Users can see admin section if a thread is moved there and someone replies getting a

[dwh]

A user emailed me that they can get into a private forum when a moderator replies to a thread they subscribed to and upon further questioning proved it to me. Running 2.27. How can this be??? I'm freaked out!

[Floris]

If you move a thread from a public board into a private board - they might have received an email that there was a reply to that thread (though i think that vBulletin shouldn't do that anymore (maybe it doesn't and it happened during the move so to say)) - but normally they can't access this area. Their usergroup permissions or masks didn't update to get access when a thread is moved.

[Freddie Bingham]

Originally posted by xiphoid
If you move a thread from a public board into a private board - they might have received an email that there was a reply to that thread (though i think that vBulletin shouldn't do that anymore (maybe it doesn't and it happened during the move so to say)) - but normally they can't access this area. Their usergroup permissions or masks didn't update to get access when a thread is moved.

They won't receive email notifications unless they do have access to the forum in which the thread was moved to. Since they are receiving emails and can still see the thread, they still have access to the forum in question.

[dwh]

Originally posted by freddie
They won't receive email notifications unless they do have access to the forum in which the thread was moved to. Since they are receiving emails and can still see the thread, they still have access to the forum in question.

What if the sequence is:

New post comes in. Email goes out.
Post is moved.
User clicks on email. Gets in.
Possible?

[Freddie Bingham]

Originally posted by dwh
What if the sequence is:

New post comes in. Email goes out.
Post is moved.
User clicks on email. Gets in.
Possible?

User would receive a permission denied message if they do not have access to the forum. Having a link to a thread does not give you the ability to enter a forum unless you have permission to do so.

[dwh]

Would a dB invalid SQL error message indicating a bad session explain this? Ran a repair but no tables were corrupt.