Skip to:
Content
Pages
Categories
Search
Top
Bottom

BBPress 2.0, [bbp-topic-index], anyone can see hidden/private topics


  • Ronald Rogers
    Member

    @ronald-rogers

    It’s pretty much all stated in the title.

    There doesn’t appear to be anything preventing guests from seeing hidden or private topics when the [bbp-topic-index] short code is used.

    There is a forum on the site that only people that can view private forums are supposed to know about. You can’t view the topic’s contents, but the existence of the forum is nevertheless betrayed in the index.

    I was able to fix the problem by adding a check in the loop-single-topic.php template file.

Viewing 6 replies - 1 through 6 (of 6 total)

  • John James Jacoby
    Keymaster

    @johnjamesjacoby

    Need more information to try to duplicate. The topics/replies in private/hidden forums are explicitly hidden from every query bbPress runs, unless the current user has the ability to see them.


    Ronald Rogers
    Member

    @ronald-rogers

    Just realized topics can be marked as private.

    Sorry for being unclear.

    I have a _forum_ marked as private but the private forum’s topics are still showing up in the topic index.

    Note that the topics themselves are not marked as private (when they are, they are hidden from the topic index as expected).

    When you try to access the topic, it cannot be viewed unless you can view private forums.

    Looks like a hairy problem to fix properly…


    Ronald Rogers
    Member

    @ronald-rogers

    Ok, I’ve narrowed down the problem a little more.

    The forum itself is not marked private, one of the forum’s parent forums is (in my case, a category).

    The problem occurs when a forum’s topics show up in the index even when one of the forum’s parents is marked private.

    Note that the topic remains inaccessible when you try to view it from the index (defeating the purpose of displaying it there at all).

    So I’m guessing it is still bug, but one can easily work around it by changing all of the child forums of a private forum to private as well.


    John James Jacoby
    Keymaster

    @johnjamesjacoby

    So, as weird as it sounds, this is by design. The ability to stagger the forum privacy is a feature, and the ability to walk up the forum tree for every topic and check it’s visibility is currently too labor intensive to do.

    The obvious fix is not to have public forums within private forums.


    Ronald Rogers
    Member

    @ronald-rogers

    Well the odd thing is that, though the topic and the forum are public, because it has a parent forum that is private, the topic cannot be viewed without the proper privileges, even though it shows up in the index.

    This might just be an oddity with my setup, I do not know.

    Anyways, thanks for the help.


    John James Jacoby
    Keymaster

    @johnjamesjacoby

    Some checks are done to check ancestry in some places to prevent total exposure. It’s a tricky balance to strike, and one that won’t start to be fully baked in until 2.1.

Viewing 6 replies - 1 through 6 (of 6 total)
  • You must be logged in to reply to this topic.
Skip to toolbar