Users able to post to all blogs - confirming and extending previously reported bug by others
- Status
- Closed
- Subject
- Users able to post to all blogs - confirming and extending previously reported bug by others
- Version
- 1.9.x
2.x - Category
- Usability
- Feature
- Blog
Permission - Submitted by
- zorp
- Volunteered to solve
- zorp
- Rating
- Description
On clean installs (empty databases) of TW 1.10 and 1.9.11 (also tested and confirmed on the clean 1.9.11 install on opensourcecms.com).
After users (perms tiki_p_create_blogs and tiki_p_blog_post enabled)create a blog they can proceed to post to any other user's blog. More precisely, on the post blog page, a user can select all blogs from the "Blog" field- Solution
it seems that the function user_has_perm_on_object in tikilib.php (called by the list_blogs_user_can_post function) returns true for all blogs. It seems to me that user_has_perm_on_object either confuses the permission levels of tiki_p_blog_post or it simply doesn't check whether the blog has been marked as private or not.
A quick work around (which completely bypasses user_has_perm_on_object so is probably poses a bunch of security risk):
in the file tikilib.php
in the function function list_blogs_user_can_post
Replace
if( $this->user_has_perm_on_object($user, $res'blogId', 'blog', 'tiki_p_blog_post',0)){with
if( $user $res'user' || $res'public' 'y'){////////////////////////////////
fixed in tikitrunk(3.0)
commit 13737 + 13736- Importance
- 5
- Priority
- 25
- Demonstrate Bug on Tiki 19+
-
This bug has been demonstrated on show2.tiki.org
Please demonstrate your bug on show2.tiki.org
Show.tiki.org is not configured properlyThe public/private keys configured to connect to show2.tiki.org were not accepted. Please make sure you are using RSA keys. Thanks.
- Demonstrate Bug (older Tiki versions)
-
This bug has been demonstrated on show.tikiwiki.org
Please demonstrate your bug on show.tikiwiki.org
Show.tiki.org is not configured properlyThe public/private keys configured to connect to show.tikiwiki.org were not accepted. Please make sure you are using RSA keys. Thanks.
- Ticket ID
- 1782
- Created
- Monday 26 May, 2008 10:26:08 UTC
by Unknown - LastModif
- Tuesday 22 July, 2008 10:57:40 UTC