[F] editpost.php issue with closed forums [R]

[Troll]

Hi,

I am using MyBB 1.4.4.

As I was trying to edit a post in a closed forum, I noticed that I was able to edit a post (closed or not) in a closed forum by the quick edit way, but not by the complete editing page.

After (too many) several minutes of search, I finally found the origin of this issue :

Code:

if($forum['open'] == 0 || $mybb->user['suspendposting'] == 1)
{
    error_no_permission();
}

This code is located in editpost.php

If the forum is closed, so the permissions aren't checked and even the administrators can't edit the post by the complete editing page.

Stranger than this, it's possible to edit it with the quick edit function, and it records... O_o



I hope I am not reporting a bug already reported. I've searched the forum and I haven't found this bug.

[MattRogowski]

I always thought the point of a closed forum was that nothing could be done in there at all??

[Tom Loveric]

(04-05-2009 11:10 PM)MattRogowski Wrote:  I always thought the point of a closed forum was that nothing could be done in there at all??

I thought so too

[Troll]

Nothing but administrators actions, no ?

It seems logical, here like it is now, if an administrator wants to edit a post in a closed forum, or delete or another action... he can't.

Plus, as I said, it's possible to do it whith the quick edit feature...

[MattRogowski]

If anything, it should disallow quick editing then.

'If unselected, users will not be able to post in this forum regardless of permissions.'

I've always seen closed forums as being for archival purposes. If you can't post threads, reply to threads, vote on polls, or use full edit, you shouldn't be able to quick edit either.

[Troll]

It's a bit strange, comparatively to others Bulletin Board CMS, MyBB is the only one I know who is making the "closed forum" as a forum for archival purposes.

If it's for archival purposes, why don't call it "Archive forum" and make available a feature for closed forums ?

[Scoutie44]

Then the bug is the quick edit, not the missing permissions check.

[Troll]

(04-06-2009 08:38 PM)Scoutie44 Wrote:  Then the bug is the quick edit, not the missing permissions check.

Yes, it seems.

But in this case, I hope a "standard" closed forum feature (instead of a forum for archival purposes) will be added in the next releases, it's a so basic function... I didn't imagine MyBB's not implementing it.

[Imad Jomaa]

Which usergroup are you referring to? The Users or the Administrators?

Quote:If the forum is closed, so the permissions aren't checked and even the administrators can't edit the post by the complete editing

But the user can?

[Troll]

Sorry if I wasn't clear, I don't speak english very well...

So, I didn't try with an user account, but with an administrator account, it wasn't possible to edit by clicking on "full edit". However, by clicking on "quick edit", it was possible to edit an save the edition of the post.

I can try with an user account, but redarding to the php code I've posted, it will do the same (at least, for the full edit page).