Security Issue: Latest Forum Topics

[Mephisteus]

It doesn't take in mind if the forum is passworded or not, basically you can see the thread title, poster etc. in a passworded forum and even use the preview function of vBulletin allowing anyone with access to that block to view the first chars of that post without having access.

[Zachery]

Have you tried logging out first and seeing if said threads are still listed?

[Our Sponsors]

[Mephisteus]

Yes, I have tried that. Still the same

[Brian]

forum/includes/vba_cmps_include_bottom.php - Look for:

if (!($forumperms & CANVIEW) OR !($forumperms & CANVIEWOTHERS))

Replace that with:

if (!($forumperms & CANVIEW) OR !($forumperms & CANVIEWOTHERS) OR $forum['password'])

And that should fix the problem.