Unregistered users can view attachments.

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • craigyb
    Member
    • Jun 2008
    • 36

    Unregistered users can view attachments.

    Unregistered users can view attachments on my board. I am on VB 5.2.2 and I thought my default that "unregistered / Not Logged In" could not download attachments. However when I went into the permissions manager download attachments was checked. So I unchecked it.
    Now Unregistered users see a link but when they click on it they still see the attachment.
    All Usergroups and Channel permissions show "unregistered / Not Logged In" cannot download attachments.
    This must be a bug.

    Several different Channels that all inherit the same permissions behave differently.
    One goes to a blank page when you click on an attachment.
    Last edited by craigyb; Tue 17 May '16, 7:28pm.
  • TLMD
    Senior Member
    • Sep 2012
    • 1766
    • 5.6.X

    #2
    Are we talking about "regular" attachments (files) or image attachments?

    What have you selected for the following permissions?
    • Can Download Non-Image Attachments
    • Can Download Image Attachments
    Did you select something different under AdminCP > Channel Management > Channel Permissions?

    Comment

    • craigyb
      Member
      • Jun 2008
      • 36

      #3
      Originally posted by TLMD
      Are we talking about "regular" attachments (files) or image attachments?

      What have you selected for the following permissions?
      • Can Download Non-Image Attachments
      • Can Download Image Attachments
      Did you select something different under AdminCP > Channel Management > Channel Permissions?
      Yes this is what I am saying I have removed both ability to download image and non image attachments.
      All the forums inherit the same permissions from home or root, some behave differently I have subsequently discovered.
      In all cases it no longer displays the attachments in the post but if you click on the link they can still view the attachment itself.
      Instead of on my VB4 forum you get the message you must log in to see the image.

      However it is not consistent.
      One forum at a higher level has the same permissions and when you click on the attachment link, you get a blank page.
      I am not clear if the blank page is the correct current behavior that a blank page should be presented when they don't have permission to access the image.

      I thought i read on here the unregistered users should never be able to see attachments, but this is not the case.

      Also I found they can see the thumbnails and if you click on the thumbnail is shows all the pictures in the album.

      Comment

      • craigyb
        Member
        • Jun 2008
        • 36

        #4
        It's like the permissions are different on every topic.
        In the same channel sometimes you see the attachment, sometime you see the link.
        No consistency.

        If I set the permissions specifically on each channel it then says I cannot access the channel as a guest even though view content is set.
        So it only works when inherited but then doesn't work properly or consistently.

        I'm not clear what changed recently but something did.

        Comment

        • Wayne Luke
          vBulletin Technical Support Lead
          • Aug 2000
          • 73981

          #5
          Remove their permissions under Attachments -> Attachment Permissions.

          I guess there is a bug that is preventing that group from showing... You'll probably want to set "Can View Channel" or "Can View Topics" to no for that usergroup in the channel that you want to deny permissions on.
          Translations provided by Google.

          Wayne Luke
          The Rabid Badger - a vBulletin Cloud demonstration site.
          vBulletin 5 API

          Comment

          • craigyb
            Member
            • Jun 2008
            • 36

            #6
            Originally posted by Wayne Luke
            Remove their permissions under Attachments -> Attachment Permissions.

            I guess there is a bug that is preventing that group from showing... You'll probably want to set "Can View Channel" or "Can View Topics" to no for that usergroup in the channel that you want to deny permissions on.
            Ultimately I would like guests to see thread content but not attachments in most cases.
            Some forums I would like them to see everything and of course this works.
            Then a few forums I only want them to see the thread titles and this works right.

            There is some inconsistency that some forums you get a blank page when clicking on the attachment which is correct behavior.
            Other forums with the same permissions, guests can see attachments.

            I put in a ticket and there was one bug found.
            Images uploaded via Photo Icon ignore permissions:


            Still seems to be inconsistency with other attachments but no clues to why.

            Comment

            • chriske
              Senior Member
              • Oct 2008
              • 466
              • 5.6.3

              #7
              I was surprised to see that guests can see images uploaded via the Photo tab!
              Please second this in the bud tracker: http://tracker.vbulletin.com/browse/VBV-14636
              Please vote for:
              - Lightbox for all uploads
              - Attachment permissions for unregistered users

              Comment

              Related Topics

              Collapse

              Working...