Topic: Board News and Recent Topics blocks do not follow user permissions

[Leppie]

I've installed SimplePortal 2.3.5 on my SMF 2.0.5 forum, and so far the members are very happy with it. So, many kudos for the good work

Logging onto the forum as a normal user, we keep a regular account for staff to use to see what the forum looks like for a normal user, posts from restricted boards were visible and accessible. We have a couple of boards that should normally be available to admins and moderators only, but they appear for the whole world to be viewed using the "Board News" and "Recent Topics" blocks on the portal.
Unfortunately this is a major inconvenience as I would like to be able to show staff all the updates for the boards they can access, but at the same time I do not want those who should not have access, and in particular guests, to be able to read these posts.

Am I missing some setting(s) somewhere, or is this just the way it's implemented?
Many thanks in advance for all the help.

[Burke Knight]

Go edit them, and there will be a list of the boards, unselect them, by holding the shift key and click the board you do not want visible.

If no box like that, then there will be a box to enter the ID's of boards not to display in recent list. There should be Help icons next to them to explain how to use them.

[[SiNaN]]

Welcome to SimplePortal! Thank you for your kind words.

Both of those blocks should respect the forum permissions. It's possible that the board access permissions or the blocks are misconfigured. Would it be possible to get a link to your forum to get a better idea about what might be going on? You could send that information to me with a personal message if you don't want to share the link to your forum.

[Leppie]

Thanks for your replies.

@BurkeKnight: As a temporary measure I had already put a restriction on the boards being selected for these two blocks. This obviously is only a temporary solution.

@[SiNaN]: The forum in question is: https://openlinuxforums.org/
As mentioned, I have restricted the selected boards as everything was displayed to everybody using the OOTB settings. If you need more specific details about particular settings let me know.
Many thanks for your help.

[[SiNaN]]

This may seem obvious but allow me to ask this please: Are you completely sure that you were viewing the portal page not with your own account and as a guest (logged out), when you saw the posts from restricted boards?

To further debug the issue, create a new board and make it visible only to administrator group. Then post some topics in that board and see if they'll appear on the board news block. If you can keep it like that for some time, I could see it for myself as well. It would help a lot if you could get a screenshot of the block edit page of board news block to see the exact settings too.

[Leppie]

This may seem obvious but allow me to ask this please: Are you completely sure that you were viewing the portal page not with your own account and as a guest (logged out), when you saw the posts from restricted boards?

I was viewing the board as a regular member, not an admin nor guest. But not even regular members should be able to view the admin board, let alone the contents of messages in that board.

To further debug the issue, create a new board and make it visible only to administrator group. Then post some topics in that board and see if they'll appear on the board news block. If you can keep it like that for some time, I could see it for myself as well. It would help a lot if you could get a screenshot of the block edit page of board news block to see the exact settings too.

I have created a test board for this purpose, but as mentioned before there is a restriction on the boards that are processed by the "Board News" and "Recent Topics" blocks. I've included the "Testing" board in the list for "Board News", but the message is clearly visible using my normal user account.
Anyway, I've attached a couple of screenshots that may help explain the situation.

[Leppie]

[SiNaN], I don't know if it would help, but I could send you the credentials of one of our test accounts.
Or, you can even register a new account yourself.

[[SiNaN]]

I think I now have an idea about what might be going on. Could you see if this change fixes the issue for the board news block?:

Sources/PortalBlocks.php

Code: (Find) [Select]

WHERE ' . (empty($board) ? '{query_see_board}
AND t.id_first_msg >= {int:min_msg_id}' : 't.id_board IN ({array_int:current_board})') . ($modSettings['postmod_active'] ? '

Code: (Replace) [Select]

WHERE {query_see_board}' . (empty($board) ? '
AND t.id_first_msg >= {int:min_msg_id}' : '
AND t.id_board IN ({array_int:current_board})') . ($modSettings['postmod_active'] ? '

[Leppie]

Trying the change. Will be back in a couple of minutes.

[Leppie]

I now get a Database Error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'AND t.id_board IN (1, 63, 86, 47, 8, 61, 6, 9, 7, 51, 85, 2, 52, 13, 12, 16, 82,' at line 6
File: /var/www/clients/client1/web4/web/Sources/PortalBlocks.php
Line: 1311

Note: It appears that your database may require an upgrade. Your forum's files are currently at version SMF 2.0.5, while your database is at version 2.0.3. The above error might possibly go away if you execute the latest version of upgrade.php.

[[SiNaN]]

Hmmm, that's interesting. Can you attach the PortalBlocks.php file that you get the error with?

[Leppie]

Here's my PortalBlocks.php.

[[SiNaN]]

The code you have there in that file looks a little different from what I've suggested.

Code: (What you have in the file attached) [Select]

WHERE ' . (empty($board) ? '{query_see_board}
AND t.id_first_msg >= {int:min_msg_id}' : '
AND t.id_board IN ({array_int:current_board})') . ($modSettings['postmod_active'] ? '

Code: (What I suggested) [Select]

WHERE {query_see_board}' . (empty($board) ? '
AND t.id_first_msg >= {int:min_msg_id}' : '
AND t.id_board IN ({array_int:current_board})') . ($modSettings['postmod_active'] ? '
It shouldn't cause any errors if you make sure it looks exactly as I suggested.

[Leppie]

It shouldn't cause any errors if you make sure it looks exactly as I suggested.

Ooops... you're absolutely right. 
This seems to work indeed 

I'll solve the topic for now and test a bit. Many thanks for the fix

[[SiNaN]]

It's okay. You're welcome! It seems that board news block will ignore permissions once you explicitly define the boards to fetch the posts from. Something to change for the next version.

What about Recent Posts/Topics block? Are you still having problems with that one too?

[Leppie]

It's okay. You're welcome! It seems that board news block will ignore permissions once you explicitly define the boards to fetch the posts from. Something to change for the next version.

I had to explicitly define the boards to fetch as otherwise the contents of the staff boards would be available to the whole world. Now with or without explicit definition of what to fetch it behaves as expected. 

What about Recent Posts/Topics block? Are you still having problems with that one too?

The Recent Topics block doesn't seem to be doing this anymore. Maybe by changing some other settings it's been restored to what it should be.

[[SiNaN]]

If everything is working fine for you, it's all good then.

[Leppie]

It is indeed.
If you're ever in London, I'll buy you a beer.

[[SiNaN]]

Thank you! It's a place I really want to visit. I'll take you up on your offer if that ever happens. I'm more of a coffee person though.

[Leppie]

Coffee it is then