Core: Restricted tag issue

[PeopleInside]

Bug Report

Current Behavior

• A restricted tag is added (primary) where the regular user are allowed only to see discussions.
• User see the possibility to start a discussion on this restricted post also if when try to post they have not permission. This made user create all post text and after negate the publish permission: the start discussion on that tag should be forbidden from the start.

Steps to Reproduce

1. Create a restricted primary tag where regular user can only read.
2. From user profile go on this tag, you will be able to create a post.

Expected Behavior
Start discussion should be disabled.

Environment

• Flarum version: Beta 8.1
• Website URL: https://community.peopleinside.it/t/rilievo-sticky
• Webserver: [apache,]
• Hosting environment: [ vps]
• PHP version: 7.1.x
• Browser: [Firefox]

Output of "php flarum info", run this in terminal in your Flarum directory.
Really necessary?

Possible Solution

Start discussion should be disabled where user has not permission to start a discussion

[franzliedke]

Output of "php flarum info", run this in terminal in your Flarum directory.
Really necessary?

Yes. We need to know what version of the tags extension (and other extensions) you are running.

[PeopleInside]

Ok, sorry :)

Flarum core 0.1.0-beta.8.1
PHP version: 7.1.XX
Loaded extensions: Core, date, libxml, pcre, dom, fileinfo, filter, hash, json, SPL, bz2, posix, Reflection, session, SimpleXML, standard, xml, xmlreader, xmlwriter, bcmath, openssl, calendar, ctype, curl, dba, mbstring, ftp, gd, gettext, gmp, iconv, imap, intl, ldap, exif, mcrypt, zlib, pcntl, PDO, pdo_sqlite, shmop, soap, sockets, sqlite3, sysvsem, sysvshm, tidy, tokenizer, wddx, xmlrpc, xsl, zip, Phar, mysqlnd, mysqli, pdo_mysql, ionCube Loader, Zend OPcache
+----------------------+-----------------+--------+
| Flarum Extensions | | |
+----------------------+-----------------+--------+
| ID | Version | Commit |
+----------------------+-----------------+--------+
| flarum-approval | v0.1.0-beta.8 | |
| flarum-bbcode | v0.1.0-beta.8 | |
| flarum-emoji | v0.1.0-beta.8 | |
| flarum-flags | v0.1.0-beta.8.1 | |
| flarum-likes | v0.1.0-beta.8.1 | |
| flarum-lock | v0.1.0-beta.8 | |
| flarum-markdown | v0.1.0-beta.8 | |
| flarum-mentions | v0.1.0-beta.8.1 | |
| flarum-sticky | v0.1.0-beta.8 | |
| flarum-subscriptions | v0.1.0-beta.8 | |
| flarum-suspend | v0.1.0-beta.8 | |
| flarum-tags | v0.1.0-beta.8.2 | |
| flarum-lang-english | v0.1.0-beta.8 | |
| flarum-pusher | v0.1.0-beta.8.1 | |
| flarum-auth-twitter | v0.1.0-beta.8 | |
| flagrow-upload | 0.7.0 | |
| flarum-auth-github | v0.1.0-beta.8 | |
| flarum-statistics | v0.1.0-beta.8 | |
| flarum-auth-facebook | v0.1.0-beta.8 | |
| fof-user-bio | 0.1.1 | |
| nearata-lang-italian | v0.1.0-beta.8.2 | |
| reflar-twofactor | 0.1.0-beta.4.2 | |
| flarum-akismet | v0.1.0-beta.8 | |
+----------------------+-----------------+--------+
Base URL: https://community.peopleinside.it

[tobyzerner]

Confirmed

[PeopleInside]

This is strong issue for my community, hope can be solved. I don't have user so is not urgent but i think can create big issue to a community where there are different users as they create his post and only after discover, with the red message, they are unable to post. Hope this will be fixed in the next version of Flarum.

[PeopleInside]

up

[askvortsov1]

@PeopleInside I'm trying to test for this, and I'm not able to reproduce it on the most recent version (11.1 beta). If it's still an issue, could you please record a gif of how this happens on a 11.1 beta site, and post here so that I can have a start towards fixing it?

[PeopleInside]

Hi @askvortsov1 , this still be a stressful issue. I'm happy someone will look into this.
Maybe this issue need steps for reproduce.

You need create a tag than restrict permission to post in this tag only to admins.
For example i have tag Announcements that can be view by anyone but only admin can do other axctions.

Normal user must have permission to see posts than when user open the tag see all post in Annuncments and left top can start a discussion.

Can write a title and post but when press for publish the message an error alert the user they have not permission to do.

The left button on top should be disabled as the user has no right to post there.

[askvortsov1]

Hi @PeopleInside! I think I'm following this protocol, but I'm still having issues reproducing the bug on beta 11.1. I'm seeing the issue on your site, which seems to be running beta 8, but it seems like that could be fixed by updating to beta 11.1.

[PeopleInside]

I'm using the latest Flarum version 0.1.0-beta.11.1
https://discuss.flarum.org/d/22102-flarum-0-1-0-beta-11-released/77

I kep my server software always updated.

[askvortsov1]

So I've set up a test site at https://askvortsov.flarum.cloud/t/general. I can see that the create discussion button is enabled when not logged in, but no one can post when not logged in anyway. When you log in, that instantly goes away. Can you try reproducing it on there?

[PeopleInside]

Seems also if I'm registered i cannot post everywhere. No permission to post anywhere. You need maybe create more tag. What version are you running?

[askvortsov1]

Ah ok I see, got it. It looks like the "permission to create" system is determined by whether the user has permission to post in general, not just in the active tag. I'll work on a PR, thanks for the help identifying the issue!

[PeopleInside]

Thanks for your help

[askvortsov1]

Proposed fix in above PR, sorry this took so long to address!

[PeopleInside]

@askvortsov1 thanks. I tried to apply this just editing the js file but seems not work for me. Need edit something else?

[tankerkiller125]

@PeopleInside PRs only include changes to the raw JS, if you wanted to actually try the PR you would need to compile the JS by running npm install inside the js/ directory and then npm run dev or npm run build after that.

[PeopleInside]

Thanks npm run build works.
The fix seems work but only disable the button, should exist an alert to user that explain they cannot post? Also is not really clear the button is disabled... Should be better show a message like can't reply or can't post or do disabled button more clear maybe change pointer the mouse.

I'm testing and can be not clear to the user the button is disabled because is a section than cannot post because no permission.

Anyway thanks for the fix :) it works now

[askvortsov1]

My bad, I forgot to change the button text. I'll push that shortly

[PeopleInside]

Thanks @askvortsov1 , remind the button should respect the translation.
When the fix will be ready i will test again.. just follow previous step i believe. Thanks again for fixing this.

[askvortsov1]

Should be fixed now @PeopleInside

[PeopleInside]

Works, thanks @askvortsov1 . Great Job

[PeopleInside]

Hi, this issue is not fully resolved. I opened a new report: https://github.com/flarum/core/issues/2149