How are guests getting inside a members only forum?

spindr at 04h17

May

2011

Hello

First I have been very happy with the Forumotion experience. I have started my first forum with little practical experience and so far things have gone very well.

I have set up my forum to be visible only to registered members. It is nothing scandalous, but I think the group has a more personal experience when there are no lurkers. Using the permissions of the forum I have set it so that only members can view and post. I've even set up a group which includes the registered members so the forum requires both membership to the forum and membership to the group. I've also set up new accounts to require admin approval, so I felt I had things under control. I have checked the settings myself and when not logged in, all I can see is the main login page and nothing else.

However, twice now in the past week I have noticed on the Who's online page a Guest viewing the forum. I can tell the Guest is in the Forum because it clearly shows the name of the forum they are in rather than saying "Viewing the Forum Index" which is what it says when the Guest is at the login page.

I have banned the IPs and they went away, but I really don't feel like chasing away rats every day just to deliver a private forum experience.

So can someone tell me what is going on here? Is it really this easy for someone to enter a private forum through a back door? Is there any way to prevent this?

Maybe this is a Forumotion person just checking up on things?

Please advise.

1 slg, on 24/05/2011 at 05h35

If it says that guests are looking at things that members can only see does not mean guests are exactly seeing the things. They are probably seeing a page that says, "You do not have permissions to access this page."

2 TeeDee, on 17/08/2011 at 09h33

Hi,

I saw the same thing in my forum too. Guests are reading what is supposed to be only accessible by forum member + a user group.

Is there a definite explanation to this occurrence please?

3 kirk, on 17/08/2011 at 10h44

if you have the permissions set for not to have access then they will not have access.
It's like what slg is saying above, if you have the forum permissions set so they can see the forum is there but do not have access, then it means the just clicked the forum, and are getting a message saying they do not have access.

to make things easy, log out of your forum, you are now a guest.. check and make sure everything is set right.. if not go back and fix the permissions, log out again and re-test again to be sure.

4 TeeDee, on 17/08/2011 at 10h47

Prior to the post I did the log out and check and I can only see the login page can be seen by me.

But was wondering if there could be a bypass by someone who was knowledgeable enough.

Thanks for the speedy reply Smile

5 kirk, on 17/08/2011 at 10h48

No not unless they was logged in as a member and have permissions for what ever sections/forums Smile

Your welcome.

6 spindr, on 17/08/2011 at 15h37

Thank you for the information kirk. Much appreciated.

7 Sanket, on 17/08/2011 at 15h52

Since this thread appears to be solved, I will lock this thread and mark it as solved.

Sanket