Guest is viewing PMs if ./?action=pm is loaded by them

[lucb1e]

A friend of mine closed a forum, but looking in the Who's Online section (as admin) it appeared as if a guest was reading their PMs. I tried to reproduce it on a SMF 1.1.x forum that I knew, but it didn't work. Trying on the friend's forum, running SMF 2.0.2, as soon as I loaded smf/index.php?action=pm, I showed up as reading PMs. The forum is in maintenance mode, so that was kind of confusing.

Not an important bug, but perhaps something to patch in a future release.

Thanks,
Luc

[Arantor]

What's to patch, exactly? It's working exactly as designed.

The session is recording the fact that a user is visiting action=pm. Who's Online looks up the action that a user is performing and displays the action attached to that URL - it doesn't go through and verify whether the user has permission to be able to do that, because that would potentially mean dozens of database queries to figure it out.

[lucb1e]

It has to figure out whether the user is allowed to view the page anyway, so that doesn't impact anything. What's to patch is that it's confusing to see that a guest, a non-user, is viewing their PMs. My first idea was this bug, but the only other option would be a leak in the software that allowed guests to view other people's PMs. Or their own, which should also not be allowed during maintenance mode. Changing this behavior might just save some people a headache

[emanuele]

I would simply remove the "Who is online" page.
That would save much more headaches.

[NanoSector]

I would simply remove the "Who is online" page.
That would save much more headaches.

Got to agree with this, really. The page has caused way too much confusion.

[Arantor]

What's to patch is that it's confusing to see that a guest, a non-user, is viewing their PMs.

If only it were actually a bug, but like I said, it's not. It is truly by design. The page doesn't go and validate that the person viewing the page actually has the permission to view that page - all that's recorded is that the user did in fact visit that page.

There's no bug, only a misunderstanding.