Pin topic - Returns 403 Forbidden for Global Moderators

UniversalSuperBox

Hello!

I'm having some trouble with my NodeBB 1.16.1 forum. Usually, users who are members of the Global Moderators group are able to pin posts in any category. However, this has stopped working after our upgrade to v1.15.5 (and remained broken after upgrading to v1.16.1).

When a member of this group tries to pin a message, they receive a 403 Forbidden with the following payload:

{
  "status": {
    "code": "forbidden",
    "message": "[[error:no-privileges]]"
  },
  "response": {}
}

If I grant the "Moderate" permission to any of the users in the Global Moderators group on any category, they are able to pin topics in the granted category. I can do this from the Privileges page or by adding the user to the "Admins and Moderators" page. However, these users are still unable to pin topics in any other categories despite their Global Moderator membership.

Members of the administrators group are able to pin topics in all categories. Members of the Global Moderator group are able to delete, move, and lock topics as expected. It seems the only affected functionality is pinning topics.

I'm running NodeBB behind an nginx reverse proxy, which is proxied again by Cloudflare.

There does not appear to be anything in the output.log of the running NodeBB when this error occurs.

Is there some more logging that I could enable to try to see the problem in more detail? Or should I be posting this as a bug report instead of a support request?

NodeBB version: v1.16.1
NodeBB git hash: d7044a5e8623ae6b95360ff58e8f6dbc0e90629b
NodeJS version: v12.20.1
Installed NodeBB Plugins:

Active plugins:
	* [email protected] (installed, enabled)
	* [email protected] (installed, enabled)
	* [email protected] (installed, enabled)
	* nodebb-plugin-emailer-mailgun (not installed, enabled)
	* [email protected] (installed, enabled)
	* [email protected] (installed, enabled)
	* [email protected] (installed, disabled)
	* [email protected] (installed, enabled)
	* nodebb-plugin-import (not installed, enabled)
	* nodebb-plugin-import-mybb (not installed, enabled)
	* [email protected] (installed, enabled)
	* [email protected] (installed, enabled)
	* nodebb-plugin-newsletter (not installed, enabled)
	* [email protected] (installed, enabled)
	* nodebb-plugin-recent-cards (not installed, enabled)
	* [email protected] (installed, disabled)
	* [email protected] (installed, enabled)
	* [email protected] (installed, enabled)
	* [email protected] (installed, disabled)
	* [email protected] (installed, enabled)
	* [email protected] (installed, disabled)
	* [email protected] (installed, disabled)
	* [email protected] (installed, enabled)

Database type: redis
Database version: Redis server v=5.0.7 sha=00000000:0 malloc=jemalloc-5.2.1 bits=64 build=636cde3b5c7a3923

PitaJ

I can confirm this issue. Please open a bug report on GitHub.

UniversalSuperBox

Got it. https://github.com/NodeBB/NodeBB/issues/9194

UniversalSuperBox

Great news! https://github.com/NodeBB/NodeBB/commit/c0fb1cb59cd76f46919a171862bc4015d1ff2d2a should fix the issue in v1.16.2