Category Permission Confusion, Possible bug

matthewkris

I'm confused on how category permissions work. I'm trying to create a Staff category that only Mods and Admins can view and use.

Here is what I'm presented with:

http://i.imgur.com/6IGNN.jpg

What I am to make of this? It appears that the options are duplicated. Please help.

matthewkris

According to this page, http://vanillaforums.org/docs/managecategories, my headers are messed up and just read "Default Category".

Is this a bug? I've not modified any core elements.

tjforsythe

I've had that problem. They are your roles. Go to your roles config and look at the order they are listed. You should then be able to go pack to your permissions figure out which is who. After I saved it, it was correct the next time I accessed it.

matthewkris

Yeah it looks like if I create a new category the role labels don't display properly. Once I added the category and return to edit them they appear, which now leads to a new issue. I've set them up to so that this new category is viewable only by Mods and Admins. I save it and it works fine, but when I return to edit the same category all options are restored. Another possible bug?

All of this on 2.0.17.8 (upgraded from 2.0.17.7). No mods and or additional plug-ins.

jrapage

Beware! I had problems too when setting up a hidden 'moderator' board.

The Roles & Permissions pages do enact the settings correctly, but if after making changes (e.g. switching 'View' off for certain groups) you go back and look at the permissions again, the page defaults the View column to 'on' even if in the database the setting is off.

This is a @bug in the way the Roles & Permissions page renders, ignoring the true state of the board.

I've found dozens of these niggles with Vanilla 2. The amount of formal testing this software goes through seems woefully inadequate. It's a shame because the design is fantastic.

Lincoln

@matthewkris Yes, this is a filed issue on GitHub. Sorry for the confusion.

@jrapage You're saying the boxes re-check themselves but the permissions apply correctly?

matthewkris

My boxes also recheck themselves.

Lincoln

OK, but can you say whether the permission apply?

matthewkris

Yes they do apply.

Lincoln

@Mark you have a couple important bugs in the new categories here.

jrapage

@Lincoln yes, I verified by monitoring the database entries. It's simply an issue of the page ignoring the actual settings and populating the 'View' (checked) regardless. It's annoying but not a show stopper, unless of course you have secret-squirrel Categories and accidentally forget to uncheck them all every time :)

barnsy

Am so glad that someone else has encountered this category permissions problem, as I thought I was the only one.

@mark On the topic of 'secret-squirrel' categories, I've noticed that I can succesfully set up a category that only Mods and Admins can see, post, view etc (despite the permissions confusion above). However, every comment that is posted in a thread under the 'secret-squirrel' category shows up in the Mods' and Admins' 'Activity' log - for *everyone* to see.

For me this is a show-stopper, and is preventing me from upgrading from Vanilla 1 to Vanilla 2.

@matthewkris - can you confirm this unexpected behaviour on your forum?

barnsy

@jrapage - how about you? Do you also notice that the comments in the 'hidden' moderator board aren't so hidden afterall and can be seen by everyone (including non-Mods) in the 'Activity' log?

If anyone has a solution to hide this Activity, or turn off Activity completely, please do let me know.

Thanks

jrapage

@barnsy - yes, you have to implement the code fix from the branch that @Lincoln stated above.

Albert

@barnsy
I have the same problem...

http://vanillaforums.org/discussion/14828/profile-permission-problem-viewing-comments#Item_2

matthewkris

Wow! All of my private category posts are available to the public under the user activity. This is a HUGE deal and I've since had to delete the entire category as it contains stuff private to our staff. Great...

This is a critical bug and a patch should be released ASAP.

I am seriously one more huge bug away from tossing Vanilla.

@barnsy confirmed. :(

luc

Wow! All of my private category posts are available to the public under the user activity. This is a HUGE deal and I've since had to delete the entire category as it contains stuff private to our staff. Great...

This is a critical bug and a patch should be released ASAP.

I am seriously one more huge bug away from tossing Vanilla.

@barnsy confirmed. :(

I think this one is what's fixed by this:
https://github.com/vanillaforums/Garden/commit/bfe5fbae87ef7b0521297b9afacf115648bdf688

matthewkris

@luc Thanks.

While I'm able to patch it myself, this seems like something that should be put out there in a point release.

luc

Indeed, let me know if it fixes it for you.
If so, I'll patch mine myself too tonight when back from work :)

Albert

Patch work for me :-)

I'm really happy now :-D

jrapage

Seems there still may be security holes with private boards in the Activity feed.

I just got a bunch of email notifications about threads on this subject, but they are mysteriously missing from here now. Seems a member got banned and maybe his question got nuked. Not cool?

http://vanillaforums.org/discussion/comment/147376#Comment_147376

UnderDog

Seems a member got banned and maybe his question got nuked. Not cool

No, that guy had just 2 posts per user that he created, nothing special. If you know a thread that's going on about security holes in activity, just let me know in a PM.
Let's get back on topic

barnsy

Hello all

I'm about to finally upgrade my forum from Vanilla 1 to Vanilla 2. I had previously installed a test version of 2.0.17.6 and discovered the issue with private category posts being visible in a user's activity feed.

I noticed that a code update had been released on github (thanks @luc for the link) which patched the problem.

Like @jrepage above, I too received some email notifications suggesting this may still be an issue as at November 2011.

Can contributors to this thread, or anyone else who is running 2.0.18.2, confirm that this issue has been addressed in the core?

On a related topic, users on my existing forum have made extensive use of the 'Whisper' feature which came with Vanilla 1. Some of the whispers contain sensitive information (not quite 'national security sensitive', but 'private' nonetheless).

Can anyone explain how 'whispers' are treated in the export/import process when upgrading to Vanilla 2? and if they become part of the private messaging system, whether they remain private between between the author and recipient and not visible in an activity feed?

Thanks all!

x00

@barnsy

I check thed activity, it doesn't show publicly, private category activity as far as I can see.

barnsy

Thanks @x00

Anyone have any advice on how whispers are treated in the export/import process?

Thanks!

x00

I know that they are not quite equivalent.

V2 whispers are more like linked conversations.

barnsy

Thanks. Yeah I've read that whispers have now become private conversations and I really like that new feature.

I'm more wondering how whispers are handled when I export my V1 whispers and import them into V2 - are they changed to private conversations automatucally? (I'd hate to see whispers appearing as regular comments!...)

x00

barnsley I have done a Porter fork script called Porter Plus, it has several options. It is sponsored by a member on this forum. here is a screenshot:

Note:utf-8 didn't turn out to be that useful,yet.

Unfortunately I'm unable to releasing it yet because, he want do do some other stuff not related and it is taking a long time. There is still the arbitrary search and replace 9includign regular expressions) of post sponsored. I doesn't really make much sense to release without this, as I would have to undo the work.

Beauty of sponsored development is anyone can sponsor, it doesn't have to be one person, and it helps open source along.

If you have any features you would like, and would like to sponsor the search and replace, let me know. honestly I just want £15 for s&r, I want this over with so I can release a copy of it, then other can see and get involved.

You can see some of my plugins produced through sponsored devleopment.

x00

To answer you question. it doesn't import whispers at all.

If you would like to import whisper as conversations, this might be something you might sponsor.