!Security Risk! – forum posts are “promiscuous.” Even private posts are not private.
-
Just posted here:
http://trac.buddypress.org/ticket/2343Forum posts are “promiscuous” and can masquerade as belonging to other forums – even if it is a private forum (probably also a problem with hidden forums).
Here is a working example from testbp.org. Start with this private topic that you do not have rights to view:
Now, replace group name with any existing other group name, such as /baseball/ , and you will now see the private topic:
http://testbp.org/groups/baseball/forum/topic/super-secret-post/
This example shows how an unauthorized user can have access to private posts they should not be seeing.
-
This is similar to an issue I found and have an open ‘Critical’ ticket on.
If you go to your account and then activity > friends you are able to view updates/comments made by a friend who is a member of a hidden group but which you are not, what is worse is that not only can you read content made to a group that you should not be able to read but you can also use the ‘reply’ to add a comment that will then appear in the hidden group.
I’m afraid that for me hidden groups are no such thing and represent a real issue if people use them believing them to be hidden and private in nature.
To date I have had little response on this, the ticket is still open and but for the very kind help of Boone, who helped or rather provided a interim hack to hide the activity altogether, there feels as though there is not a huge deal of concern over an issue of this nature when Andy dropped into the forum thread I raised on the issue it was simply to tick me off for incorrectly referring to hidden groups as ‘private hidden’ – Sorry Andy just thought it may have merited a little more concern than nomenclature issues
Wow 😮 thanks 3sixty for moving it up, maybe I was being too respectful should have changed it myself
And thanks JJJ for the quick patch to #2343 Can you also look at #2293 if you’re not already.
This was an issue but it was attended to with a workaround by Boone with a little help from me ( well I discovered it
) it predates the favorite issue and shouldn’t be apparent but it’s a while since I looked.I am using BP 1.5.1 and am having this exact issue – is it still an issue or am I missing something? Private groups still populate the ‘my friends’ activity feed. Nonmembers can see the activity of their ‘friends’ in private groups in the activity feed. I’ve disabled the ‘all members’ tab in the activity feed because of this issue, so I can’t currently comment on whether private groups are showing up in the ‘all members’ filter.
THANKS! I’m running a paid membership site so this is a biggie
- The topic ‘!Security Risk! – forum posts are “promiscuous.” Even private posts are not private.’ is closed to new replies.
