phpBB • Free and Open Source Forum Software

Here's what I did:

1. Go to memberlist.php
2. Click 'Find a member'
3. Select any group from the Groups dropdown and hit submit. The first time you hit Search, the form is posted and the location in the address bar doesn't change. Hit Search again. The search parameters are sent via a GET request.
4. Modify the location in the address bar, specifically the number after search_group_id= to view the members of any group, even hidden groups that you are not a part of.

Sure, it doesn't show the group name, but that doesn't mean anything. Several inferences can be made based on who are members of what group. For example, we are playing the werewolf game on my forum and using this hack, people can figure out who the wolves and vampires are.

Issue does indeed exist, potential patch against trunk attached.

Code: Select all: Index: memberlist.php =================================================================== --- memberlist.php (revision 8425) +++ memberlist.php (working copy) @@ -1238,6 +1238,8 @@ $group_selected = request_var('search_group_id', 0); $s_group_select = '<option value="0"' . ((!$group_selected) ? ' selected="selected"' : '') . '> </option>'; + $group_ids = array(); + if ($auth->acl_gets('a_group', 'a_groupadd', 'a_groupdel')) { $sql = 'SELECT group_id, group_name, group_type @@ -1261,10 +1263,16 @@ while ($row = $db->sql_fetchrow($result)) { + $group_ids[] = $row['group_id']; $s_group_select .= '<option value="' . $row['group_id'] . '"' . (($group_selected == $row['group_id']) ? ' selected="selected"' : '') . '>' . (($row['group_type'] == GROUP_SPECIAL) ? $user->lang['G_' . $row['group_name']] : $row['group_name']) . '</option>'; } $db->sql_freeresult($result); + if ($group_selected !== 0 && !in_array($group_selected, $group_ids)) + { + trigger_error('NO_GROUP'); + } + $template->assign_vars(array( 'USERNAME' => $username, 'EMAIL' => $email,