum/showthread.php?threadid=619[/url]

[firewire]

Thanks! That made it! :)

I have been searching myself but didn't find anything (most likely because i did not use the phrase "private forum" :) ).

So, my private fora are safe now. Good... that really annoyed me :)

[Freddie Bingham]

WereHere

werehere looks like your forum has expereinced technical difficulties

"Warning: Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (111) in admin/db_mysql.php on line 29"

[werehere]

Yes it is, but that is due to Interland and upgrades, not the vb software at all.

They are trying to redo the permissions for MYSQL and give me root access for it, but they messed up the configuration along the way, and have been doing that way to often:(

Thank you for trying to alert me though:)