Problems with user groups/permissions

[Marc Boisvert-Dupras]

Hey all, there seems to be a problem with group permissions on my forums. For some reason, users are able to join private group without being accepted which is quite a problem as we have ~3k users and this sort of thing can become unmanageable very quick. We use groups on the forums for our staff members and they have special permissions to moderate topics etc..

I also noticed that when removing a user from said groups, I get a Error: Invalid data alert but the user does get removed from the group. Something is wrong but I cannot pinpoint what exactly and nothing shows up in the logs.

We are running 0.8.2 currently. Any help would be appreciated! If you need more information please ask and I shall oblige

[pichalite]

@Marc-Boisvert-Dupras what's your community's URL?

[Marc Boisvert-Dupras]

@pichalite http://forums.eternalgames.net/

[Marc Boisvert-Dupras]

Anyone? This is a pretty major thing for us :S

[yariplus]

Is this on?

[pichalite]

@Marc-Boisvert-Dupras this is probably related to this bug

gh#4008

You will have to upgrade to 0.9.x or modify the file yourself to fix the issue

sohrabafard created this issue in NodeBB/NodeBB

closed private group - security #4008

[Marc Boisvert-Dupras]

@yariplus Yes of course

@pichalite I will attempt an upgrade to 0.9.x see if it fixed the issue. Thanks a bunch!!