Page Index Toggle Pages: 1
Topic Tools
Normal Topic FIXD-Forum attachment log visible from non-admins? (Read 689 times)
ggn
YaBB Newcomer
*
Offline



Posts: 25
FIXD-Forum attachment log visible from non-admins?
Dec 25th, 2010 at 7:49am
Post Tools
Hi, and merry Christmas to all!

While doing a google search, I came across with a link like this:

<my server>/cgi-bin/yabb2/YaBB.pl?action=viewdownloads;thread=<thread no>

This apparently triggers the view downloads section from the admin menu to open and everyone can see the attachments and thread names.

I wasn't sure if this problem relates to my forum or is more general, so I tried it on this very forum: I simply needed to find a thread that has attachments (otherwise it didn't work), and slapped the "action=viewdownloads;thread=" in there. So, http://www.yabbforum.com/community/YaBB.pl?action=viewdownloads;thread=128573867....

Now, I'm sure there's something screwy with my forum setup because it shows all attachments from all threads. Problem is, this shows names of threads from hidden boards too, as well as attachments; fortunately one isn't able to download zip files etc, but can view pics as jpg, png etc.


Can somebody verify this? Like I said, I think the attachment log should only be visible to admins, not everyone!
« Last Edit: Dec 25th, 2010 at 11:37pm by ggn »  
Back to top
 
IP Logged
 
Captain John
Ex Member


Re: Forum attachment log visible from non-admins?
Reply #1 - Dec 25th, 2010 at 6:48pm
Post Tools
Jet Li informs me that was fixed in Y2,5, your using Y2.4

http://www.yabbforum.com/community/YaBB.pl?num=1244890682
  
Back to top
 
IP Logged
 
ggn
YaBB Newcomer
*
Offline



Posts: 25
Re: Forum attachment log visible from non-admins?
Reply #2 - Dec 25th, 2010 at 11:36pm
Post Tools
Okay, I applied the patch on my 2.4 setup (still haven't upgraded to 2.5, when I tried it something went horribly wrong so I reverted back) and it does seem to cure this. Thanks Smiley
  
Back to top
 
IP Logged
 
Page Index Toggle Pages: 1
Topic Tools