Web Wiz - Green Windows Web Hosting

  New Posts New Posts RSS Feed - Security Issue
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

Security Issue

 Post Reply Post Reply
Author
Nick-V View Drop Down
Senior Member
Senior Member


Joined: 26 October 2002
Location: United Kingdom
Status: Offline
Points: 319
Post Options Post Options   Thanks (0) Thanks(0)   Quote Nick-V Quote  Post ReplyReply Direct Link To This Post Topic: Security Issue
    Posted: 02 November 2003 at 5:16pm

Is it true that ALL topics headings, even those in private and hidden (secure?) forums can be seen by ALL users when they use SEARCH and ACTIVE TOPICS?

WWF contains some good security features but this sounds like a recent and significant flaw. I believe that securing topic names is just as important as securing the message itself. Just imagine !!!

Has anyone got a work-around or an add-on for this. I'd rather live with some slower performance or more basic security that allow all topic headings to be seen publicly.

Did I misunderstand this issue or what?

Back to Top
dead_angel View Drop Down
Mod Builder Group
Mod Builder Group


Joined: 02 May 2003
Location: United Kingdom
Status: Offline
Points: 147
Post Options Post Options   Thanks (0) Thanks(0)   Quote dead_angel Quote  Post ReplyReply Direct Link To This Post Posted: 02 November 2003 at 7:28pm
i think someone made a mod for this, but not sure who or when or where it was posted, search back in the mod foums or on mad dogs site. i'm pretty sure it's been covered somewhere.
Back to Top
zadax View Drop Down
Mod Builder Group
Mod Builder Group


Joined: 19 January 2003
Location: Israel
Status: Offline
Points: 433
Post Options Post Options   Thanks (0) Thanks(0)   Quote zadax Quote  Post ReplyReply Direct Link To This Post Posted: 03 November 2003 at 1:24am

can somone give link ?

i searched and searched and didnt find it

Back to Top
Nick-V View Drop Down
Senior Member
Senior Member


Joined: 26 October 2002
Location: United Kingdom
Status: Offline
Points: 319
Post Options Post Options   Thanks (0) Thanks(0)   Quote Nick-V Quote  Post ReplyReply Direct Link To This Post Posted: 03 November 2003 at 3:05am

I also searched and could only find http://forums.webwiz.net/forum_posts.asp?TID=1058&a mp;KW=search+topics+hidden.

The thread provides a line of code not instructions where to enter it. I suspect it just changes the topic name displayed to "Special Topic" if the topic found is from forum 1 or whatever you determine to be the sensitive forums.

As he states, its a fast cover-up but not a solution.

Back to Top
Nick-V View Drop Down
Senior Member
Senior Member


Joined: 26 October 2002
Location: United Kingdom
Status: Offline
Points: 319
Post Options Post Options   Thanks (0) Thanks(0)   Quote Nick-V Quote  Post ReplyReply Direct Link To This Post Posted: 03 November 2003 at 4:28am
I am no technical authority but carried out some user testing and wish to share my results to encourage solutions.
 
The Active Topics Issue
 
First, The Search Issue is different and will be looked into separately.
 
It appears that forums can be included or excluded in the Active Topics list based on the following criteria:
 
If the Generic Forum Permission named Forum Access is set to All Users the forum topics will be included in the Active Topics list. Under all other circumstances the topics will not display.
 
Group Permissions are not considered in the display of topic names but do control access to the postings as one would expect. The issue, therefore, is controlling the display of the topic name. To help you:
  • if you have attempted to secure your forums using generic permissions, active topics will not work for NO-ONE.
  • If you wish EVERYONE (including guests) to see all of your topic names set the Generic Forum Permission to All Users and use Group Permissions to control access to the forum's content. Thus, topic names can be seen but threads cannot be read.
  • If you wish to prevent EVERYONE (including users with forum access) from seeing the topic names in specific forums, set the Generic Forum Permission for the specific forums to Private Groups and set up Group Permissions to control access to the forum's content.
If you wish to have increasing levels of users like Guests, Customers, Staff and Managers and use Active Topics you'll have to set up separate forums!!! The only three options are hidden for all, hidden for no-one, hidden for private forums.
 
As mentioned previously, the deficiency is that it is not possible to secure topic names without losing use of the Active Topics facility (even for those permitted to see the threads themselves).
 
I'd appreciate any ideas or feedback on this.


Edited by Nick-V
Back to Top
WebWiz-Bruce View Drop Down
Admin Group
Admin Group
Avatar
Web Wiz Developer

Joined: 03 September 2001
Location: Bournemouth
Status: Offline
Points: 9844
Post Options Post Options   Thanks (0) Thanks(0)   Quote WebWiz-Bruce Quote  Post ReplyReply Direct Link To This Post Posted: 03 November 2003 at 4:30am
The next version that I will release today won't show topic titles for forums the user can't view on the active users page.

This was discussed in quite some length a few weeks ago and many things tried out which resulted in a new stored procedure for SQL server and a new query for Access that I did post somewhere on this forum.
Back to Top
Nick-V View Drop Down
Senior Member
Senior Member


Joined: 26 October 2002
Location: United Kingdom
Status: Offline
Points: 319
Post Options Post Options   Thanks (0) Thanks(0)   Quote Nick-V Quote  Post ReplyReply Direct Link To This Post Posted: 03 November 2003 at 4:35am

Thats great news Borg...I didn't find the discussion despite some searching but I'm sure I'll find the new SQL Stored Procedure.

Borg, does the new version also fix the search issue or shall I continue to look into what it does and how to get around it?

PS. I think I found pre-release stored procedure (Active Topics not Search) but I'm waiting for new version as it need to be called with 4 bits of data in the linkage. For those interested its at http://forums.webwiz.net/forum_posts.asp?TID=6268&a mp;KW=active+topics+procedure



Edited by Nick-V
Back to Top
WebWiz-Bruce View Drop Down
Admin Group
Admin Group
Avatar
Web Wiz Developer

Joined: 03 September 2001
Location: Bournemouth
Status: Offline
Points: 9844
Post Options Post Options   Thanks (0) Thanks(0)   Quote WebWiz-Bruce Quote  Post ReplyReply Direct Link To This Post Posted: 03 November 2003 at 5:06am
I've looked at all teh queries in the search.asp page but they are so complex I can't find a way to also look at the permisisons for the user without a search taking 10 minutes.
Back to Top
 Post Reply Post Reply

Forum Jump Forum Permissions View Drop Down

Forum Software by Web Wiz Forums® version 12.08
Copyright ©2001-2026 Web Wiz Ltd.


Become a Fan on Facebook Follow us on X Connect with us on LinkedIn Web Wiz Blogs
About Web Wiz | Contact Web Wiz | Terms & Conditions | Cookies | Privacy Notice

Web Wiz is the trading name of Web Wiz Ltd. Company registration No. 05977755. Registered in England and Wales.
Registered office: Web Wiz Ltd, Unit 18, The Glenmore Centre, Fancy Road, Poole, Dorset, BH12 4FB, UK.

Prices exclude VAT at 20% unless otherwise stated. VAT No. GB988999105 - $, € prices shown as a guideline only.

Copyright ©2001-2026 Web Wiz Ltd. All rights reserved.