Fixed Secret Groups leave a "gap" on Group index

[Freelancer]

Situation: A user views group index with the group grid and one group is "secret" (and he is not a member of that group). The grid displays only the groups that are visible except the secret group, but the secret group leaves one grid slot EMPTY (at the end of the grid page). I have 24 groups per page and the grid is set to 4. So it should work normally.

I checked it with a member of the secret group and he sees the secret group (of course) and therefore 24 groups are displayed.

It would be necessary that if one group is not shown, all other groups shift into the next slot to close the ranks...

 

[alfa1]

That is a remarkable bug, because a secret group should not have hidden visibility but should not have any visibility at all. The page should not call any secret group if the user does not have permission.
This makes me wonder if our script kiddies and hacker users users can somehow make secret groups visible. Which would be a security issue.

 

[Truonglv]

This makes me wonder if our script kiddies and hacker users users can somehow make secret groups visible. Which would be a security issue.

alfa1Oh. How to? Add-on doesn't generate HMTL for user did not have permission to view. It is issues because it is query include the secret group then remove it after query. It is normal processing on XF there.

 

[alfa1]

It is issues because it is query include the secret group then remove it after query.

NobitaIs it not better to insert after the query if permission is found?

 

[Truonglv]

Is it not better to insert after the query if permission is found?

alfa1Yeah. Secret check in group you are in and some privacy.

 

[Dadparvar]

That's right.

We also have this problem. Good attention @Freelancer

 

[Freelancer]

 

[Freelancer]

And now?

 

[Truonglv]

It is as designed. I have some ways to resolve it but it is make poor performance so leave it.

 

[Dadparvar]

leave it.

Nobita