members cannot move ads (2.5)

daxter · March 2nd, 2007, 06:52 AM

If members try to move their ad, they get the error You do not have permission for this action! (It works for admins).
Delete ad works for members.

Any idea of what might cause this?

I see $Globals['userdel'] is tested. Where is this defined?

Chuck S · March 2nd, 2007, 07:50 AM

In admin options where it asks if users can move/delete there ads.

I do not see any difference here between my 2.5 and the current 2.6 version and am able to move ads. You can always download fresh code and try upgrading.

daxter · March 2nd, 2007, 01:33 PM

Thanks Chuck, found the setting. As expected it was set to "Yes".
Now I have reloaded all original 2.5 source and template files, but still members cannot move.

(Can't upgrade to 2.6 yet due to many mods)

Chuck S · March 2nd, 2007, 06:31 PM

This is what I have at the bottom of the adm-product.php file

Code:

Content visible to verified customers only.

daxter · March 3rd, 2007, 04:24 AM

Thanks Chuck, that solved it! I had

Code:

Content visible to verified customers only.

No version info in the file, but it was downloaded 25.april.2006

Chuck S · March 3rd, 2007, 09:49 AM

Thats and old 2.5 version so most likely a bug that had been fixed later

daxter · March 3rd, 2007, 10:34 AM

Yes, i understand that. Will upgrade to 2.6 as soon as time allows. Thanks!

Can't you setup a classified here so that we can test? F.ex. I would like to see how filmstrip works.

Chuck S · March 3rd, 2007, 11:12 AM

I dont have anything to do with the website here just support sorry but will pass that along.

daxter · March 3rd, 2007, 12:27 PM

Thanks!

Just got a new question: Today a unregistered user managed to post an ad. He is named "Unregistered" and user ID is 0! (IPB integration).
This have never happened before. I checked that guests cannot post.
Could it have some connection with the change I made to adm-product.php?
Or any other suggestion?

It appears to be a real ad, no scam.

Chuck S · March 3rd, 2007, 04:26 PM

If you have guests set not to upload ads then they should not be able to. The change you made has nothing to do with uploading permissions

daxter · March 4th, 2007, 04:43 AM

Guest do not have permission to post, and I have checked that this is working. As said, user is "Unregistered and userid is zero. Does that conform with a guest posting?

Just got it confirmed that he was logged into Invision when he posted the ad.
Searching the database i found one similar post, added a month ago. (Db contains 465 ads)

Chuck S · March 4th, 2007, 10:45 AM

Maybe somehow his cookie got whacked out? If guests can not post they can not post. So somehow he had permission to upload but maybe midstream through upload his cookie got dropped which is possible.

daxter · March 4th, 2007, 01:31 PM

As said he confirmed that he was logged in when posting the ad.
Since it has happened only twice in 8 months I just leave it.

daxter · March 14th, 2007, 03:30 PM

Today it happened again, ad posted by "Unregistered"...

daxter · April 5th, 2008, 04:50 AM

Have some more info:
This problem occurs when the IPB "member_id" cookie is missing. Since the other IPB cookies are present Classifieds think that the user is logged in and allow the ad to be posted.

(I haven't been able to duplicate what cause the "member_id" cookie to be missing, but obviously this must be a fairly common state of IPB)

Chuck S · April 5th, 2008, 10:40 AM

I dont see how that can happen we only grab info based on the member_id cookie. You allow guests to post ads?

Code:

Content visible to verified customers only.

Unless we can grab a users group based on their info it would be extremely hard for them to have posting permissions unless your allowing guests to post ads see my thought here.

daxter · April 5th, 2008, 02:12 PM

No, we do not allow guest to post.
As can been seen from the above posts we have been struggling with this problem for over a year. Regularely we have had these ads from "unregistered", but I have never been able to duplicate the problem.
Then, a few days ago I discovered that the "post new ad" option was available when I visited classifieds as guest. Examining the IPB cookies they where all there except for the "member_id".
So as far as I can tell there is a bug in the way Classifieds tests if a visitor is logged into the forum or not.

Chuck S · April 5th, 2008, 04:53 PM

well try this although as I stated its impossible that I see to pull the users info if there is a not a member_id cookie since thats how we pull his usergroup and assign permissions. Thus if what your saying is correct how are we getting the proper usergroup to assign permissions to upload do you see what I am saying here. Hense this is why I posted the code I noted because if a user is logged in not logging in we only grab the user info if that member_id cookie is present.

In ib2.php you can try adding this in bold

Code:

Content visible to verified customers only.

daxter · April 5th, 2008, 05:30 PM

Thanks a lot Chuck, I have made that modification, guess this solves the problem.

Sorry for my confusing description. I'll try again:

This situation occurs when a user is logged out of the forum and, for some unknown reasons, the "member_id" cookie is missing. All other IPB cookies are present.
Classifieds, again for unknown reasons, think that the user is logged in and let him post an ad. But since the "member_id" cookie is missing, the user name is missing from the "showproduct" display, field is empty.
But in the main listing it says that the last ad is posted by "Unregistered".

All these ads that I have been able to trace have been posted by members that has been logged out when visiting the Classified section. None of them have been made by pure guests.
(I said in post 11 that the user in question was logged in, but further investigation showed that this was wrong, he was not logged in.)

Chuck S · April 5th, 2008, 05:34 PM

Right all I am saying is if there is no member_id cookie we cant grab user data therefore we cant grab a usergroup so how would he be able to post unless you allow guests to post which is what I was saying.

The member_id cookie is the userid which we use to grab his forum info.