Shade- / MyFacebook-Connect

A plugin to integrate Facebook with MyBB, letting users login and register through Facebook.
27 stars 24 forks source link

2.0 group after registration #19

Closed amplifier1 closed 10 years ago

amplifier1 commented 10 years ago

A very strange issue it just happens randomly .

I created a user group for the facebook users and in the plugin settings changed the group after registration to that group. The first time it worked perfectly but then after 2-3 times while registering it automatically changed to the Administator group . Mybb showed a no permission page with warnings then I checked that user in the ACP where its Primary usergroup was Administrator.

amplifier1 commented 10 years ago

I forgot to mention this

After your latest update I didn't uploaded this updated file ah.. I think this could be the reason

MyFacebook-Connect-unstable\admin\modules\config\myfbconnect.php

Shade- commented 10 years ago

I will look into this too. Seems like a high risk vulnerability if confirmed. Anyway, upload the latest 2.0 version (just upload), you will see in the settings a select box with all the existing usergroups: see what usergroup you have inserted, maybe you've chosen the wrong GID (4 == administrators).

That file is just the admin module, it doesn't affect any client-side routine.

Shade- commented 10 years ago

Most probably your fault here. Double checked this and the target usergroup is $mybb->settings['myfbconnect_usergroup'] which is only set by you in the ACP.

amplifier1 commented 10 years ago

I will update if it happens again.

amplifier1 commented 10 years ago

It happened again there is a bug.

First the After registration usergroup in ACP automatically gets changed to guests.

If an registered user tries to login then nothing weird happens but if a new user try to register using fbconnect the user gets registered with Administrator as primary usergroup.

But when I try to reproduce it by changing the after registration group to Guests the error do not happen instead the user gets registered with Guest as primary usergroup.

http://www.youtube.com/watch?v=vFeJNQtQlB4

amplifier1 commented 10 years ago

File: inc/class_session.php (Line no. 273) Message array_merge() [function.array-merge]: Argument #1 is not an array

File: inc/plugins/inlinesuccess.php (Line no. 207) Message session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at /home/xxxxx/public_html/XXXXXX/inc/class_error.php:215)

File: inc/functions.php (Line no. 1721) Message Cannot modify header information - headers already sent by (output started at /home/xxxxxx/public_html/xxxxx/inc/class_error.php:215)

File: inc/plugins/inlinesuccess.php (Line no. 187) Message Cannot modify header information - headers already sent by (output started at /home/xxxx/public_html/xxx/inc/class_error.php:215)

amplifier1 commented 10 years ago

Finally now I have found how to reproduce the error.

You should have both inline success and MFC 2.0

Second Video http://www.youtube.com/watch?v=TKGCE3HgKfA&feature=youtu.be

First do as shown in video

Change inline success settings

Now the MFC settings would have automatically changed to guests (do not change yourself to guest)

then register a new fb user (delete existing user from ACP then re-register)

Mybb will show a no permission page

Now check the new registered user primary group in ACP

Shade- commented 10 years ago

Uhhhh weird. It's not a ISM - MFC conflict, it's a bug in the settings saver function of MFC. Will push a fix ASAP.

(the user will have usergroup == void which in the validation process gets changed to admin automatically).

sashh82 commented 10 years ago

Shade Can you make Steam Connect??

Shade- commented 10 years ago

I have still to publish MyGoogle+ Connect. Not sure how Steam works, but will give a try in the future most probably.

sashh82 commented 10 years ago

ok