IMPORTANT! Serious bug in 1.1 RC2-3

[bkLife]

After chatting to a user of my site - www.play-fm.com [nofollow] - i was alarmed when i learned that all visitors had "access" to posts posted in hidden forum boards. Ergo texts i have written in my admins-board (where we discuss 'secret' stuff the rest of the world shouldn't see and read) is to a certain extent visible to even a guest!

Please fix this at once, and notify everyone who might be affected by this!

[Simplemachines Cowboy]

Set your permissions correctly.

[bkLife]

They are set correctly, i just doublechecked them 5 minutes ago!

[kegobeer]

How about a link to your forum, and an example of something we shouldn't see.

[bkLife]

I am currently updating my forum, but have a look at anyway.. http://www.play-fm.com/no/forum [nofollow]

In the search box enter "fmnorge"
You will see results from a forum board named "Styrerommet" = "The Board Room" Norwegian/English

[bkLife]

Or, you probably wont since i disabled the entire search function, but for you guys ill enable it for a short while..

[kegobeer]

I can't duplicate this on my RC3 test install.  Is this a fresh install or did you upgrade to RC3?  Do you have global or local permissions for your boards?

[kegobeer]

Are you using the most up to date language files?  If you switch to English does this still happen?

[Skipdawg]

Looks like you fixed it. I did the search and it takes me to registration.
Yea all you have to do is ensure permissions are set correctly for each board and each user group. 

[bkLife]

Nope, sadly the bug is not fixed..

What i have done is disable the search engine, something that is NOT acceptable for more than a short period of time!

[Harzem]

Can you please enable the search for me and I'll search for "fmnorge" and try to see what you are saying.

[Owdy]

In the search box enter "fmnorge"
You will see results from a forum board named "Styrerommet" = "The Board Room" Norwegian/English

You did try this as guest, right?

[bkLife]

Correct!

[H]

Do you have caching enabled?

Is it just the one secret forum in the search or all of them?

[bkLife]

Cache is NOT enabled.

Yes, "Styrerommet" (English: The Board Room) is the only secret forum.

[kegobeer]

Are you using the most up to date language files?  If you switch to English does this still happen?

[bkLife]

Jepp, the problem is exactly the same with english language activated.

check the bug for yourselves at http://play-fm.com/no/forum/index.php [nofollow]

Insert "fmnorge" into the searchbox, you will be shown previews of messages from the hidden forum board "Styrerommet"

[Skipdawg]

Well maybe you have something cached in your browser. I get sent to the registration page when I click on what is found.

And I have no such issues with any of my 3 forums. All 1.1 RC3

[Joshua Dickerson]

Do you have any mods installed? What theme are you using?

[jacortina]

Well maybe you have something cached in your browser. I get sent to the registration page when I click on what is found.

And I have no such issues with any of my 3 forums. All 1.1 RC3

That is not what he's pointing out. Snippets of posts from a private board are being shown. As you yourself say, it's there to click on and it shouldn't be.

No content, even a few words, should be shown to those who haven't the access rights/permissions to see those.