Guests Posting Without Usergroup/Forum Permissions?

[Rheddy]

This has got to be a new one I have encountered, ever since I started using Invision Power Services back in 2004. Keep in mind that I have permissions on my site set up very specifically so that only registered members can create content on my site/forums (my site is fully integrated with the IPS platform. With this in mind, Guests can only view or browse my forums as my community is set up to where they cannot post messages, comments, personal messages, topics or replies. This was never a problem until I logged into my site just a few minutes ago and discovered that two guests had posted new topics on my forums. What's odd about this is that I've checked the usergroup permissions as well as the permissions for my forums, and they still have disabled permissions for guest posting.

Has anyone ever encountered this and if so, is there a solution to fix it? The guests had posted spam and even though it was hidden until approved (which I have the usergroup permissions set as), the only thing that prevented the posts from being visible is that I had it set up like that. I can say for certain that it's also not related to the login handlers because I don't have any of the social media login handlers enabled. This glitch, or bug, didn't happen until after my upgrade from 4.2.3 to 4.4.1 was completed yesterday.

[Adriano Faria]

4 minutes ago, Rheddy said:

Guests can only view or browse my forums as my community is set up to where they cannot post messages, comments, personal messages, topics or replies. This was never a problem until I logged into my site just a few minutes ago and discovered that two guests had posted new topics on my forums. What's odd about this is that I've checked the usergroup permissions as well as the permissions for my forums, and they still have disabled permissions for guest posting.

 

[IPSTemplate]

 

If you disabled that and they can post, make a ticket.

 

[Rheddy]

Thanks, guys. That explains things.  It was curious as to why they were able to post. Thanks for pointing me in the right direction. 👍

[Large Scale Planes]

Thanks for pointing this out. We haven't had this issue on our community yet, but likely would have, as that setting seems to be enabled by default. I've now disabled it. It's just an invitation for spammers, really.

Kev

[bfarber]

Realistically, it's no more an invitation than allowing guests to register and post.

The system is designed so that (when the setting is enabled), the guest can "post" however it is not visible to anyone on the site, at all, until they register. When the guest registers, at that point in time their post becomes visible. If they do not, the post is automatically pruned after a week, giving them some time to complete their registration.

There is a bug in the 4.4.0 and 4.4.1 release where these posts can be displayed in certain sidebar blocks, which may give the illusion of spam, however only moderators and administrators are seeing these posts. This bug is fixed in our upcoming 4.4.2 release. But, I did want to just point out that this is no more an ability to submit spam than allowing a guest to register and begin posting is, because that is what the underlying permissions is based on. We just provided "post then register" as an option, in addition to the existing "register then post" which you are used to.

[BankFodder]

Yes, since we enabled post before registering, we have been hit by spammers – his posts are appearing as explained above by bfarber.

We are considering turning it off – but one strange thing is that when I try to access that guest all that post, I am prevented from doing so by an error message – even though I think I have full admin rights.

Anyone any idea about this?

If you have somebody who post before registering, where do you find them all?

[bfarber]

You cannot access posts submitted through the post before register feature, whether you are an admin, moderator, regular member or guest. For all intents and purposes they completely do not exist until the guest completes registration. The fact that they show up anywhere is simply a bug which is corrected in the next release.

I think the best course of action is to wait until 4.4.2 is released and then re-evaluate if you have any concerns.