Guest can delete Wall posts??

Today I realized that Guest can delete posts on the wall.

How can this be??

I've checked:

Settings --> Membership Levels --> Non-member  and then their allowed Actions.

None of such action for Guest (Non-member) is allowed on that list.

I tried to alowe it and then dissabled it again but no change. Guest can simply delete Wall posts.

Can somebody help?

Thanks!

Mayki

Check your settings in the app itself.

 Sorry, I read but still missed that part about you resetting.

Also uninstall and reinstall. But on this the members would most likely lose their messages.

Thanks jcrouch.

I know that so that is why I don't want to reinstall the module.

Is it possible that Non-member isn't the same as Guest?

What if I create another membership level with that name and then edit their allowed actions??

No, but that reminds me. At the top of the membership level settings, is the "Enable promotional membership" checked or unchecked? If checked and you have it set for members to delete wall posts then they would still be considered guests with membership abilities.

I don't think that would help. The real issue would have to be fixed in this case since the standard membership levels and functions are default by design.

Hi,

The "Enable promotional membership" is unchecked. And yes  Jcrouch I was thinking the same as you, that creating Guest membership wouldn't solve the problem.

What I did for now unti the problem is solved (if solved), I just denied access to guests = only members can view Wall. (Builders --> Navigation Menu --> WallViewer = Visible - just for Members)

Then I re-checked Wall behavior and I'd realized that as a Standard Member (not moderator or admin) I have the same rights = I can delete any post on anybody's wall???? 

I hope for some help on this isue.

Regards

Mayki

I think that I understand what is going on now.... Put your guest settings back to what you had them and try going in with another browser or device that the site doesn't recognize or ask some BoonEx members here to go into your site to confirm whether or not a guest can delete wall posts. Of course you would also need a wall post for them to check.

You are set by default as a standard member but your login knows that you are an admin so naturally you would have admin rights as a standard member. I made a test member so that I could check to see what a standard member can and can't do or see on my site because their view and function still would not be the same for me. I also made an Admin membership with my own badge and set all permissions for the admin then changed my status to admin. In the price setting set 0=lifetime and for price, leave it blank. This prevents it from being seen by members and from purchase choices. You will still be recognized as the same old admin but you will see that you actually have more control and accesses from the site too. I would not advise giving this badge to others because they would have all the rights that you have. You would want to make one specifically for moderators with no ability to edit or approve anything but every ability to delete. This keeps them out of your admin panel.

You can verify that no-one else can see it as you by using another browser and/or device signing in as your test member and not signing in as a guest. If your browser has a hard time with this just empty your browser history and cache. You may even need to restart and sign in with test member first before signing in as admin.

I have seen this happen only when the "wall" has been moved to the homepage; did you do that?

If so set the wall for members only.

Hi,

@ Jcrouch and newton27
Thanks for your suggestions. Everything is as it supposed to be with memberships, allowed and denied actions are OK. It was my mistake on previous post when I wrote that Standard member can delete any post on the Wall. I was checking settings with account thinking it was Standard but it was Moderator. So I created new test account  (Standard membership) and it can not delete or edit any post. So this is OK.

Mystery with a guest account continues...

If I log out , clear browser cache with CCleaner, tried with other browsers, other computer and even remote computer over TeamViewer guest account can delete or edit any post on the Wall. But it can not write on the Wall (access denied).

@ newton27
I did not put the Wall to the Hompage.

Now I hide Wall from top menu so it is visible for the members only. But if someone=guest knows how Dolphin works it can simply add this in a browser address bar:

/modules/?r=wall/index/xxx  or /modules/?r=wall/index/{memberNick}

then one can again access the Wall and delete Wall posts.

(btw. you can see that I'm not using permalinks becouse I'm not running my web site with apache but with lighttpd.)

So there is stil something wrong, but I realy don't know where else to look at.

Any additional help or advice would be very much appreciated!

Regards

Mayki

Mayki is correct here..!

This is my testing on 7.1!

This is a recent member on the DEMO of 7.1 http://mynewbeetle.net/7.1/modules/?r=wall/index/Harry

you can navigate to ANY profile this way and delete all the comments as a guest on the site.

For now you should use the PAC module and block the page from guest.

That's insane.... I just finished checking my site as a guest. I had blocked every avenue in the modules, member settings, pages, page blocks, Navigation blocks, member menu blocks and all settings else where to prevent guests from seeing anything more than the front page, public media, featured media, and other public viewable items.

I am not able to view the wall itself as a guest. It says "access denied" and I do have my wall set to public. I even pasted my wall address into the browser to try to reach it directly as a guest and the site gave me nothing but it also did not say access denied this time.

I know that with dolphin, if every page, item and setting isn't in sync with each other, it will still leave a loop hole open. So you may want to reconsider doing a double check on every setting in every corner of the site.

I hate to use this site as a test for what I found..

ustillup.com you cannot do anything on that site without being redirected to the join page..

WARNING THE FOLLOWING LINK CONTAINS AN ADULT IMAGE BANNER! IF THIS TURNS YOUR STOMACH... OR FREAKS YOU OUT DON'T CLICK THE LINK

BUT  

use something like this http://ustillup.com/modules/?r=wall/index/Michael

then click on the actual "photo"on the wall, and boom, you in the site able to view what is supposed to be only for members of the site to see..

Okay newton27 "Graphic Warning" would have been nice..... I know that I haven't released the info but I am now..... I am a woman and would appreciate the graphic warnings so that I can choose NOT to click.

LOL I haven't been here long enough to know that a red but is a warning. (I hope my computer is alright, I nearly knocked it over trying to get out of there.)   I did try opening my wall using your url method with my site and username.... still can't access my wall or view it as a guest.

There is a pic of what I see as a guest on my site with this url..... no graphic's warning needed.

I realy don't konw what to do...

Attached is a snapshot of a wall, me beeing as Guest....

Is this a bug or just some miss configuration?

 I'll install later a fresh Dolphin 7.0.9 to my test server and I will see how the Wall works on new instalation.

Thank you guys for your help, if any new findings apear, please let me know.

ps. Welcome lady Jcrouch!!

Regards,

Mayki

Thanks Mayki....

I notice on the screenshot wall it also has option for guest to post on the wall.....  That could be one of those settings leaving a loophole open.

 I'll try to remember gender, but your profile photo, and user name is not "Female;" so I assume most webmasters look over the site material.

I have worked on many sites I hated to look at but as a professional, and making money, I am able to look over that.

No problem newton. I should have known better because I am aware of what others use dolphin for. No biggy, it's like that spider on your leg that won't hurt you but makes you hurt yourself. LOL I got a good laugh out of it.

I did too, reading your post about trying to get it off your screen, again, sorry. Was a good laugh for me as well.

I was able to reproduce this problem on my older 7.1 SVN install.

But i cannot reproduce it on my 7.0.9 site. Guests on my 7.0.9 site cannot delete wall posts.

So i am still trying to figure out what the difference is. But at the moment i am rather busy and don't really have the time to look into stuff like this.

deano92964

We all  know that who ever use Dolphin must have a lot of patience....

So I wil wait patiently and during that time I'll try with fresh installation just for this testing.

Hi,

I have installed fresh version of Dolphin 7.0.9.

In this fresh version Guests can not delete posts even if you use /modules/?r=wall/index/xxx  or /modules/?r=wall/index/{memberNick}

I have  checked settings in:

Builders --> Navigation Menu and there is the diffrence between fresh instalation of Dolphin and my "on-line" instalation. In my "on-line" instalation there is WallViewer in NavigationMenu though on fresh install isn't. (See attached image (wall-viewer_01.jpg))

I tried and removed WallViewer from Top Level Menu but the problem persist.

The second attached image (wall-viewer_02.jpg) shows that there are several WallViewer in Inactive Elements field. I have removed those too, so now there is only one WallViewer in inactive elements field and without WallViewer in the Top Level Menu, but none of this action solved the problem.

I know that this topic is old, but has this been fixed, because I have the same issue, version 7.2?!

https://github.com/boonex/dolphin.pro/issues/246 

Not fixed I have the same problem on 7.2.1 ..

please fix this is terrible 

It has been fixed:

https://github.com/boonex/dolphin.pro/commit/fd755e9ca87687f0636907507dbbe86924363a98