Security Leak - Problem with Forum Layouts

[Kloreep]

In my experience with previous DGs, posts in the private forums will not show up in any meaningful way in a user's profile. If their last post was in a private forum, then the date and time will be of that post, but the title and thread listed will be their last post outside a private forum.

I think the C3CDG forums show up, though. Both I and other members of Team Babylon had their private forum posts show up in their profiles. To test if this was simply because I have access to Babylon's forum, I checked ormuzd's profile. His last post shows as "Turn 2 - 3950 BC" or somesuch. I would assume this is a thread inside Ankh-Morpork's forum. I did not try to access the thread; hopefully security would still keep me out, but I don't know since trying it out might require me to exit the game till Babylon got a map of their area.

But even if this can't be used to access forums, the titles alone are a problem. If the Ankh-Morpork team had a thread titled "Let's attack Babylon!" I might stumble on to it when viewing their members' profiles. No such thread is going to be started right now (at least, I hope not ) but by the time teams get contact with each other, either this will need to be fixed, or teams will need to use vague and/or code thread titles.

[Kloreep]

I just tried opening a test thread in the Babylon forum for Lord Nuclear to see if he could access it through my profile. However, interestingly, he cannot see it. Nor can he see some of the things I can (e.g. Bongo's current last post being in a thread called "3900 BC")

After making this post, I will make one more post in the test thread I've started in the Babylon forum. See if can see "Test thread for Security Leak" as the last post in my profile, or if it just shows this one, and post whichever way you find.

[Kloreep]

I just did the test in the opposite direction (Lord Nuclear posting a test thread for me in his team's forum) and I not only got in to the thread, but posted as well. I suppose it's possible I could have gotten in to the main forum and other threads from there, though I didn't try.

So, this is definitely a severe problem. What I see being left to help the admins pin it down is figuring out what group of posters can see these private threads in the last post field in the first place. With that in mind, I will post in my forum's test thread once more after this so people can test what they see in my profile and post here which thread - this one or the private one - they see.

[OPD]

I see the above post as your last

[Kloreep]

I'm thinking I may have somehow gotten permissions I shouldn't have...

Here's what I see as the C3CDG forum page. I figured the private forums being displayed like that was just something different the admin who set up this forum had done, but is it different from what the rest of you see?

[Jonny]

Well, I don't have a listing of the private forums like that...

[Conqueror]

Hmm, i dont see those private forums in that way either. Kloreep has some magical powers indeed. Makes me wonder how many others can see the private forums that way... Post and thread amounts on private forums.. and date and time of last post.. i think those should not be seen unless you are a moderator.

Looks like kloreep could enter the forums just by clicking on them.

[Paddy]

wow that is some information you have there old bear

edit: ok I have taken a few of the Horde team and tried this out, and can see none of the posts that they have made in the private forum

you one honest Koala... looks like you have been eating all your gum leaves lately

[snoopy369]

Yeh... I have the usual screen (just the little listing of one private forum and the other "not member") ... and before we had any posts in any of the forums I tested out browsing them by direct link and that definitely didn't work ... dunno if a specific thread link makes a difference ...

[Beta]

All I can say is that I am very glad Kloreep is on our team.

(on a more serious note - I presume this is something that can be rectified.)

[Kloreep]

I just tested whether I could access the private forums by removing myself from the Babylon civgroup and trying to access the Babylon forum. It told me access was restricted. (Now I need to get back in! Help, help! )

The individual thread access by using the post link in profiles remains. Still, this seems to be something with my individual account, not a widespread thing. I promise I won't abuse it. Let's hope MarkG can sort this out...

[Paddy]

I am sure Mark has an answer to this

[MarkG]

should be fixed, a usual bug related to creation of private forums and certain special usergroups like plus members

btw, the leak wasnt big just 29 users

[Paddy]

cheers and only 29 users ahh thee well

certainly glad it got cut off now, not 200 thousand years into the game