lichess-org / lila

♞ lichess.org: the forever free, adless and open source chess server ♞
https://lichess.org
GNU Affero General Public License v3.0
15.52k stars 2.26k forks source link

Moderator eye is available to a user without mod perms in a broadcast #11880

Closed Arihol closed 1 year ago

Arihol commented 1 year ago

I’m a contributor to a broadcast, and (afaik) I have no mod permissions. Usually, when I click on a chat message I see the report button (as intended). But occasionally, especially after typing something in the chat myself, I see a mod’s eye, with the option to time out players.

To reproduce: create a broadcast via a regular account and have it featured on the broadcasts page. The mod options just appear (and disappear) randomly when hovering over a chat message. 3577E050-C163-42D7-B78E-5ADB93F75AFE

Yeltcki commented 1 year ago

Is the mod eye only appearing when the broadcast is not official yet, and when it's official it doesn't appear? Or does it also appear to you when the broadcast is official? If it only appears when it is not official, then it's normal because there is a permission to be able to timeout when the broadcast is official. You're also probably just a page mod when the broadcast is not official.

Arihol commented 1 year ago

The mod eye comes and goes, sometimes after I refresh the page. I’m quite sure this broadcast is official, even though it’s not a BBB event.

https://lichess.org/broadcast/25th-open-international-bavarian-championships/whVomW3g

benediktwerner commented 1 year ago

You are the creator/owner of that broadcast so you are a page mod on it and therefore should have a mod eye to time out users. But in active official broadcasts, this is restricted and only Lichess mods can time people out. Once the broadcast becomes inactive or unofficial, the behavior reverts back to normal.

Arihol commented 1 year ago

I’m aware of that, but the broadcast has been official throughout this week, and the mod perms just come and go in a seemingly random fashion… Sometimes it appeared when the broadcast was at the peak of its activity, whereas in between rounds it disappeared again.

Arihol commented 1 year ago

Ok, I think I have the exact steps to reproduce the bug.

If you’re a broadcast manager with no mod perms and you click on a message in the chat, you see the report button as intended.

BUT, if you click on one of the games first, and then click on a chat message, you get mod perms for some reason.

Arihol commented 1 year ago

4C0E7A25-4899-4CFD-946E-0F316C8EFFA4 EEAF8265-2A14-460C-979D-34439D69FC4B

Arihol commented 1 year ago

Resubmitting as a bug report