[Done 1.5.2] SearchNew Mod v.09

[koldnal]

http://www.endeligmamma.com/yabbse/index.php

and the search new is here.. http://www.endeligmamma.com/yabbse/index.php?board=;action=searchnew

[Stud Muffin]

I saw it there, try refreshing your browser a few times.
Also where is your server as it was very slow for me from the UK and i'm on cable?

[koldnal]

Are you sure? It's the button that says Search|New (not Search). I have even tried to open it in a different browser, and I still can't see it.. Also, I thought only the Search|New was for the members? And I doubt that you took the time and registrated.. hehe

The server is located in norway.. web.no
They are having some problems at the moment, it's not usally this slow..

[Stud Muffin]

Are you sure? It's the button that says Search|New (not Search). I have even tried to open it in a different browser, and I still can't see it.. Also, I thought only the Search|New was for the members? And I doubt that you took the time and registrated.. hehe

Yes i did and it was there, then deleted my account.


I saw this button
http://www.endeligmamma.com/yabbse/YaBBImages/searchnew.gif

[koldnal]

Hmm.. thats wierd.. I still can't see it... How many times am I suppose to refresh.. hehe!

I'll go and ask some of the other members, if they can see it..  

[koldnal]

None of the members I asked can see it either.. there has to be something wrong here.. is there any way to do this manually.. edit the subs.php? but what and where should i do this

[Stud Muffin]

Yes strange, i can't see it now, try backing it out and then doing it again after checking all the permisions.

[koldnal]

Done that now.. still can't see the button there...

[Mach8]

This mod has a serious security problem - any member can see messages in private forums that they're not supposed to.

[Stud Muffin]

This mod has a serious security problem - any member can see messages in private forums that they're not supposed to.

How did you get that as i checked on mine and its ok? I had some unread messages in a private forum, so i downgraded my user and then click searchnew but could not see links to the private messages.

[Mach8]

I have two forums - one for my website staff, and one containing threads between a friend and mine regarding a secret project that we REALLY cannot afford to get out into the public. Thank god I cut off the text at 30 characters

Basically a forum member posted a screenshot showing he could see these threads - you can't deny that.

[Stud Muffin]

Basically a forum member posted a screenshot showing he could see these threads - you can't deny that.

No i'm just saying on mine, on first testing it did not seam to be doing it.

[Stud Muffin]

None of the members I asked can see it either.. there has to be something wrong here.. is there any way to do this manually.. edit the subs.php? but what and where should i do this

Found out your problem one of my german users could not see it untill he switched his id to english.lng

[koldnal]

I figured it out..

And you could never have seen the button

[Forge]

This mod has a serious security problem - any member can see messages in private forums that they're not supposed to.

Mach8, before you go making serious accusations, I suggest you double-check your work.  You may have a security problem on your board, but that doesn't mean the problem exists everywhere.  In a default YABBSE install with my search new mod, the kind of access you describe doesn't exist (unless it is a security hole in the whole board).  I have worked closely with 6 different boards, hosted by several different webmasters, none of which have the problem you describe.

The SQL Search statements used in my mod are based on the SQL statements in the Search.php mod.  As such, they use all the same permissions that are built in for members vs non-members.  If you are using some 3rd party membergroups mod to assign permissions to groups, well then it is likely that the search new won't work with it.

For someone on the YABB support team, I would expect a little better treatment.  Maybe next time you might look at the code (there's not that much to it) to figure out where you think the problem is occuring, rather than just posting un-helpful inflammatory statements.