AOK Forum - The Prop Den

[NoHumorMan]

We still have the issue that non-staff members can view our hidden, staff only sections, no matter how much we mess with the permissions.  The phpBB3 permission settings are so complex that it isn't enough just to fix the settings once, you have to go in to each user's account and fix settings and with as many users that we have it is getting impossible to manage.  Maybe we are doing it wrong, but when we set a section to admin only, then that should be for admin only and should override all other settings everywhere and in all accounts, and only allow those who are set as admin to be able to view.

How do we make this happen, because we've heard from several now that they can view the section, even though they are not supposed to.

[NoHumorMan]

Any help on this would be appreciated, as our security isn't secure when regular members can view out hidden sections even though the permission settings show that they shouldn't be able to.  When checking a user's permissions it also doesn't show that they can see those sections, but we get notices from several members that they can in fact both view and browse the section, but mostly report that they cannot read the threads.  This is a serious security breach that we simply cannot figure out how to fix.

[ForumMate]

I am not an expert on phpBB permissions I would try asking on phpbb.com if there is a flaw with our system I will look into it and fix it.

[NoHumorMan]

Having just asked on the phpBB support forum they think the issue lies with the system you are using.  After having digged a bit more into the issue the users in question doesn't appear to be able to view the hidden forums on the main page, but can read the titles of the posts from those sections in the View Active Posts option in the top left corner under the banner.  According to our permission settings users with No Access shouldn't be able to view posts from those sections in that active topics list, so somewhere lies a glitch that makes that possible.  I will work with them some more to prune our permission settings to make it perfect and if the issue still happens they would like you to contact them on their support forum in the thread I made there.

[NoHumorMan]

Help required to fix this issue.  Please.

[ForumMate]

Do you have a link to the topic on phpbb.com?

[NoHumorMan]

http://www.phpbb-seo.com/en/phpbb-forum/article9609.html

And here's the thread on phpbb.com, however, they said your system came from the above provider and not theirs: https://www.phpbb.com/community/viewtopic.php?f=46&t=2223961&sid=cfbafe8d0594096b43b70caa3898c8f4

[ForumMate]

Ok seems tricky I was not aware the phpBB seo was a whole different set of phpBB files I thought it was just an addon...hmmm

[NoHumorMan]

From what I understood, then the issue must originate from phpbb-seo.com as posts or thread titles from hidden sections shouldn't be visible in the active topics list, according to phpbb.com, but I haven't had a reply from the -seo service yet.  Maybe you'll have more luck, or perhaps switch the service.

Could you also inquire why they felt the need to make a simple, functional system that worked into the most head scratching complex mess where the same feature can be corrected from 6 different sections of the Admin Panel and where you can never be sure what's messing with what?  The previous system was so easy to figure out and operate... this is like a nightmare.

[NoHumorMan]

The phpbb-seo support has a suggestion for a possible fix that sounds rather invasive, but can you look into it?  This issue is getting really annoying.

Or, you could switch to the actual phpbb.com service and escape oddities in the software.

[NoHumorMan]

Besides the permission security issue, we also have a problem with mass e-mails.  When we try to send those to alert our members of things happening on the forum it just blanks out.  It refuses to send them.  Can this be looked at?  We probably have many "dead" e-mails, but how can we get the system to ignore those when it finds them and then send e-mails out to the rest?  If it could then sort the members with dead e-mail addresses in a list, so we can find out who they are and potentially contact them in other ways to get them to change the dead e-mail address with a valid, functional one?

[Paul]

Hi mate, I will just go and read those topics in the links you provided and get back to you.

Seems odd that only your frum is having these issues so I assume it is just an error in the way your individual forum has its permissions set.

back soon

[Paul]

Hi mate, I have just joined as Paul@support, can you tell me which of the hiden I should not see

[NoHumorMan]

The highlighted post should not be visible to anyone in the active post list.  They cannot access the post, but they can read the title.  But even that is too much info sometimes.

Both the section highlighted below - The Board Staff Lounge - as well as the other staff section - The Mod Squad - has post titles showing up in the active posts list.  We do not want that to happen.  It doesn't appear they can otherwise view, read, or post in the actual forums - the issue is only in the "view active posts" list, apparently.

[Paul]

From what you say above you could have identified the problem, "Active posts"

Just give this a try
ACP > FORUMS > select those forums you mention and see if ...

Display active topics:
If set to yes topics made to this forum will be shown in the active topics list.

....is set to yes, if it is set to no and it will not display in the active topics list.