Uploaded image for project: 'phpBB3'
  1. phpBB3
  2. PHPBB3-10377

All moderators can change topic type

    Details

      Description

      Moderator is able to construct a URL to change topic type when he does not have permissions to do so.

      Demonstration:
      Set moderator user's "Can make sticky" to Never.
      Browse to viewtopic
      Observe that Make Sticky is not present on Quick Mod Tools
      Choose View Logs from Quick Mod Tools
      edit URL in browser address bar: Tack "&action=make_sticky" to end of URL
      Enter to browse to URL
      Make Sticky confirmation screen appears, and then allows topic to be made sticky.

        Attachments

          Activity

            People

            • Assignee:
              igorw Igor Wiedler [X] (Inactive)
              Reporter:
              Brf Brf
            • Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: