#5703 - backend.php showing all available feeds to Guests

This is a spacer post for a website comment topic. The content this topic relates to: #5703 - backend.php showing all available feeds to Guests
By Guest posted
Whoopsie that does sound like an issue.
By Guest posted
@Adam I need more information. It looks like RSS hooks have proper privilege checking in place. What specific backend.php URL calls are causing a leak of info? And where are these calls located?
By Guest posted
Ignore; I found the issue. I'm assuming it's opml because I saw some feeds listed that guests normally would not have access. I added a clause to hide those for guests.
By Guest posted
Automated response: backend.php showing all available feeds to Guests

backend.php opml mode was publicising all available feeds, even ones guests would not be able to access.

This patch hot-fudges a list of feeds we don't want to promote to guests; they will no longer display in the opml feed.

However in v11, we should add a new method in the RSS hooks for privilege checking (based on current member) and use that instead.

By Guest posted
Fixed in v11 with a better approach using a new method on RSS hook calls

https://gitlab.com/composr-foundation/composr/-/commit/e25cffa0ff26d49d1b48b2a62694a57855563972
0 guests and 0 members have recently viewed this.