Icy Phoenix

Hi, I put it in here because I think it could be a bug...

I try to summarize what was this four hours-to-solve problem :D


Well, in portal and in forum index I have the Quick Links block. I modified it in order to let some link to be shown only by admin, here's the code:





and





and in "Info" section




Very simple, I just used the user_is_admin switch in order to disable some links to users.


Yesterday, navigating the ACP I saw two users playing sudoku, which should have been disabled (I'm monitoring query usage, XS is not kinda... light :D ), as you can see from the code. I checked the code but I was sure nobody (other admins) had touched it, and so it was. I tried anyway to change something in the code just to see what happened when I saw a thing that astonished me: users and guests could see ACP link and try login.


I spent a lot of time looking for some error in the code but I was wrong 'cause the problem wasn't there. But changing the nav_quick_links.tpl I could see that the Quick Links block in forum index was modified by my changes and the block in portal index wasn't.


So I found it was a caching problem.


So, caching THAT block in portal (I suppose in forum index it's not cached?) causes a very "funny" thing... If I empty the cache I can see what follows:

- Empty cache, an admin logins and load the portal, even guests can see all links.

- Empty cache, a user (even guest) without admin privileges load the portal, admin doesn't see the links as if he wasn't admin.


In a few words first to come decides... :mrblue: (now I'm laughing 'cause I don't want to bore you more than necessary, but I stayed up till four am :( )


Ok then... I solved for now disabling caching system, but this obviously causes my portal index to generate more than FIFTY queries... and I cannot effort such amount.

Another solution could be totally remove the links... but I'd like to solve it less brutally...


Sincerely I don't know when this thing started, I found it yesterday. Anyway I don't think it has always been like that 'cause when I modified the switch I tested it as admin, user and guest and all worked fine.




Well I think it's all... any suggestion?

I think this could be a big security problem... ALMighty Gorgon, are you there? :mrviolet:

This hasn't happend to me, and I also have added mg_switch_user_is_admin to some parts of nav_quick_links.tpl. I have two thoughts here.

1) How sure are you that normal users could see these links? If you are logged in as admin, then ofcourse you will see all these links. I use a test user account with normal user priveledges to check out any changes I make. At the very least, see what happens to nav quick links when you have logged out.

2) Regular users will probably have bookmarked these areas of your site, or else will go by the browser history. Simply hiding links will not prevent regular users from accessing those areas! Unfortunately there are no view permissions for some items, like sodoku, but it isn't hard to add. As it sounds you are not afraid to tweak, you can try encasing the entire tpl of soduku.tpl within <!-- BEGIN mg_switch_user_is_admin --> Do this after:
Then add <!-- END mg_switch_user_is_admin --> at the bottom, after
but before <table>...
(this is a quick fix - I would be inclined to add another switch for normal users, that enabled a message to be displayed, such as "You are not authorised to access this"... this would require some extra logic within sodoku.php (or even page_header.php) to check that user is not admin, then parse an appropriate template variable. This is done as follows. In includes/page_header.php, a line before $template->pparse('overall_header'); add:



and then in sodoku.tpl, after <!-- END mg_switch_user_is_admin --> add:


Let me know if that works!

First of all, thanks for the answer ;)

moreteavicar wrote: [View Post]

This hasn't happend to me, and I also have added mg_switch_user_is_admin to some parts of nav_quick_links.tpl. I have two thoughts here.

1) How sure are you that normal users could see these links? If you are logged in as admin, then ofcourse you will see all these links. I use a test user account with normal user priveledges to check out any changes I make. At the very least, see what happens to nav quick links when you have logged out.

Oh God... maybe I'm noob but not SO much... :roll:

Of course I checked logging out (as guest), with my own test account and with 3 other users too... I wouldn't post here if I wasn't sure ;)

Quote:

2) Regular users will probably have bookmarked these areas of your site, or else will go by the browser history. Simply hiding links will not prevent regular users from accessing those areas!

This could be right if I hid those links AFTER they accessed them... but since I opened the site they've always been hidden. Switched worked, I tried it personally (as guest, test user and bla bla bla ;) ) and even if cached it showed a different quick links block for admins and for others.

The switch stopped to work yesterday apparently without reason. It seems that having cached the block, it loads the page without checking whether user has admin privileges or not (ONLY FOR THAT BLOCK IN PORTAL).

Quote:

Unfortunately there are no view permissions for some items, like sodoku, but it isn't hard to add. As it sounds you are not afraid to tweak, you can try encasing the entire tpl of soduku.tpl

Uhm... mine is not a sudoku problem :mrgreen:


Even if I upload the original nav_quick_links.tpl the switch doesn't work for that block when loaded in portal (this in bold is quite important)


You know, ACP link should be disabled by default (to normal users)! And it is visible to guests too... I really don't think that fixing the entire sudoku.php could help... actually, I appreciate your suggestions and I'm not afraid to tweak of course ;) but I don't think I need a workaround, because the switch worked till yesterday. Couldn't it be "simply" a caching problem?

I'm not a programmer, don't know if the point is this but in rough words I think that portal page loads the block WITHOUT checking whether user is admin or not. And this is kinda... bad. Am I wrong?

Vortex wrote: [View Post]

Uhm... mine is not a sudoku problem :mrgreen:

Is that so? I thought you said this in your your first post:

Vortex wrote: 

Yesterday, navigating the ACP I saw two users playing sudoku, which should have been disabled (I'm monitoring query usage, XS is not kinda... light :D ), as you can see from the code.

What I am suggesting is a fireproof way to prevent users from accessing sodoku, and likewise the same principle can be applied to anything else you wish to prevent access to. Even if the user sees the option to access it, they cannot use it. Surely thats better: consider also that even if your site is fresh, with hidden options, a user can also access so called "hidden areas" if they have accessed other phpBBXS based sites (or use phpBBXS themselves), because they will know the relative links to access them.

As for the caching issue, I don't think the extreme styles caching system itself will cause that, but to confirm, you can check cache/tpl_ca_aphrodite.nav_quick_links.php - if you see your admin switch lines are in the code, then there is something else not right.

Mentioning caching - are you using the same browser to test these things? How is the browser cache itself configured? Try clearing browser cache / offline content before visiting your site as a guest. I was going to have a peak at your site to confirm this, but I can't find your site details.

moreteavicar wrote: [View Post]

Vortex wrote: [View Post]

Uhm... mine is not a sudoku problem :mrgreen:

Is that so? I thought you said this in your your first post:

Vortex wrote: 

Yesterday, navigating the ACP I saw two users playing sudoku, which should have been disabled (I'm monitoring query usage, XS is not kinda... light :D ), as you can see from the code.

I thought I also said that even guest can try login to ACP and THAT is the problem, IMHO.

Sudoku was just an example of a hidden link, but actually I don't care too much about it... at least not as ACP ;)

Quote:

What I am suggesting is a fireproof way to prevent users from accessing sodoku, and likewise the same principle can be applied to anything else you wish to prevent access to. Even if the user sees the option to access it, they cannot use it. Surely thats better: consider also that even if your site is fresh, with hidden options, a user can also access so called "hidden areas" if they have accessed other phpBBXS based sites (or use phpBBXS themselves), because they will know the relative links to access them.

I know, thanks for that I will try this trick for sure, but my problem now is that ACP is visible to guests too... and that's really not good :D

(and... users of my site don't even know the difference between left and right click... no worry about avoiding hidden links :LOL: )

Quote:

As for the caching issue, I don't think the extreme styles caching system itself will cause that, but to confirm, you can check cache/tpl_ca_aphrodite.nav_quick_links.php - if you see your admin switch lines are in the code, then there is something else not right.

That's exactly what I tried to say... code is ok. Problem is somewhere else... I keep saying could be a caching problem (I'm talking about board's cache )

Quote:

Mentioning caching - are you using the same browser to test these things? How is the browser cache itself configured? Try clearing browser cache / offline content before visiting your site as a guest. I was going to have a peak at your site to confirm this, but I can't find your site details.

I hope you're jokin' me... OF COURSE I tried clearing the cache of my browser and of course I tried it as normal user and guest. I tried also with three more users. I know what I'm talkin' about ;)


Now I manually removed that links till I find a solution so you will not see them... anyway: www.kope.it is the site.


Notice: Site is NOT VISIBLE WITH INTERNET EXPLORER. I applied Explorer Destroyer

if sudoku players bookmarks it then they can play

I don't read all, but my users can not see ACP

disable caches for quick navigation links block if enabled

you must do tests not at one machine or one IP

difus wrote: [View Post]

if sudoku players bookmarks it then they can play

I don't read all, but my users can not see ACP

disable caches for quick navigation links block if enabled

you must do tests not at one machine or one IP

I answered ALL these four sentences. If you want, read ALL before answering, otherwise it's a waste of time for both of us ;)

show me your ACP now

I don't see it

difus wrote: [View Post]

show me your ACP now

You mean I have to reactivate the switch?

Of course, it was disabled... just try now ;)

Here you are ;)

it is too late
yes it is not working
somewhere is error I think
but switch is working for header and footer
can you attach quick links I'll test it

Yeah I gotta go to bed too ;)


Thanks for help anyway, here's the file. Goodnight, see you tomorrow :mrblue:



(I added .gif extension otherwise couldn't attach it ;) )