Request for help - potential website security issue

[Carol Haynes]

I have set up a website for my local running club. A member has informed me that the private members' forum can be access just by browsing the website without entering a username and password and is therefore not private.

The website is www.swaledaleroadrunners.co.uk and I can't find any way to read forum messages without logging in.

Unfortunately the member is being unhelpful and refusing to tell me how they can achieve this.

Personally I suspect that it is them either being difficult or else just that they never log out so when they visit the site the stored cookie allows them to access the website again but the challenge is can anyone here read the forum without logging in and if so how?

Cheers

Carol

[KynloStephen66515]

Thats what I see on the forum page.

[KynloStephen66515]

Side note...I think I just broke your disclaimer (No part of this website can be reproduced in any form without written permission)

[Carol Haynes]

Precisely - BUT this difficult member is saying that simply by browsing the website she can read the forum without logging in - I can't see how this is possible. AS far as I can tell no articles on the website link directly to forum articles and even if they did they should lead to a login page before being able to read the posting.

Side note...I think I just broke your disclaimer (No part of this website can be reproduced in any form without written permission)

-Stephen66515 (May 21, 2012, 05:06 PM)

May be that should be 'may be reproduced' ! Anyway I give you permission ;-)

By the way if any one does find a security whole please let me know by PM - not on the open forum here.

[KynloStephen66515]

Precisely - BUT this difficult member is saying that simply by browsing the website she can read the forum without logging in - I can't see how this is possible. AS far as I can tell no articles on the website link directly to forum articles and even if they did they should lead to a login page before being able to read the posting.

Side note...I think I just broke your disclaimer (No part of this website can be reproduced in any form without written permission)

-Stephen66515 (May 21, 2012, 05:06 PM)

May be that should be 'may be reproduced' ! Anyway I give you permission ;-)

By the way if any one does find a security whole please let me know by PM - not on the open forum here.

-Carol Haynes (May 21, 2012, 05:06 PM)

The member is probably just being stupid and not realized they are actually logged in lol

[rgdot]

See the same as Stephen.

Only thing I can think of is masking or identifying as googlebot, but I don't believe many users know how and it won't work in many cases anyway.

[wraith808]

Try

Code: Text [Select]

1. http://webcache.googleusercontent.com/search?sourceid=chrome&ie=UTF-8&q=cache%3Awww.swaledaleroadrunners.co.uk%2Fforum

with the actual link to a page in place of the

Code: Text [Select]

1. www.swaledaleroadrunners.co.uk%2Fforum

.  

I doubt that it will work, but it sometimes does.

[Carol Haynes]

Yes I wondered about caching but the forum pages aren't in the site map and are set not to index by google etc. As far as I can tell they are not cached (looking at the google webadmin index) and certainly if I look for a cached copy of a specific forum thread it comes up as not indexed by google.

I don't think the member would be able to craft that sort of URL anyway - they said it was just from browsing on the website.

[x16wda]

Well, if you can disable your user's site account, then that shouldn't interrupt access from what the user said, right?

[Carol Haynes]

Well, if you can disable your user's site account, then that shouldn't interrupt access from what the user said, right?

-x16wda (May 21, 2012, 06:17 PM)

That was precisely my thought - unfortunately I only set up the site, I am not a club member myself so I can't really make that decision.

[hamradio]

I cant find a way in my brief tests either however I did notice the website designed by link doesn't lead to Dales Computer Service...don't know if that is by design or if you forgot to change it.

[Carol Haynes]

Thanks hamradio - someone must have edited the link though I can't think why! (They largely manage their own content)