News:

Wondering if this will always be free?  See why free is better.

Main Menu

Guest posts

Started by 2sanstef, October 04, 2008, 04:03:17 PM

Previous topic - Next topic

2sanstef

I have set up my forum to be accessed by guests but they need to register if they decide to post. This seems to work fine on my own PC. However, I have one guest who seems to be able to post on the site without being registered. Any clues??

www.sanstefanos.co.uk/smf/index.php

Crasy

Quote from: 2sanstef on October 04, 2008, 04:03:17 PM
I have set up my forum to be accessed by guests but they need to register if they decide to post. This seems to work fine on my own PC. However, I have one guest who seems to be able to post on the site without being registered. Any clues??

www.sanstefanos.co.uk/smf/index.php

Are they able to do this on only one specific board?
Have you tested out trying to post while posing as a guest yourself?
You're sure this person hasn't registered, posted and then deleted their own account? That could be possible and would int he end result show her as a 'guest'.

2sanstef

NO they seem to be able to post on a variety of boards, also seem to be the only guest who does so.  I have tried from my own PC as a guest and I do not have an option to post.

Crasy

Quote from: 2sanstef on October 05, 2008, 03:47:59 PM
NO they seem to be able to post on a variety of boards, also seem to be the only guest who does so.  I have tried from my own PC as a guest and I do not have an option to post.
They are continuing to make more posts as a guest?
Or are all of the posts from the guest made in the past?

2sanstef

They continue to make posts, last one I can trace is the 3rd October. Thinking about posting a note asking them to use the contact us option on the website and getting into a dialogue outside of the forum to enquire have they ever registered, what options do they have when viewing the forum. They seem harmless enough.

Crasy

Quote from: 2sanstef on October 06, 2008, 06:20:16 PM
They continue to make posts, last one I can trace is the 3rd October. Thinking about posting a note asking them to use the contact us option on the website and getting into a dialogue outside of the forum to enquire have they ever registered, what options do they have when viewing the forum. They seem harmless enough.

I don't get it...
I can't post on your forum as a guest...

2sanstef

I know so why has Paulene Dean been able to (see last post on the Out and about board) and other boards, its certainly baffled me as well!!

Deprecated

Are you sure that they didn't have an account, posted, then you or somebody else deleted the account?

I even tried a bit of URL hacking and I couldn't post.

Also, do you have any kind of SSI set up?

2sanstef

Sorry what do you mean by SSI??

Deprecated


genieuk

This could be possible i think thou,

a specific website that helps people to save money, advice and so on tells you have to get into sites without needing to register you would just appear as a guest but gives you access without the need of registering, it takes a matter of mitters to configure in browser, not tried it myself and not sure how it works but it can be done, just complete hidious and not nice, if a member wants to post why dont they just register.

Mat

Deprecated

Please post or PM me the URL that describes what you are discussing. If I can find any way to use the data to guest post at an SMF site I'll figure out how to prevent it and post a bug report.

genieuk


Deprecated

Well thanks, but I can't find anything SMF related on the site, and the search box didn't bring up anything I could see that was SMF related. If you have a specific URL that points directly at a post telling how to post on SMF without registering, please PM that, or otherwise all I can say is thank you for going to the trouble to PM me.

genieuk

Well like i said i am looking. The site was hacked a while ago probably about 2 weeks, if you look it did say on there site they was hacked.

I am also not saying specifically SMF all i was saying that i did see a hack in where they do something in there browser settings to make a website think there are registered and it allows them access, I hope it was not lost and i find it to prove it. I dont know exactly what they can get into with the hack but i do remember reading it can get you into alot of websites.

Sorry for confusion as i did not mean there was a hack specifically to post on SMF boards without registering i meant there was a hack i seen that gives people access to sites that require registering but without having to register.

It may or may not work i dont know but it does get me concerned that with a few tweaks in your browser you may be able to access sites without needing to register.

Deprecated

It would take more than tweaking your browser to hack a guest post at SMF.

Well please let me know if you discover anything related to SMF, or contact one of the SMF people who does security stuff and tell them.

We certainly don't want any loopholes in our SMF. :)

genieuk

I totally agree.  ;)

I cannot find it so it may have got lost when there servers was hacked.

Deprecated

I have received some communications verifying that this is a security vulnerability of SMF 1.1.5 that was fixed with the new SMF 1.1.6 release. There is an available attack script, so it is urgent that anybody running 1.1.5 should upgrade before some script kiddie takes your forum away.

So there is no need to investigate any vulnerabilities. It was already fixed, and the energy should be focused upon encouraging all 1.1.5 forums to upgrade ASAP.

2sanstef

Found the answer.

The member in question was a registered member but then for some reason their account turned into a guest until it was re-activated??

Advertisement: