SimplePortal

Support => Install and Upgrade => Topic started by: Leppie on August 21, 2013, 04:22:02 AM

Title: Board News and Recent Topics blocks do not follow user permissions
Post by: Leppie on August 21, 2013, 04:22:02 AM
I've installed SimplePortal 2.3.5 on my SMF 2.0.5 forum, and so far the members are very happy with it. So, many kudos for the good work :D

Logging onto the forum as a normal user, we keep a regular account for staff to use to see what the forum looks like for a normal user, posts from restricted boards were visible and accessible. We have a couple of boards that should normally be available to admins and moderators only, but they appear for the whole world to be viewed using the "Board News" and "Recent Topics" blocks on the portal.
Unfortunately this is a major inconvenience as I would like to be able to show staff all the updates for the boards they can access, but at the same time I do not want those who should not have access, and in particular guests, to be able to read these posts.

Am I missing some setting(s) somewhere, or is this just the way it's implemented?
Many thanks in advance for all the help.
Title: Re: Board News and Recent Topics blocks do not follow user permissions
Post by: Burke Knight on August 21, 2013, 06:30:08 AM
Go edit them, and there will be a list of the boards, unselect them, by holding the shift key and click the board you do not want visible.

If no box like that, then there will be a box to enter the ID's of boards not to display in recent list. There should be Help icons next to them to explain how to use them.
Title: Re: Board News and Recent Topics blocks do not follow user permissions
Post by: [SiNaN] on August 21, 2013, 06:41:41 AM
Welcome to SimplePortal! Thank you for your kind words. :)

Both of those blocks should respect the forum permissions. It's possible that the board access permissions or the blocks are misconfigured. Would it be possible to get a link to your forum to get a better idea about what might be going on? You could send that information to me with a personal message if you don't want to share the link to your forum.
Title: Re: Board News and Recent Topics blocks do not follow user permissions
Post by: Leppie on August 22, 2013, 04:56:35 AM
Thanks for your replies.

@BurkeKnight: As a temporary measure I had already put a restriction on the boards being selected for these two blocks. This obviously is only a temporary solution.

@[SiNaN]: The forum in question is: https://openlinuxforums.org/
As mentioned, I have restricted the selected boards as everything was displayed to everybody using the OOTB settings. If you need more specific details about particular settings let me know.
Many thanks for your help.
Title: Re: Board News and Recent Topics blocks do not follow user permissions
Post by: [SiNaN] on August 23, 2013, 05:10:16 AM
This may seem obvious but allow me to ask this please: Are you completely sure that you were viewing the portal page not with your own account and as a guest (logged out), when you saw the posts from restricted boards?

To further debug the issue, create a new board and make it visible only to administrator group. Then post some topics in that board and see if they'll appear on the board news block. If you can keep it like that for some time, I could see it for myself as well. It would help a lot if you could get a screenshot of the block edit page of board news block to see the exact settings too.
Title: Re: Board News and Recent Topics blocks do not follow user permissions
Post by: Leppie on August 23, 2013, 05:46:20 PM
This may seem obvious but allow me to ask this please: Are you completely sure that you were viewing the portal page not with your own account and as a guest (logged out), when you saw the posts from restricted boards?
I was viewing the board as a regular member, not an admin nor guest. But not even regular members should be able to view the admin board, let alone the contents of messages in that board.

To further debug the issue, create a new board and make it visible only to administrator group. Then post some topics in that board and see if they'll appear on the board news block. If you can keep it like that for some time, I could see it for myself as well. It would help a lot if you could get a screenshot of the block edit page of board news block to see the exact settings too.
I have created a test board for this purpose, but as mentioned before there is a restriction on the boards that are processed by the "Board News" and "Recent Topics" blocks. I've included the "Testing" board in the list for "Board News", but the message is clearly visible using my normal user account.
Anyway, I've attached a couple of screenshots that may help explain the situation.
Title: Re: Board News and Recent Topics blocks do not follow user permissions
Post by: Leppie on August 23, 2013, 05:54:18 PM
[SiNaN], I don't know if it would help, but I could send you the credentials of one of our test accounts.
Or, you can even register a new account yourself.
Title: Re: Board News and Recent Topics blocks do not follow user permissions
Post by: [SiNaN] on August 23, 2013, 06:06:07 PM
I think I now have an idea about what might be going on. Could you see if this change fixes the issue for the board news block?:

Sources/PortalBlocks.php

Code: (Find) [Select]
WHERE ' . (empty($board) ? '{query_see_board}
AND t.id_first_msg >= {int:min_msg_id}' : 't.id_board IN ({array_int:current_board})') . ($modSettings['postmod_active'] ? '

Code: (Replace) [Select]
WHERE {query_see_board}' . (empty($board) ? '
AND t.id_first_msg >= {int:min_msg_id}' : '
AND t.id_board IN ({array_int:current_board})') . ($modSettings['postmod_active'] ? '
Title: Re: Board News and Recent Topics blocks do not follow user permissions
Post by: Leppie on August 23, 2013, 06:07:49 PM
Trying the change. Will be back in a couple of minutes.
Title: Re: Board News and Recent Topics blocks do not follow user permissions
Post by: Leppie on August 23, 2013, 06:12:55 PM
I now get a Database Error:
Quote
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'AND t.id_board IN (1, 63, 86, 47, 8, 61, 6, 9, 7, 51, 85, 2, 52, 13, 12, 16, 82,' at line 6
File: /var/www/clients/client1/web4/web/Sources/PortalBlocks.php
Line: 1311

Note: It appears that your database may require an upgrade. Your forum's files are currently at version SMF 2.0.5, while your database is at version 2.0.3. The above error might possibly go away if you execute the latest version of upgrade.php.
Title: Re: Board News and Recent Topics blocks do not follow user permissions
Post by: [SiNaN] on August 23, 2013, 06:24:39 PM
Hmmm, that's interesting. Can you attach the PortalBlocks.php file that you get the error with?
Title: Re: Board News and Recent Topics blocks do not follow user permissions
Post by: Leppie on August 23, 2013, 06:37:47 PM
Here's my PortalBlocks.php.
Title: Re: Board News and Recent Topics blocks do not follow user permissions
Post by: [SiNaN] on August 23, 2013, 06:41:58 PM
The code you have there in that file looks a little different from what I've suggested.

Code: (What you have in the file attached) [Select]
WHERE ' . (empty($board) ? '{query_see_board}
AND t.id_first_msg >= {int:min_msg_id}' : '
AND t.id_board IN ({array_int:current_board})') . ($modSettings['postmod_active'] ? '

Code: (What I suggested) [Select]
WHERE {query_see_board}' . (empty($board) ? '
AND t.id_first_msg >= {int:min_msg_id}' : '
AND t.id_board IN ({array_int:current_board})') . ($modSettings['postmod_active'] ? '

It shouldn't cause any errors if you make sure it looks exactly as I suggested.
Title: Re: Board News and Recent Topics blocks do not follow user permissions
Post by: Leppie on August 23, 2013, 06:47:51 PM
It shouldn't cause any errors if you make sure it looks exactly as I suggested.
Ooops... you're absolutely right.  :-[
This seems to work indeed  :applause:

I'll solve the topic for now and test a bit. Many thanks for the fix ;D
Title: Re: Board News and Recent Topics blocks do not follow user permissions
Post by: [SiNaN] on August 23, 2013, 06:52:15 PM
It's okay. You're welcome! It seems that board news block will ignore permissions once you explicitly define the boards to fetch the posts from. Something to change for the next version.

What about Recent Posts/Topics block? Are you still having problems with that one too?
Title: Re: Board News and Recent Topics blocks do not follow user permissions
Post by: Leppie on August 23, 2013, 07:07:21 PM
It's okay. You're welcome! It seems that board news block will ignore permissions once you explicitly define the boards to fetch the posts from. Something to change for the next version.
I had to explicitly define the boards to fetch as otherwise the contents of the staff boards would be available to the whole world. Now with or without explicit definition of what to fetch it behaves as expected.  :applause:

What about Recent Posts/Topics block? Are you still having problems with that one too?
The Recent Topics block doesn't seem to be doing this anymore. Maybe by changing some other settings it's been restored to what it should be.
Title: Re: Board News and Recent Topics blocks do not follow user permissions
Post by: [SiNaN] on August 23, 2013, 07:12:35 PM
If everything is working fine for you, it's all good then. :)
Title: Re: Board News and Recent Topics blocks do not follow user permissions
Post by: Leppie on August 23, 2013, 07:15:35 PM
It is indeed.
If you're ever in London, I'll buy you a beer.
Title: Re: Board News and Recent Topics blocks do not follow user permissions
Post by: [SiNaN] on August 23, 2013, 07:30:01 PM
Thank you! It's a place I really want to visit. I'll take you up on your offer if that ever happens. I'm more of a coffee person though. :)
Title: Re: Board News and Recent Topics blocks do not follow user permissions
Post by: Leppie on August 23, 2013, 07:39:55 PM
Coffee it is then  :thumbsup:
SimplePortal 2.3.8 © 2008-2024, SimplePortal