usergroup is able to post in category without permission

[Mary303]

Classifieds url
Main Index - Blab Classifieds

Is set up and open for use. However users have not been notified and haven't used it. Myself and 2 others have had access and made edits. I have used 2 test id's as well as my id.

Admin url
Login - Blab Classifieds
access username REMOVED
password REMOVED

Admin > Edit Categories (top category)
Blab Auctions > AUCTIONS - All Items
TEST
both the above categories are unchecked for usergroup 0101_Free Member

However, this user can post in both categories
username: TestFree
password: asdf123
usergroup: 0101_Free Member

Examples of posting by TestFree in ...

Blab Auctions > AUCTIONS - All Items (photo - reindeer)
***TESTFREE auc sat. 830p 1112 - Blab Classifieds

TEST (photo - white flower)
***TESTFREE auc sat. 845p 1112 - Blab Classifieds

How is TestFree able to post the above ads without permissions? More important, how can I make sure the usergroup 0101_Free Member is not able to post in the categories I want to block to them?


Also, category Blab Auctions > AUCTIONS - All Items is not retaining the category avatar filepath I have set to provide an avatar. The filepath disappears and is replaced by the latest auction item, whenever one is created. Is there a way to stop this happening?

[Chuck S]

The category avatar is only set on a category when it is empty. If an avatar exists it is not replaced

As far as your permissins in pp-inc.php is line 2437 make sure it is as posted in bold

Content visible to verified customers only.

[Mary303]

OK that edit seems to have fixed it.

The category avatar is only set on a category when it is empty. If an avatar exists it is not replaced

Unfortunately the avatar url is sometimes being replaced. I don't know what happens that is causing that.

[Chuck S]

The code that updates a category avatar is pretty specific

Here is the code right from our image-inc.php file

Content visible to verified customers only.

The code clearly checks for the thumbnail field of the category and only if it is empty would the avatar be updated otherwise the avatar the admin sets would be used.