Announcement

Collapse
No announcement yet.

"who's online" bug

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • "who's online" bug

    i know i should have upgraded to version 2.2.8 by now but sadly haven't had the time & i still have 2.2.7

    PROBLEM: when a mod is posting in the moderators forum, the thread name/title appears in the "who's online" and regular members can see it.

    i consider this a small security problem because members can see the thread title and thus know who & what we are talking about.

    is there a way to amend/fix this?

    btw, if i upgrade to 2.2.8, do i lose my template/style? i have added the vbportal and many template alterations - so it would be a shame to have to do all this again.

    thanks in advance.
    - Rav3n

  • #2
    Are you sure that regular members can see it? It should only show the thread title if the user has permission to see that forum. Else it should just show Viewing Thread without the title after it.
    Scott MacVicar

    My Blog | Twitter

    Comment


    • #3
      Originally posted by Scott MacVicar
      Are you sure that regular members can see it?
      yep. i logged in under a regular 'test' member name with Netscape & was still logged in under my admin name with Internet Explorer. my admin name was viewing a hidden forum & the regular "test" name could see the thread title i was viewing through the "who's online" function.

      the reason this issue came about was because one of my mods made a thread in the Mod Board about a problem poster using the problem poster's name in the thread title & that member pm'd my mod telling her "why was she making secret threads about him?"

      this is when she reported it to me. i did some investigating & found that the leak was coming from the "who's online" area.
      Last edited by Rav3n; Thu 7 Nov '02, 6:08am.

      Comment


      • #4
        Do you have access masks turned on?

        Check permissions for that forum that for registered users Can View is set to no.
        Scott MacVicar

        My Blog | Twitter

        Comment


        • #5
          i have 'masks' on.

          when you say;

          Check permissions for that forum that for registered users Can View is set to no
          do you mean the following;

          Posting Options
          Private forum
          (Invisible to all except moderators and admins; user access masks must be on!)
          if so, i've checked the 'Yes' option for that too.

          Comment


          • #6
            Set all Private subforums permissions directly instead of counting on them to inherit the permissions from a parent forum.

            Comment


            • #7
              done that too.

              Comment


              • #8
                Then you have a permissions problem to figure out as the only "bug" is if you allow forums to inherit their permissions instead of directly setting them. That allows thread titles to be seen on Who's Online (but they still can't be entered).

                Comment


                • #9
                  Originally posted by freddie
                  the only "bug" is if you allow forums to inherit their permissions instead of directly setting them. That allows thread titles to be seen on Who's Online (but they still can't be entered).
                  yes, that's what's happening now.

                  Originally posted by freddie
                  Then you have a permissions problem to figure out
                  as far as setting all the correct permissions for the 'private' forums when i started them, i did. so if it's not a standard setting, where do i begin to look for the permission problem now? i have no idea.

                  also going back to one of my original questions...

                  - if i upgrade to 2.2.8, do i lose my template/style? i have added the vbportal and many template alterations.

                  thanks.

                  Comment


                  • #10
                    Originally posted by Rav3n
                    - if i upgrade to 2.2.8, do i lose my template/style? i have added the vbportal and many template alterations.
                    Upgrading won't overwrite any cusomized styles. However it will overwrite any changes you've made to the vB php files.
                    Steve Machol, former vBulletin Customer Support Manager (and NOT retired!)
                    Change CKEditor Colors to Match Style (for 4.1.4 and above)

                    Steve Machol Photography


                    Mankind is the only creature smart enough to know its own history, and dumb enough to ignore it.


                    Comment


                    • #11
                      okay . i think i'll just wait for vb3 then because it's very arduous redoing all the php modifications.

                      thanks everyone.

                      Comment

                      Loading...
                      Working...
                      X