Search function allowing user to find private forum posts

[ctslacker]

I'm running 1.1.5, and when my users search for something, they are receiving search results of posts that are in private forums.  The users don't have access to the forums, and according to the Search page, they can't search them, but they still get the results from other private boards.

If they choose "show results as messages" they get the full text, which shouldn't happen.

Help?

[Sverre]

This is now the fifth time I've seen this reported, but as you can see in the following threads, it appears that the problem has yet to be resolved.

http://www.simplemachines.org/community/index.php?topic=88762.0
http://www.simplemachines.org/community/index.php?topic=116008.0
http://www.simplemachines.org/community/index.php?topic=167349.0
http://www.simplemachines.org/community/index.php?topic=207095.0

Hopefully, the cause of this mysterious behaviour can finally be revealed this time around.

[ctslacker]

That would be very nice.

[Antechinus]

Ok, I haven't heard of this. I'm going to test it on my forum too. Sounds like a very serious bug if it's widespread.

ETA: Just having read all those links it looks like the problem can be hard to repeat for testing, which would indicate that maybe it isn't caused by SMF itself but by a configuration problem either in admin or the server. I'll still try it at my place on a test account and see what happens.

[Sverre]

As I've said in some of the other threads, I've not been able to reproduce this on any of my own installs, hosted on three separate systems, so my guess is that it must be something with the server configuration - taking into consideration that one of the reported cases happened regardless of a search index being used (http://www.simplemachines.org/community/index.php?topic=88762.0), and another one (http://www.simplemachines.org/community/index.php?topic=116008.0) pretty much confirms that it wasn't caused by a permission related user error.

[karlbenson]

As far as I'm aware every instance where this has been reported in the past isn't due to a bug in SMF but either
- incorrect child board permissions
(where the parent board is private, the child board isn't made private, however since its parent is hidden, it isn't shown on the boardindex, and therefore admins assume that the child boards are private).
- mod related
(where the mod doesn't affect search/recent posts, unread posts).
- bug in a mod
(there is one in frustrate guests which does this, which is why the mod was removed)

[Sverre]

Karl, how would you explain bkLife's case (http://www.simplemachines.org/community/index.php?topic=116008.0) then? At least according to his own posts, it couldn't have been mod related, and I can confirm that it wasn't a case of incorrect (child) board permissions.

[ctslacker]

As far as I'm aware every instance where this has been reported in the past isn't due to a bug in SMF but either
- incorrect child board permissions
(where the parent board is private, the child board isn't made private, however since its parent is hidden, it isn't shown on the boardindex, and therefore admins assume that the child boards are private).
- mod related
(where the mod doesn't affect search/recent posts, unread posts).
- bug in a mod
(there is one in frustrate guests which does this, which is why the mod was removed)

Ok, some points to help illustrate my issue.

For testing:  Navigate to Search, select "show results as messages" if you want.  Then type a search term that you know exists in a private forum.  I received search results from my private forums.

1.  The private forums that I receive results from are not child-boards of any other board.
2.  Mods I have installed are: Flashchat, SMF Gallery Lite.  The issue was reported before I installed the gallery.

This is definitely a weird situation, but it seems like it happens fairly regularly.

[karlbenson]

If you don't mind pm'img me a username/password to an admin account, I dont mind taking a look at your various permissions.