Jump to the post that solved this thread.
Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Not Solved [Security] Awaiting Registration permissions not working
#1
Not Solved
I discovered we had 150 users awaiting registration from last year. 

I deleted 60% of them because we have a lot of spammers. 

Seems some of them had actually created and posted in the forum, while the permissions say they cannot create anything there.

How can this be happening? Is this a bug? How can I manage this?
Reply
#2
Not Solved
exactly which version of MyBB you are using ?
whatever is the version, group permissions set at admin panel should work.

can we have a test url where you have posts by awaiting activation members ..
Reply
#3
Not Solved
(03-16-2018, 10:59 AM).m. Wrote: exactly which version of MyBB you are using ?
whatever is the version, group permissions set at admin panel should work.

can we have a test url where you have posts by awaiting activation members ..

It's definitely not working. I had it all OFF so that nobody could do it, and I found 30 out of 200 members with messages on the forum, and still haven't answered the confirmation email.

How can I give you that?
Reply
#4
Not Solved
(03-16-2018, 10:59 AM).m. Wrote: exactly which version of MyBB you are using ?
whatever is the version, group permissions set at admin panel should work.

can we have a test url where you have posts by awaiting activation members ..

This is still happening. A lot of users registered, the awaiting registration status stays , they dont' receive the activation email and they can still create forum posts and new threads, even when they have no permissions at all.

I ended up setting it up so that they cannot see the forum if they don't have activated their accounts... but since they don't receive the email either...

MyBB Version
1.8.14
PHP Version
7.0.27-0+deb9u1
SQL Engine
MySQLi 10.1.26
Users
721 Registered Users
3 Active Users
0 Registrations Today
53 Awaiting Activation
Server Load
0.6
Reply
#5
Not Solved
Did you checked the permissions for forums where they are posting?

Try the following plugin (Permission Viewer by dragonexpert) to figure out at what level they have such permission:
https://community.mybb.com/mods.php?action=view&pid=270
Reply
#6
Not Solved
(05-06-2018, 07:48 PM)Omar G. Wrote: Did you checked the permissions for forums where they are posting?

Try the following plugin (Permission Viewer by dragonexpert) to figure out at what level they have such permission:
https://community.mybb.com/mods.php?action=view&pid=270

Oh. I found it. Some forums had permissions for awaiting registration.

How come the forum permissions override the user permissions? I think that's very wrong and makes no sense.


But anyhow, I installed the plugin but the developer doesn't give any information about where to find what it adds to the admin panel. I can't find any option it adds (I activated it, I use several plugins, I know how to do it!) so I'm a little lost. I guess that fix will probably work, but anyway, I'd like to use this plugin. Can somebody help me how to use it?  I wrote to the developer too.



Now the problem with the email not being sent... I'm looking into other forum posts...
Reply
#7
Not Solved
The plugin adds a new module in acp->tools->permission viewer. If you cant see it check your admin permissions in acp->groups->admin permissions.
Reply
#8
Not Solved
(05-07-2018, 08:04 AM)Omar G. Wrote: The plugin adds a new module in acp->tools->permission viewer. If you cant see it check your admin permissions in acp->groups->admin permissions.

Oh I saw it. Thanks a lot... he should put this in his description, would have been easier to find it.

It's nice, but it's confusing about the "guest" permissions. In my case, they have permission to post and create threads... but if you visit the forums permissions in the plugin it says they don't have any permissions... well. I wonder what it means by "guest", they have no permissions at all in the configs.

Thanks for your help!
Reply
#9
Not Solved
I won't be sure but I think it could only be loading forum permissions for groups which actually have custom forum permissions set and not "root" ones if that makes sense.

Since there were custom permissions for the awaiting activation they were displayed. But guests probably don't have custom permissions hence they display nothing.

Quote:How come the forum permissions override the user permissions? I think that's very wrong and makes no sense.

Quote:Seems some of them had actually created and posted in the forum, while the permissions say they cannot create anything there.

Posting isn't a per user base but a per group base permission (to clarify) (edit: i think they actually are). It was simply decided that forum permission to take priority upon group permissions.

I actually think if they were the other way it would cause the permission system to be more complicated than it is. I think that is how phpBB, xenForo, and vBulletin do it as well.

Quote:but since they don't receive the email either...

Do they never receive it? Either way I think you should probably check your server. I don't recall any current known issue with the mass mail queue system.
Reply
#10
Not Solved
[quote pid='1303738' dateline='1525754563']
Do they never receive it? Either way I think you should probably check your server. I don't recall any current known issue with the mass mail queue system.
[/quote]

I checked the email settings and help page for myBB. PHP emails are sent, but the email was not set in the settings for any option. Let's see if that works from now on. Thanks a lot!


About the other stuff, yea... I get it, makes sense. Thanks a lot
Reply
Jump to the post that solved this thread.


Forum Jump:


Users browsing this thread: 1 Guest(s)