Error pages - 404 vs 403 No permission

[StuartSafe]

I've recently added a couple of plugins to add a sign up button to my 403 no permission page and customise 404. However, it's made me realise that the error pages arent' working in the way I'd expect. Example some someone not signed in (we have boards not visible for guests)...

Follows a link to a discussion - 403, all good
Follows a link to a forum - 404 which I'd have thought should be a 403 because it's there but they don't have permission

We've also created a custom homepage which we've linked to our forums, but if a guest clicks through they get a 404 because they aren't visible to guests. Is making them visible to only way to overcome this error?

[Marc]

Do you have an example of this on your site?

[Daniel F]

The 404 is intentional, it's to hide the fact that the forum exists at all, this also means that the 403 which is returned when a topic is viewed, is a bug, which I have just logged to our bug tracker.

[Percival]

On 3/17/2022 at 5:50 PM, Daniel F said:

this also means that the 403 which is returned when a topic is viewed, is a bug, which I have just logged to our bug tracker

Has this been fixed? Still forums return 404 and topics 403.

[Jim M]

1 hour ago, Percival said:

Has this been fixed? Still forums return 404 and topics 403.

It has, I am unable to reproduce this with a non-existing topic and forum. Both return 404's.

[Percival]

@Jim M It's about forums and topics that you do not have permission to view. Let me give an example:

https://invisioncommunity.com/forums/forum/15-test-posting/ returns 404 for guests (forum is hidden from guests) - OK

https://invisioncommunity.com/forums/topic/472383-test-topic/ returns 403 for guests [should return 404]

@Daniel F stated that topic should also return 404 to hide the fact that topic exists at all.

 

[Marc]

I have created a bug report for this, so we can take a closer look