[Bug / Issue] Clicking link in notification email shows "unauthorized to view - contact administrator" for registered users

[mark.hs]

This has been an ongoing error for almost 2 years, and every six months I resurface it just in case someone has any ideas how to solve. The issue occurs when a registered user receives an email notification that a subscribed topic has a new message. When the user clicks on the link in the email they are sent to the forum, but they are presented with an error which reads something like "You are not authorized to view, please contact the administrator" (sorry I do not have the exact wording ). Users of our forum have basically become conditioned to this error and they ignore the link in the email and simply go to the forum to read the thread directly; which totally defeats the purpose of the subscribed thread notification.

Does anyone else have this issue or does anyone have any suggestions on how to troubleshoot?

BTW, I cannot say definitively, but we think it might be happening only to topics which have had at least one post deleted somewhere in the topic. This is not 100% certain, but it is a lead theory.

Mark

[OrganForum]

They'll get the message if they're not signed when they click the link.

[zweeper]

dont even have a working link in that mails...

[mark.hs]

Here is the exact email from a user:

**********************************
Just received the email when I click on the link I get the old.


"Sorry, you are not authorized to view this page.
Please try logging in or logging in as different user Login or send a message to the admin"


Mike

On Saturday, November 17, 2018, 11:58:48 AM MST, HobbySquawk Support <[email protected]> wrote:



Dear MikeT,


poochies has made a new post under

Official Freewing 90mm F-4 Phantom II Thread


The discussion is located at:

https://www.hobbysquawk.com/node/162536

Here is the message that has been posted:

***************

What he said!

????????? Got 500 to spend before the holidays hit me hard!!!

***************


All the best,

Hobby Squawk - RC Airplane and Helicopter Community


To unsubscribe from this, please visit this page:

https://www.hobbysquawk.com/member/1392/subscriptions

****************************

[mark.hs]

They'll get the message if they're not signed when they click the link.

The forum is public, all topics and posts are public. Clicking the link in the email should simple show them the topic. Notice the link above that I posted, it says "https://www.hobbysquawk.com/node/162536" ... I'm wondering if that is the issue, is the /node/XXXXX structure valid??

[OrganForum]

FWIW, the links in the forum notifications I receive look like this

https://organforum.com/forums/forum/blower-room/general-chat/654351-forum-photos-from-the-days-before-we-self-hosted

https://organforum.com/forums/forum/blower-room/general-chat/654351-forum-photos-from-the-days-before-we-self-hosted

The forum is self-hosted and running VB 5.5.1

[Wayne Luke]

The /node/XXXXX url structure should be usable on your site. Instead of the topic is allows us to easily target a specific post within that topic. Though you can use the node id for the a channel, topic, post, or comment. What is the exact URL for the page when you visit it directly?

Never mind. This I think this is the URL - https://www.hobbysquawk.com/forum/rc-airplanes/jets-and-edfs/116696-official-freewing-90mm-f-4-phantom-ii-thread

The URL in the email address is most likely referring to a deleted node. Possibly through moderation. The node in question should appear on page 137 of the topic between post #2723 (nodeid:162446) and post #2724 (nodeid:126537). If you view that post as an Administrator do you see a deleted post at that location? Users cannnot generally see deleted posts so will the standard No Permission error.

If you permanently delete posts, you won't see the deletion notice in the topic either. However you can run this query to see if the node exists or now:

SELECT * FROM node WHERE nodeid=162536

For a permanently deleted node, nothing should be returned.

However, I think this behavior should be improved.

[mark.hs]

Using the example that the user gave me above, when I click on the link in the email:

https://www.hobbysquawk.com/node/162536

it goes to:
https://www.hobbysquawk.com/forum/rc...thread/page138 ONLY if I am logged in as the admin or Super Moderator. If I logged in as a registered user - OR - not logged in at all, I get "Sorry you are not authorized to view this page. See the screenshot below of a real registered user, logged in, and not able to access that page.

[mark.hs]

I just did a test on this forum. I subscribed to this post. I received an email. I cut and pasted this link https://www.vbulletin.com/forum/node/4413920 into an incognito window and it took me straight to this forum page; without being logged in or being registered.

So we can safely say it is a setup issue on my end. Now, where the heck do I start looking?

"

[Wayne Luke]

I have created an Improvement Request to make this functionality behave better and create fewer frustrations with users.

https://tracker.vbulletin.com/vbulletin5/issues/VBV-19330

[mark.hs]

Wayne,
1. is it not happening on this site because we have not deleted a post in this topic? Can we test that.?
2. I know you guys have thousands of improvements to work on, so this could be a very long time before it gets resolved. Is there a setting I can change in VB (related to deleting posts) or is there a new process (not deleting but instead hiding) I can deploy to prevent this. ?
3. and why doesn't it affect Admins or Super Moderators? makes me think it could be a permission setting?

[Wayne Luke]

Using the example that the user gave me above, when I click on the link in the email:

https://www.hobbysquawk.com/node/162536

it goes to:
https://www.hobbysquawk.com/forum/rc...thread/page138 ONLY if I am logged in as the admin or Super Moderator. If I logged in as a registered user - OR - not logged in at all, I get "Sorry you are not authorized to view this page. See the screenshot below of a real registered user, logged in, and not able to access that page.

That is most likely because Admins and Moderators can view "deletion notices". If the "Can View Deletion Notices" permission is set to No for the usergroup, they are seeing a valid no permission error. The fix is that if that would occur that find the user's last read post in the topic and redirect them there instead. Should put them roughly in the same place and make the system more intelligent. See my post above.

[Wayne Luke]

Wayne,
2. I know you guys have thousands of improvements to work on, so this could be a very long time before it gets resolved. Is there a setting I can change in VB (related to deleting posts) or is there a new process (not deleting but instead hiding) I can deploy to prevent this. ?

If customers reading this topic think the change should be made and vote on it, I will have a better chance of pushing it forward quicker. The more votes it gets between now and Monday, the easier my job of pushing it forward will be.

[mark.hs]

Wayne Luke what if we unapproved the post instead of deleting it?

[Wayne Luke]

An unapproved post would only be visible for the user that created it.

[mark.hs]

Wayne, I have two users who PM'ed me that said they cannot click the +1 in the Bug Tracker.. the + is grey out.. do you know what is going on??