YAFLogo

rjryerson
  • rjryerson
  • 71.6% (Friendly)
  • YAF Lover Topic Starter
13 years ago
I found a couple things in the latest build concerning security, roles and users.

1. Sync All User Membership button brings down all roles from all child portals.

2. Users removed from a role in the DNN site, are not updated in the forums (ie a member (role) that is no longer a member(role) , still has member(role) access to the forums)

3. Permission Bleed - if two child portals have duplicate roles (by name) granting of the role in one site, but not on the other, the user still has those permissions in the latter.

For example: On Child Site A I am a member, On Child Site B, I am NOT a member. On Child Site B, I can see "member" forums.

Sorry to bring these out, but my superior is breathing down my neck.

Best regards,

Rick

Sponsor
tha_watcha
  • tha_watcha
  • 100% (Exalted)
  • YAF.NET Project Lead 🤴 YAF Version: 4.0.1 BETA
13 years ago

I found a couple things in the latest build concerning security, roles and users.

1. Sync All User Membership button brings down all roles from all child portals.

2. Users removed from a role in the DNN site, are not updated in the forums (ie a member (role) that is no longer a member(role) , still has member(role) access to the forums)

3. Permission Bleed - if two child portals have duplicate roles (by name) granting of the role in one site, but not on the other, the user still has those permissions in the latter.

For example: On Child Site A I am a member, On Child Site B, I am NOT a member. On Child Site B, I can see "member" forums.

Sorry to bring these out, but my superior is breathing down my neck.

Best regards,

Rick

Originally Posted by: rjryerson 

1. The Button will be disabled to prevent that.

2. Currently there is no check that automatically syncing check that removes the user from the roles, i added it, will be included in next release.

3. Currently i dont see any solution to that because everyting is handled via the role name, the only workaround to prevent that problem is to rename the roles for each portal.

rjryerson
  • rjryerson
  • 71.6% (Friendly)
  • YAF Lover Topic Starter
13 years ago

1. The Button will be disabled to prevent that.

2. Currently there is no check that automatically syncing check that removes the user from the roles, i added it, will be included in next release.

3. Currently i dont see any solution to that because everyting is handled via the role name, the only workaround to prevent that problem is to rename the roles for each portal.

Originally Posted by: tha_watcha 

1. Is there functionality in here that will need something else?

2. AWESOME!

3. I figured and I have a backup plan - create unique roles (name) and migrate users to the those roles.

Something else I'm getting reports of and seeing: Thread / Post tracking isn't working. Logging out and then returning shows all threads as unread.

rjryerson
  • rjryerson
  • 71.6% (Friendly)
  • YAF Lover Topic Starter
13 years ago
Oh, and I wanted to say thanks for all your help. I really like these forums.
tha_watcha
  • tha_watcha
  • 100% (Exalted)
  • YAF.NET Project Lead 🤴 YAF Version: 4.0.1 BETA
13 years ago

Something else I'm getting reports of and seeing: Thread / Post tracking isn't working. Logging out and then returning shows all threads as unread.

Originally Posted by: rjryerson 

By default yaf uses session based read tracking, you need to turn on db read tracking if you want to use real read tracking?

rjryerson
  • rjryerson
  • 71.6% (Friendly)
  • YAF Lover Topic Starter
13 years ago
Thanks, I must have reset sessions with the upgrade and several restarts. Turned on DB tracking :)

Thanks again!