[F] announcement in password protected forum [C-sayakb]

[frostschutz]

If a password protected forum has an announcement, users can access it directly by giving the announcements.php?aid=x URL. forumdisplay and showthread call the check_password function for the forum, announcement.php does not.

[Ryan Gordon]

in announcement.php find:

PHP Code:

if($forumpermissions['canview'] == 0 || $forumpermissions['canviewthreads'] == 0)
{
    error_no_permission();
} 


Add after:

PHP Code:

// Check if this forum is password protected and we have a valid password
check_forum_password($forum['fid']); 


[Ryan Gordon]

Thank you for your bug report.

This bug has been fixed in our internal code repository. Please note that the problem will not be fixed here until these forums are updated.

With regards,
MyBB Group