View rights inconsistently enforced between Profile discussions & comments!

jrapage

If you have Categories that have different View permissions (i.e. non-signed in users may not view), the visibility is not enforced correctly between the following pages:

YOURSITE/index.php?p=/profile/discussions/ID/USER
yes - hides discussions started by the user in categories that are not permitted to view

YOURSITE/index.php?p=/profile/comments/ID/USER
NO! - shows all latest comments by the user regardless of category permissions

This is a *major* privacy/security hole that puts any board at risk that has category view rights assigned to select groups.

Is anyone familiar with the code behind the Discussions and Comments tabs on a user's profile page? The former checks for rights whereas the latter doesn't.

Thanks

Linc

Confirmed. I am fixing this immediately.

Linc

@jrapage The patch is here: https://github.com/vanillaforums/Garden/commit/bfe5fbae87ef7b0521297b9afacf115648bdf688

It will be in the next release, and I'll bring it to the attention of the staff in case they want to do an immediate patch release.

Thanks!

Linc

@Tim @Todd

jrapage

That's great news. I'll apply the patch and report back.

jrapage

Works perfectly.

jrapage

Verified this is fixed in 2.1