2015-06-12, 10:16 PM
Hi,
I have a forum on which I have a security flaw in the theme. Guests and basic registered users can see groupimages in postbits and in member profile - these images include some information that these usergroups shouldn't see.
I know that all themes have an option to set them availible for different groups, but there is no option to strictly assign a theme to a specific group - only force one theme for all...
On the forum, normally people can register and see limited content etc., but...
if they use an invite code (that I generate with Invitation system by cfillion) they are registered into specific usergroup and additional group - that automatically gives them more permissions. The plugin doesn't come with a feature of assigning theme to a user or automatically detecting theme pick according to the usergroup, so I can't do it all with the invitation code.
At first, I tried making a default template with the "fragile" information removed, but it's not that simple. It works partially, but it makes my life harder as all other new users that will register with the special invite code, will remain with the "guest/registered" theme instead of the fully-privilidged.
Now the questions. Please answer all of them.
1. Is it possible to assign a theme to a usergroup + make it autodetect users group change detection? So simply force it, bind it... Or in other words default theme per usergroup instead of one default theme globally.
f.e:
2. Is there a way to block theme usage?
I think of it as a bodge work - I could easily fix my issue by setting a default theme as the fully featured and blocking guests and registered from using it - but how do I do that?
I've tried disabling the default state of the theme and then setting allowed usergroups accordingly, but it's wrong. As new users register, their SQL style(theme) value won't change to the one that they theoretically should be set with.
f. e:
Of course, it would also be enough if I could set permission to view groupimages by usergroup, but I haven't found the right plugin to do so.
If this issue is "solved" in myBB 1.8.x then let me know and I'll focus more on updating my template to be compatible with 1.8.
I think the easiest way would be upgrading the Invitation plugin with the feature of assigning theme to the user. I guess setting default theme per usergroup would be too difficult/time-worthy to make.
Please help me out, thanks
I have a forum on which I have a security flaw in the theme. Guests and basic registered users can see groupimages in postbits and in member profile - these images include some information that these usergroups shouldn't see.
I know that all themes have an option to set them availible for different groups, but there is no option to strictly assign a theme to a specific group - only force one theme for all...
On the forum, normally people can register and see limited content etc., but...
if they use an invite code (that I generate with Invitation system by cfillion) they are registered into specific usergroup and additional group - that automatically gives them more permissions. The plugin doesn't come with a feature of assigning theme to a user or automatically detecting theme pick according to the usergroup, so I can't do it all with the invitation code.
At first, I tried making a default template with the "fragile" information removed, but it's not that simple. It works partially, but it makes my life harder as all other new users that will register with the special invite code, will remain with the "guest/registered" theme instead of the fully-privilidged.
Now the questions. Please answer all of them.
1. Is it possible to assign a theme to a usergroup + make it autodetect users group change detection? So simply force it, bind it... Or in other words default theme per usergroup instead of one default theme globally.
f.e:
Quote:user Mike is in usergroup Rookie and I change his usergroup to Delirious - now his theme setting should change.
guests see theme set as their default, registered as their default etc.
2. Is there a way to block theme usage?
I think of it as a bodge work - I could easily fix my issue by setting a default theme as the fully featured and blocking guests and registered from using it - but how do I do that?
I've tried disabling the default state of the theme and then setting allowed usergroups accordingly, but it's wrong. As new users register, their SQL style(theme) value won't change to the one that they theoretically should be set with.
f. e:
Quote:I've then changed the guests/registered theme ID to 0 so that these guys would have the right theme.
Next, I've set allowed groups for the rest of themes remembering not to include groups 1 and 2 (guests and registered). The ID 0 theme allowed groups were only 1 and 2.
Then I hoped that when a member registers with the special invitation code putting him into a specific main usergroup (not registered), he would see the the theme he is allowed to use. But the SQL style value remained 0. So, eventually it was pointless.
I guess that ID 0 means default
Of course, it would also be enough if I could set permission to view groupimages by usergroup, but I haven't found the right plugin to do so.
If this issue is "solved" in myBB 1.8.x then let me know and I'll focus more on updating my template to be compatible with 1.8.
I think the easiest way would be upgrading the Invitation plugin with the feature of assigning theme to the user. I guess setting default theme per usergroup would be too difficult/time-worthy to make.
Please help me out, thanks