Fixed Members are able to view Article Pages and Blog Entry Pages, even tho they don't have permission to view the full Article or Blog Entry

[gemma]

AMS Version

AMS 2.3.8 | UBS 2.3.7

XenForo Version

XF 2.3.4

PHP Version

8.3.19

Database & Version

N/A

Are there any errors being throw?

No

I think this is a bug and not me missing a permission somewhere.

When you create an article that consists of pages of content, they appear in the latest activity news feed when created. No problem there.



If you click on the article, ie"Mood Booster - 7 Day Diet Plan", it respects the viewing permissions.



But if you click on any of the page links that appear in the latest activity feed, you can access any of these pages and view the content.



You can then cycle through the Table of Contents and read all the pages other than the overview, or view the full article.

I have permissions set as follows....

 

[Bob]

If you can view an article, you can view all article pages that are set to visible. Draft pages are not publicly viewable (Owners, CoOwners, Contributors, Moderators and Admins can view draft pages however).

I've read this a couple times and I am not sure I understand what the bug is. Everything you state is how it should be.

If the viewing user can NOT view the article, they also can not view ANY of the Article Content. If they CAN, then THAT would be a bug.

 

[gemma]

But if you cannot view the full article you shouldn't be able to view the additional pages?

If you go to my site, Latest Activity and click on the Mood Booster - 7 Day Diet Plan you, correctly, cannot view the full article. But if you go back to the Latest Activity page and click on any of the corresponding pages for that article you can view the content and click on the table of contents top view any other page except the overview or full article - that shouldn't be right as you have no permission to view the article you should be able to view those pages.

I have it set to no here



Or am I missing something?

 

[Bob]

But if you cannot view the full article you shouldn't be able to view the additional pages?

I agree and that has been implemented in dozens of addons that way. Unfortunately, I am a human and far from perfect, so updating AMS and UBS never happened.

AMS and UBS never got updated like Showcase did. All of the newer addons that have pages are hiding pages when the viewing user doesn't have permission to view the full content. Only AMS and UBS are not and that is because those two addons were developed several years BEFORE the viewFull[content_type] feature was implemented (which at that time, happened while developing IMS and adding pages feature to Showcase).

Simply an oversight on my part in going back and updating AMS and UBS while I was working on IMS and Showcase.

Anyway, I've updated both AMS and UBS, so pages will not be viewable now if the viewing user does not have permission to view full article, view full blog and view full blog entry.

Fixed in AMS 2.3.10 and UBS 2.3.8.

Time to retire!

 

[thomas1]

Time to retire!

Don't you dare!!

Thanks for the updates.

 

[Bob]

Don't you dare!!

Thanks for the updates.

I was wondering when someone would catch that!