Announcement

Collapse
No announcement yet.

Users able to see posts in hidden forums

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • Users able to see posts in hidden forums

    Firstly I am currently running 2.3.5 with a clean search.php.

    It recently came to our attention that users can use the search function to view posts in hidden forums. It's strange the way it works, if a user clicks a link in the post or profile of a user then they can't see the posts. However if they go to search.php, type in the username of a person who has access to said hidden forums, and set the search to search (I'm using "search" a lot here, ain't I?) the category that the hidden forum is in, then they can see the first 200 characters of the posts. This, obviously, isn't very healthy at all.

    Is it a bug that can be fixed?

  • #2
    Do you have any hacks installed on your forum?

    Comment


    • #3
      Originally posted by Floris
      Do you have any hacks installed on your forum?
      A few, but none that affect access masks or the search feature (and none that affect search.php directly). As I said searching from a user's profile seems fine, it's only when the user goes into the search.php, edits the forum (and sets it to the category the hidden forum is in) and searches from a specific username.

      Comment


      • #4
        Sorry, we don't give support to customized forums. Please uninstall the hacks, re-upload all the vBulletin files in ASCII transfer mode (you can skip uploading images) and see if that fixes the issue.

        Comment


        • #5
          What you also can try to do is make a test installation of a fresh vBulletin 2.3.5 without the hacks and see if that also gives the same issue as your live forum.

          Comment


          • #6
            After doing extensive testing and quite a bit of set up to copy this problem on the completely unhacked board that's been suggested, I came up with exactly the same problem. The search works fine as long as no category is being specified to search in.

            So if I have the following structure
            -- category X*
            --- sub A*
            ---- sub A1*
            --- sub B
            ---- sub B1

            The ones marked with * the ones I have access to.

            When I simply search for a username without specifying any forum to search in it returns proper results.

            As soon as I put Category X in to search usernames for, it returns threads from subs A, A1 and B1. Strangely enough not from B. This no matter whether access masks is being set to no for only B or B1 as well.
            Clicking on a link still doesnt allow to view the thread, however if one enters to return results as posts, part of posts that shouldnt be visible do become available to anyone with access to the category.

            Oh and I may add the same applies to WOL. If someone views sub B, it doesnt show thread names. As soon as they view B1 or a thread in it the forum name and thread name become visible.

            I may add the search problem only occurs when searching for usernames, not for keywords.
            Last edited by Niobe; Mon 3 Jan '05, 3:40pm.

            Comment


            • #7
              Not sure I can follow this. Fill out a support ticket at:

              http://www.vbulletin.com/members/mem...ontactform.php

              Be sure to include the login info to your Admin CP, phpMyAdmin and FTP to the unhacked test board. Please also include a complete description of the problem, including everything needed to duplicate this problem.
              Steve Machol, former vBulletin Customer Support Manager (and NOT retired!)
              Change CKEditor Colors to Match Style (for 4.1.4 and above)

              Steve Machol Photography


              Mankind is the only creature smart enough to know its own history, and dumb enough to ignore it.


              Comment

              Loading...
              Working...
              X