How can this be happening?

[LynnB]

I changed guests from being able to browse the forum to not being able to. When I log out, I see only a login screen, nothing from the boards. Yet, when I look at users online, I sometimes see that this or that guest is viewing a specific topic. How can they have gotten past that login screen and into the forum?

[Illori]

they are attempting to view the topics/boards but they fail to actually see the stuff as you proved in your test. the who's online list does not know the difference in a failed attempt and actually being able to view the stuff.

[LynnB]

Illori, You know, I considered that, but then I thought, "how could they even make the attempt?" They can't even see forum and board names let alone topic titles. There is nothing to click on to even make an attempt. So how can users online be showing them in a topic?

[Illori]

it is not too hard to guess a url to a topic, all smf forums use the same urls for boards and topics etc.

[LynnB]

I see. Does that mean they are able to get all the way in and read posts?

[Illori]

no if the permissions are setup correctly they can only see what you allow. test it yourself.

[LynnB]

You're right. I tried a url to a topic and it just took me to the login screen. But right now I have a guest viewing forum stats where there are links to all topics. If I can't get there, I don't see how he can. Does 2.0 give more control over guests? What I would really like to do is let guests in general browse the forum, but restrict certain IPs. Now I can only do that if they are registered and logged in.

[Illori]

you can ban ip addresses but there is no real way to set permission per ip address