Uploaded image for project: 'phpBB3'
  1. phpBB3
  2. PHPBB3-10365

Moderators can view forbidden information

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Blocker
    • Resolution: Fixed
    • Affects Version/s: 3.0.9
    • Fix Version/s: 3.0.10-RC1
    • Labels:
      None
    • Environment:
      PHP 5.2.17 and MySQL 5.1.49 on Linux wp085 2.6.37-he-xeon-64gb+1 #1
      Chrome 13.0.782.220 m and IE 9 on Windows 7

      Description

      Moderators who do not have the 'Can close and delete reports' permission are still able to view report details on the Post Information section of the Moderator Control Panel. This ist possible even the permission for seeing post information ist set to "never".

      I try to explain more detailled. The concerning moderator group is not able to close or delete reports. They can nether see post details. If they read a post und they go to post moderation, then they suddenly see post information an reports.

      I want to explain by screenshots (attachments).

      Picture 1: If you see the board index an then go to mcp, then this moderation group is not able to see reportings. Everything okay.
      Picture 2: now the moderator reads a post. This post is reported, but the moderator can't see this. He nether can see post details (no "?"-button). Everything okay.
      Picture 3: The moderator now goes to mcp (from picture 2) and is suddenly able to see, that this post was reported. - Not okay. If the moderator now klicks on the "?"-button (marked yellow), then nothing will happen, because use of the needed tab is forbidden. But if the moderator klicks on "!"-button (view report), then he can see everything (picture 4).

      I hope, i was able to explain the problem. It is very hard in a foreign language. In my opinion, this is a bug in the software and should be solved. I already posted in the support forum (german an yours) und my problem could not be solved, even two support moderators tried to help me.

        Activity

        Hide
        brunoais brunoais added a comment -

        In my test, the moderator user was unable to reach the post details page in both develop and develop-olympus using the steps described here.

        Show
        brunoais brunoais added a comment - In my test, the moderator user was unable to reach the post details page in both develop and develop-olympus using the steps described here.

          People

          • Assignee:
            igorw Igor Wiedler [X] (Inactive)
            Reporter:
            BO-Samson BO-Samson [X] (Inactive)
          • Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Development