MyBB Community Forums

I created a forum for which non-registered/non-logged in users have no permissions. I log out. I can still view it and it's contents. I also log out as admin. I can still view it.

Is this a bug? What does the lack of "view" permission prevent?

More info: "Hide Private Forums" is set to yes in "Forum Home Options". Version is 1.2.2

---

I can't believe no one has encountered this problem before. Doesn't anybody use the view permission (turn it off) to prevent viewing of a forum by unregistered people? How could something this big be wrong in the current release? I hope I am just doing something wrong but the more I look into it the more it is looking like a bug and a major one at that.

thy Wrote:I created a forum for which non-registered/non-logged in users have no permissions. I log out. I can still view it and it's contents. I also log out as admin. I can still view it.

Is this a bug? What does the lack of "view" permission prevent?

More info: "Hide Private Forums" is set to yes in "Forum Home Options". Version is 1.2.2

---

OK, Went to "Usergroup Management/Edit Usergroup: Unregistered / Not Logged In" and changed the viewing permissions: Can View Threads, Can Search Forums, Can View Profiles to "no". Now the private forum is not visible when I'm not logged in. So it does what I want now and I can live with that.

But it doesn't make sense to me or do what I would expect it to do from the option names and the documentation. I would expect that turning viewing off for the forum would be enough. I would expect that turning viewing off for the group would turn off viewing of all forums, not just this one. I still call it a bug, at least a documentation bug. Have these permission interactions been thought through carefully? Documented?

thy Wrote:I can't believe no one has encountered this problem before. Doesn't anybody use the view permission (turn it off) to prevent viewing of a forum by unregistered people? How could something this big be wrong in the current release? I hope I am just doing something wrong but the more I look into it the more it is looking like a bug and a major one at that.

thy Wrote:I created a forum for which non-registered/non-logged in users have no permissions. I log out. I can still view it and it's contents. I also log out as admin. I can still view it.

Is this a bug? What does the lack of "view" permission prevent?

More info: "Hide Private Forums" is set to yes in "Forum Home Options". Version is 1.2.2

---

OK I found some documentation that seems to imply that this behavior is correct. At least it is what MyBB does -- what it should do is another matter:

Usergroups and Permissions

Currently in MyBB, the "yes" permission overrides any "no" permission. This poses a problem if you explicitly want to disable a certain permission for a usergroup if users in that usergroup are in another usergroup with "yes" permissions for the same permission.


Privacy is important so the tools for protecting privacy should be simple and clear. When settings conflict I think the decision should be toward more privacy not less as is the case here.

thy Wrote:OK, Went to "Usergroup Management/Edit Usergroup: Unregistered / Not Logged In" and changed the viewing permissions: Can View Threads, Can Search Forums, Can View Profiles to "no". Now the private forum is not visible when I'm not logged in. So it does what I want now and I can live with that.

But it doesn't make sense to me or do what I would expect it to do from the option names and the documentation. I would expect that turning viewing off for the forum would be enough. I would expect that turning viewing off for the group would turn off viewing of all forums, not just this one. I still call it a bug, at least a documentation bug. Have these permission interactions been thought through carefully? Documented?

thy Wrote:I can't believe no one has encountered this problem before. Doesn't anybody use the view permission (turn it off) to prevent viewing of a forum by unregistered people? How could something this big be wrong in the current release? I hope I am just doing something wrong but the more I look into it the more it is looking like a bug and a major one at that.

thy Wrote:I created a forum for which non-registered/non-logged in users have no permissions. I log out. I can still view it and it's contents. I also log out as admin. I can still view it.

Is this a bug? What does the lack of "view" permission prevent?

More info: "Hide Private Forums" is set to yes in "Forum Home Options". Version is 1.2.2

FOR THE LOVE OF GOD! Learn to use the EDIT button instead of essentially spamming your thread.

I managed to set my forum up so guests can't see a "Member Only" section and I did it by altering the forum permissions. I didn't change anything in the actual group settings...

DrPoodle Wrote:FOR THE LOVE OF GOD! Learn to use the EDIT button instead of essentially spamming your thread.

I managed to set my forum up so guests can't see a "Member Only" section and I did it by altering the forum permissions. I didn't change anything in the actual group settings...

I am familiar with the edit button, thank you.

This is not what I found. If you post exactly what permission settings you used I will give it a try.

My point was that if you wanted to post 4 times in a row, just use the edit button and put it all in one post. If you need to bump your thread only do it after a few days of no posting has occurred.

Anyway, in forum permissions:

Uncheck all tickboxes for the Unregistered / Not Logged In group.

In Group Permissions, Can View Board, Can View Threads, Can Search Forums, Can View Profiles are set to YES, and pretty much everything else is set to NO in the Unregistered / Not Logged In group.

That's all it took.

It also DEPENDS if you inherited any other settings and allowed Guests to view any other forums in the same catergory .

DrPoodle Wrote:My point was that if you wanted to post 4 times in a row, just use the edit button and put it all in one post. If you need to bump your thread only do it after a few days of no posting has occurred.

Anyway, in forum permissions:

Uncheck all tickboxes for the Unregistered / Not Logged In group.

In Group Permissions, Can View Board, Can View Threads, Can Search Forums, Can View Profiles are set to YES, and pretty much everything else is set to NO in the Unregistered / Not Logged In group.

That's all it took.

My point (if you care) is that merely editing the post doesn't tell anyone that something significant has changed and you might want to look at it again. That is why I posted replies. That and the fact that no one was responding.

Back to the problem, try this:
- create a new forum with all permission checkboxes for the Unregistered / Not Logged In group unchecked.
- Log out.
- Check to see if the new forum is visible (it is visible for me)
- In Group Permissions, set Can View Threads, Can Search Forums, Can View Profiles to NO.
- Still logged out, check to see if the new forum is visible (it no longer is visible for me)
- In Group Permissions, set Can View Threads, Can Search Forums, Can View Profiles to YES.
- Still logged out, check to see if the new forum is visible (it is still invisible for me)

It seems that the new private forum is (incorrectly) visible until the group permissions are turned off at which point it becomes invisible and stays invisible when they are turned back on. It apparently has to be a new forum created that way -- I just tried changing an existing forum to private without seeing this problem.

I'd call that a bug, wouldn't you?

Bug Confirmed

The "forumpermissions" cache is not being rebuilt after creating a new forum and setting permissions using the "quick permissions" function.


A quick fix, until I patch the code, is to go in to "Permissions" under "Forum Management" in the Admin CP and edit a group with custom permissions set for a forum and the cache will be completely rebuilt.

And the fix..

Manual instructions:

Open up inc/functions.php.

Find:

/**
 * Load the forum cache in to memory
 */
function cache_forums()
{
	global $forum_cache, $db, $cache;

	if(!$forum_cache)
	{
		$forum_cache = $cache->read("forums");
		if(!$forum_cache)
		{
			$cache->updateforums();
			$forum_cache = $cache->read("forums", 1);
		}
	}
	return $forum_cache;
}

Replace with:

/**
 * Load the forum cache in to memory
 *
 * @param boolean True to force a reload of the cache
 */
function cache_forums($force=false)
{
	global $forum_cache, $db, $cache;
	
	if($force == true)
	{
		$forum_cache = $cache->read("forums", 1);
		return $forum_cache;
	}

	if(!$forum_cache)
	{
		$forum_cache = $cache->read("forums");
		if(!$forum_cache)
		{
			$cache->updateforums();
			$forum_cache = $cache->read("forums", 1);
		}
	}
	return $forum_cache;
}

Open up inc/class_datacache.php

Find:

		// Get our forum list
		cache_forums();

Replace with:

		// Get our forum list
		cache_forums(true);
		$fcache = array();

This bug has been fixed in the latest code.

Please note the latest code is not live on the site or for download. An update will be released which contains this fix.

I can't believe that only Dr Poodle called thy on his unnecessary extra posts. Yes, he was spamming his own thread, and his responses were sarcastic. You know how to use edit, but you didn't want to because you apparently thought everyone here was just being lazy and ignoring you? You made four back to back posts in 3 hours! Worse than that, you quoted each previous post! What a ridiculous thing to do! You keep that up, the next time you need help, no one might help you! You might want to think about that the next time you have a problem! Just FYI...

Sorry, I just thought that needed to be said! I could see him panicking if his forum was crashed, but this wasn't a serious problem! No need to think that everyone should jump up and down in anticipation of helping!

Thanks for the fix though, Chris. I had noticed a bit of permissions problems, but I had always been able to work around them!