No Download Permission for attachements for guests will be ignored by "Share Photos"

[anothervbuser]

Dear Support

I created a vBulletin Board. As often seen I created permissions for guest users so they are not able to download attachements. Basically this works if you add normal attachements. I was suprised that this does not work if you add photos by the function "Share photos". This will be shown always even guests do not have download permission.

Did I miss something? How I can prevent guests to see full images from such "shared photos"? (Those photos will be shown with a light box).

Another question would be how I can enable the light box for images which are simple attached to a topic (not with the "Share Photos" function).

Any help would be appreciated.

kind regards
Roger

Info regarding my installation:

1. vBulletin Version: 5.5.1
2. PHP Version: 7.1.28
3. MySQL Version: 5.7.22
4. Any Addons installed: None
5. Does the issue occur in a default style? Yes
6. Does the issue occur using the English language provided? Yes
7. Error message on the screen' n/a
8. Browser and Browser version used. Chromimum 73.0.3683.86, Firefox 66.0.3
9. Did you clear the browser cache and did the error continue? Yes
10. A list of steps that can be used to recreate the issue. Create new topic and "Share Photos"; even guest users do not have download permissions for attachements they can see the photos
11. If the issue is an Invalid Server response, the web server and PHP logs that correspond with its timestamp. n/a

[Wayne Luke]

There are two download permissions for vBulletin 5...

1. Can download non-image attachments.
2. Can download image attachments.

In a default installation, the second is set to Yes for Guest Users.

[anothervbuser]

Hi Wayne

There are two download permissions for vBulletin 5...

1. Can download non-image attachments.
2. Can download image attachments.

Yes I know that this is the case in the default installation. That is the reason why I adapted the rights of the "Guest Group"; This group is not allowed to download non-image attachements nor image attachements. But guests are still able to see images. Please note that guests are not able to download/view images which where inserted with the normal "Image" button function of the post editor. It happens only if a user uses the "camera" icon with the label "Share Photos". You will get a preview of the photos which can be seen by guests and guests are also able to click on those previews to get the full size image. In my opinion this should not be possible.

cheers,
Roger

[Wayne Luke]

This is probably by design. You can create a improvement request here: https://tracker.vbulletin.com/vbulletin5/

[anothervbuser]

This is probably by design. You can create a improvement request here: https://tracker.vbulletin.com/vbulletin5/

Are you kidding? This means that the permission system is inconsistent depending on how you upload data to the forum? That's really bad - in my opinion there shouldn't be a difference. Independent where you download stuff always the same rights should be applied.

So then I try to create a improvement request. Additional I try to fix this in my installation by modifying the core accordingly.

cheers,
Roger

Edited: Filled improvement request: VBV-19327 - Enforce permissions also for albums (Download permission not respected for images in galleries/albums)

[Carrfixr]

Agree and voted.

[Wayne Luke]

The Gallery content type is specifically for sharing images. It doesn't require text at all. So a Guest User wouldn't see anything if they opened these topics if they couldn't see the images. Albums are something different. You can work around this by not allowing gallery content to be created in channels that guests have access to. Restrict the sharing of galleries to channels for your registered users. This is controlled by the "Can Create Photo Gallery" permission in the Channel Permissions page.

Albums are different from Gallery content. Albums only exist on the User's Profile. There is a separate permission to hide these. "Can View User Albums". Usergroups -> Usergroups Manager. Edit the Guest User (called Unregistered / Not Logged In in older versions of the software) usergroup to change this.

[Carrfixr]

The gallery photos disappear from a post but the text remains. click the text and the photos show. How do you remove the text so nothing is available?

[Wayne Luke]

The gallery photos disappear from a post but the text remains. click the text and the photos show. How do you remove the text so nothing is available?

That would be an actual bug and isn't how the issue was originally described. Nor is it how it is described in the Improvement Request.

[Carrfixr]

Maybe you can possibly upgrade the tracker to include this

[Mark.B]

Maybe you can possibly upgrade the tracker to include this

I would suggest it's a different issue, because it's an actual bug. It should have its own tracker entry.

In my view it should go further and include phrasing that displays a message such as 'This post contains images. Log in or Sign Up to view them'.

[Carrfixr]

I would suggest it's a different issue, because it's an actual bug. It should have its own tracker entry.

In my view it should go further and include phrasing that displays a message such as 'This post contains images. Log in or Sign Up to view them'.

Or have it say nothing at all since I want to block a certain usergroup from viewing images. Customize able for the situation?

[Wayne Luke]

I used this - https://forums.rabidbadger.io/rabidb...ts-from-guests

Will have to see if I can get it to work with Photo Galleries.

[Carrfixr]

Yea I have that already up from long ago. Sounds like a possible plan if you can

[anothervbuser]

Security by Obscurity? Not the solution I thought about.