Security issue with subcats - E-Blah Community

E-Blah Member
The Mod' King

Posts: 325

Gender:

Male

Posts Per Day: 0.22

Reputation: 91.67%

Reputation Score: +11 / -1

Time Online: 2 days 3 hours 21 minutes

Location: Türkheim, Germany

Age: 20

I'm using Platinum 10.05 and I just discovered a slight security hole that appears when using subcategories. Here we go:

On my forum, I have a subcategory with a few boards in it. The subcategory and all of the boards except for one are public, this one is restricted and can only be viewed by members of a certain member group.

Now, on the board index, it displays the newest thread of the subcategory, and it will also display the thread title of a thread in the restricted board, even if the member wouldn't have access to it.

So basically not a big deal, but members could see thread titles that they shouldn't be seeing, so you might wanna have a look at this one.

Logged

Offline

Justin

October 1, 2006, 8:44pm

The E-Blah Developer
E-Blah Programmer

Posts: 15,075

Gender:

Male

Posts Per Day: 6.52

Reputation: 93.40%

Reputation Score: +297 / -21

Time Online: 36 days 23 hours 27 minutes

Location: Tallassee, AL

Age: 22

Hmm, they shouldn't be able to?

Have you tried this?

If so, can you PM me your forum login data (*JUST YOUR FORUM*). Let me check your security settings.

I do installs for $25 and upgrades for $20.
Technical support is always free.

Donate to E-Blah!

My Websites: Revolution Reality (My Blog) | MinistryTalk.com | Portfolio

"But you, O Lord, are a compassionate and gracious God, slow to anger, abounding in love and faithfulness." — Psalm 86:15 NIV

Logged

Offline

Reply: 1 - 4

Justin

October 2, 2006, 4:53pm

The E-Blah Developer
E-Blah Programmer

Posts: 15,075

Gender:

Male

Posts Per Day: 6.52

Reputation: 93.40%

Reputation Score: +297 / -21

Time Online: 36 days 23 hours 27 minutes

Location: Tallassee, AL

Age: 22

Try this ...

This post contains attachments; to download them you must login.

Logged

Offline

Reply: 2 - 4

Justin

October 2, 2006, 6:44pm

The E-Blah Developer
E-Blah Programmer

Posts: 15,075

Gender:

Male

Posts Per Day: 6.52

Reputation: 93.40%

Reputation Score: +297 / -21

Time Online: 36 days 23 hours 27 minutes

Location: Tallassee, AL

Age: 22

Line 629 (in above file) should be:

Code

			if(GetMemberAccess($grp)) { $sflist .= qq~<a href="$surl\lb-$daid/">$sflname</a>, ~ if($subboards <= 4); }

Logged

Offline

Reply: 3 - 4

Opfer

October 3, 2006, 4:26am

E-Blah Member
The Mod' King

Posts: 325

Gender:

Male

Posts Per Day: 0.22

Reputation: 91.67%

Reputation Score: +11 / -1

Time Online: 2 days 3 hours 21 minutes

Location: Türkheim, Germany

Age: 20

That did the trick, thank you very much.

Logged

Offline