Search discloses invisible threads

[Tommy Boy]

I have a special forum set in a way that a user can only see his own threads inside this forum, while the forum itself is visible to registered users and up. The problem is that the entire list of threads in that forum is visible in search results. Of course, the threads themselves are inaccassible, but people can still guess what's going on in this forum based on the thread titles.

[Icheb]

This modification is only possible by hacking, so you have to ask the creator of this hack to modify his script according to your needs.

[Tommy Boy]

This modification is only possible by hacking, so you have to ask the creator of this hack to modify his script according to your needs.

What are you talking about? This is a built-in feature in vBulletin!

[Steve Machol]

Search should not bring up any threads that the person running the search doesn't have access to. Have you verified this by logging in as a person without this access?

[filburt1]

There was also a bug a while back related to this so make sure that you're running at least 2.2.9.

[MUG]

There was also a bug a while back related to this so make sure that you're running at least 2.2.9.

I can confirm this on 2.3.0RC3.

[Icheb]

Tommy Boy:
Yes, sorry. I forgot about "Can view others' threads", I just don't need it.

[Steve Machol]

You need to make sure you have completely removed your cookies prior to testing this.

[MUG]

You need to make sure you have completely removed your cookies prior to testing this.

Notice the currently logged in user, and the one that posted the thread.

[Steve Machol]

Yes, I noticed that. However I have done this same test before and I believe some remnants of the old cookies remain. Once I manually deleted the cookies I could not reproduce this.

[Steve Machol]

I just tried duplicating this again on my unhacked 2.3.0 RC2 forum and couldn't the private thread does not show up in a search for anyone who doesn't have access to that forum.

[MUG]

I made a Quicktime movie showing this bug (4.3 megs, 1.4 compressed)

I'll send you a PM with the URL to it.

[Steve Machol]

Please fill out a support ticket instead with all the relevant details.

http://www.vbulletin.com/members/support_form.php

Be sure to include the login info to your Admin CP and FTP.