14-02-2005 01:41									#1
	Security Leak - Problem with Forum Layouts Support Apolyton, buy GURPS/ Alpha Centauri

In my experience with previous DGs, posts in the private forums will not show up in any meaningful way in a user's profile. If their last post was in a private forum, then the date and time will be of that post, but the title and thread listed will be their last post outside a private forum.

I think the C3CDG forums show up, though. Both I and other members of Team Babylon had their private forum posts show up in their profiles. To test if this was simply because I have access to Babylon's forum, I checked ormuzd's profile. His last post shows as "Turn 2 - 3950 BC" or somesuch. I would assume this is a thread inside Ankh-Morpork's forum. I did not try to access the thread; hopefully security would still keep me out, but I don't know since trying it out might require me to exit the game till Babylon got a map of their area.

But even if this can't be used to access forums, the titles alone are a problem. If the Ankh-Morpork team had a thread titled "Let's attack Babylon!" I might stumble on to it when viewing their members' profiles. No such thread is going to be started right now (at least, I hope not ) but by the time teams get contact with each other, either this will need to be fixed, or teams will need to use vague and/or code thread titles.

	14-02-2005 02:01									#2
	Get a bigger avatar today!

I just tried opening a test thread in the Babylon forum for Lord Nuclear to see if he could access it through my profile. However, interestingly, he cannot see it. Nor can he see some of the things I can (e.g. Bongo's current last post being in a thread called "3900 BC")

After making this post, I will make one more post in the test thread I've started in the Babylon forum. See if can see "Test thread for Security Leak" as the last post in my profile, or if it just shows this one, and post whichever way you find.

	14-02-2005 02:09									#3
	Support Apolyton, buy Civilization III: Complete

I just did the test in the opposite direction (Lord Nuclear posting a test thread for me in his team's forum) and I not only got in to the thread, but posted as well. I suppose it's possible I could have gotten in to the main forum and other threads from there, though I didn't try.

So, this is definitely a severe problem. What I see being left to help the admins pin it down is figuring out what group of posters can see these private threads in the last post field in the first place. With that in mind, I will post in my forum's test thread once more after this so people can test what they see in my profile and post here which thread - this one or the private one - they see.

	14-02-2005 02:56									#4
	Support Apolyton buy from Amazon

I see the above post as your last

	14-02-2005 03:18									#5
	Suffering from ads?

I'm thinking I may have somehow gotten permissions I shouldn't have...

Here's what I see as the C3CDG forum page. I figured the private forums being displayed like that was just something different the admin who set up this forum had done, but is it different from what the rest of you see?

Attachment: c3cdgforum.jpg
This has been downloaded 58 time(s).

	14-02-2005 03:27									#6
	Enter the AD-FREE zone

Well, I don't have a listing of the private forums like that...

	14-02-2005 04:59									#7
	Help yourself to an AD-FREE life

Hmm, i dont see those private forums in that way either. Kloreep has some magical powers indeed. Makes me wonder how many others can see the private forums that way... Post and thread amounts on private forums.. and date and time of last post.. i think those should not be seen unless you are a moderator.

Looks like kloreep could enter the forums just by clicking on them.

	14-02-2005 06:00									#8
	Support Apolyton, buy Civilization III: Complete

wow that is some information you have there old bear

edit: ok I have taken a few of the Horde team and tried this out, and can see none of the posts that they have made in the private forum

you one honest Koala... looks like you have been eating all your gum leaves lately

Last edited by Paddy the Scot on 14-02-2005 at 06:10

	14-02-2005 07:14									#9
	Support Apolyton, buy Civilization: The Boardgame

Yeh... I have the usual screen (just the little listing of one private forum and the other "not member") ... and before we had any posts in any of the forums I tested out browsing them by direct link and that definitely didn't work ... dunno if a specific thread link makes a difference ...

	14-02-2005 09:32									#10
	Inflate your Upload Space

All I can say is that I am very glad Kloreep is on our team.

(on a more serious note - I presume this is something that can be rectified.)

	14-02-2005 09:34									#11
	Increase the size of your Attachments

I just tested whether I could access the private forums by removing myself from the Babylon civgroup and trying to access the Babylon forum. It told me access was restricted. (Now I need to get back in! Help, help! )

The individual thread access by using the post link in profiles remains. Still, this seems to be something with my individual account, not a widespread thing. I promise I won't abuse it. Let's hope MarkG can sort this out...

	14-02-2005 13:12									#12
	Lose 30 kilos (of popups)

I am sure Mark has an answer to this

	14-02-2005 14:05									#13
	Get a bigger avatar today!

should be fixed, a usual bug related to creation of private forums and certain special usergroups like plus members

btw, the leak wasnt big just 29 users

	14-02-2005 16:41									#14
	Tired of ads?

cheers and only 29 users ahh thee well

certainly glad it got cut off now, not 200 thousand years into the game