Newly registered user post appeared without moderator approval. How could this happen?

Get help with installation and running phpBB 3.2.x here. Please do not post bug reports, feature requests, or extension related questions here.
Post Reply
User avatar
P_I
Registered User
Posts: 1063
Joined: Tue Mar 01, 2011 8:35 pm
Location: Calgary
Contact:

Newly registered user post appeared without moderator approval. How could this happen?

Post by P_I »

We're running phpBB 3.2.9 and we've just encountered something strange with a newly registered user. They've bypassed the moderation queue and their first post became visible without approval. To the best of our knowledge this has only happen this one time.

Before and after this user registered, first posts have required moderator approval. What is strange for this specific case is there is some evidence that phpBB still thinks approval is necessary.

Some details. When viewing one of our forum listings, on the topic this newly registered user has posted, the ? icon appears and if I hover over it I get the tooltip "At least one post in this topic has not been approved". When reading the topic, the member's post does not show the expected Approval/Disapproval buttons.

Looking over the posts and the MCP, I don't see anything awaiting approval. In the Moderator logs there is no indication that this members post was approved or disapproved. Strangely, a subsequent poster the next day has quoted this post, so we know it is visible to the membership.

Our User Registration Settings:
User Registration settings.JPG
Forum Roles:
Newly Registered Users forum roles.JPG
Has anyone else ever seen this happen?

Since phpBB still thinks a post needs approval, but nothing appears in the Moderation Queue for either Topics awaiting approval or Posts awaiting approval, is there somewhere else in ACP or MCP or the database that I can check to determine a) why does phpBB still think a post needs approval and b) how moderator approval has been bypassed?

ADDED: Peeking in the database, in particular the phpbb_posts table might provide some insight, but unfortunately the structure shown in Table.phpbb posts - phpBB Development Wiki doesn't match our board. Is the post_delete_user field overloaded and would it show a moderator's ID if they approved it? If so, what field would indicate whether it was deleted/approved/disapproved?
Normal people… believe that if it ain’t broke, don’t fix it. Engineers believe that if it ain’t broke, it doesn’t have enough features yet. – Scott Adams

User avatar
KevC
Support Team Member
Support Team Member
Posts: 69703
Joined: Fri Jun 04, 2004 10:44 am
Location: Oxford, UK
Contact:

Re: Newly registered user post appeared without moderator approval. How could this happen?

Post by KevC »

It's more likely something isn't set up correctly as you expected.

Why not make a new account yourself and see if you can post in that forum.

Have any of the NRU group criteria changed since the person registered?
Have you checked the permission masks on that forum for someone else in the NRU group?
-:|:- Support Request Template -:|:-
Image
Cheap UK Hosting
"In the land of the blind the little green bloke with no pupils is king - init!"

User avatar
warmweer
Jr. Extension Validator
Posts: 4235
Joined: Fri Jul 04, 2003 6:34 am
Location: Van Allen Bel ... gium

Re: Newly registered user post appeared without moderator approval. How could this happen?

Post by warmweer »

P_I wrote:
Sun Feb 09, 2020 11:42 pm
Image
What you're showing in the role definition.
That doesn't imply that every member of the newly registered group effectively gets that permission set, perhaps another role was assigned.
As KevC said, the permission mask for that user (and also the New Registered group) for that particular forum could provide clarification.
We should embrace problems, without which there wouldn't be any solutions.

User avatar
P_I
Registered User
Posts: 1063
Joined: Tue Mar 01, 2011 8:35 pm
Location: Calgary
Contact:

Re: Newly registered user post appeared without moderator approval. How could this happen?

Post by P_I »

We are pretty sure everything is set correctly as the forum dates from 2005.

To the best of the knowledge of the moderators and admins, we've never seen this before.
KevC wrote:
Mon Feb 10, 2020 9:04 am
Have any of the NRU group criteria changed since the person registered?
Have you checked the permission masks on that forum for someone else in the NRU group?
We had thought of that. The last change made was updating to phpBB 3.2.9 (mentioned here).

Permissions mark check shows "Trace result = Never" as expected.

We've gone back and checked any new members who joined since January, 2020 and every other one has had to be approved and the moderator logs show the approval log entry.
P_I wrote:
Sun Feb 09, 2020 11:42 pm

ADDED: Peeking in the database, in particular the phpbb_posts table might provide some insight, but unfortunately the structure shown in Table.phpbb posts - phpBB Development Wiki doesn't match our board. Is the post_delete_user field overloaded and would it show a moderator's ID if they approved it? If so, what field would indicate whether it was deleted/approved/disapproved?
If I'm guessing right, for the specific post in question, the phpbb_posts entry has post_delete_user = 'one of our moderators user ID' and the post_delete_time contains a value around when the moderator was active doing other work. Since these fields aren't documented in the Development Wiki, I'm guessing their usage is overloaded and the values we are seeing would indicate that the moderator approved the message. The phpbb_topics table for the topic in question shows topic_posts_unapproved = 1, which I'm guessing is why we are seeing
P_I wrote:
Sun Feb 09, 2020 11:42 pm
When viewing one of our forum listings, on the topic this newly registered user has posted, the ? icon appears and if I hover over it I get the tooltip "At least one post in this topic has not been approved". When reading the topic, the member's post does not show the expected Approval/Disapproval buttons.
There is no mention of the approval in the phpbb_log table.

In discussion with the moderator in question we're close to concluding that the post was actually approved (it happened about 3 days ago) but something internally must have silently errored and all the database updates associated with the approval didn't happen, evidenced by the fact the phpBB is suggesting "At least one post in this topic has not been approved". The server error_log doesn't show anything.
Normal people… believe that if it ain’t broke, don’t fix it. Engineers believe that if it ain’t broke, it doesn’t have enough features yet. – Scott Adams

User avatar
KevC
Support Team Member
Support Team Member
Posts: 69703
Joined: Fri Jun 04, 2004 10:44 am
Location: Oxford, UK
Contact:

Re: Newly registered user post appeared without moderator approval. How could this happen?

Post by KevC »

Essentially there's no way to 'bypass' the permission.
If you make a new account to test it and you can't post, then neither could they in the same circumstances.
-:|:- Support Request Template -:|:-
Image
Cheap UK Hosting
"In the land of the blind the little green bloke with no pupils is king - init!"

User avatar
P_I
Registered User
Posts: 1063
Joined: Tue Mar 01, 2011 8:35 pm
Location: Calgary
Contact:

Re: Newly registered user post appeared without moderator approval. How could this happen?

Post by P_I »

KevC wrote:
Mon Feb 10, 2020 1:13 pm
Essentially there's no way to 'bypass' the permission.
If you make a new account to test it and you can't post, then neither could they in the same circumstances.
Based on what we're seeing in the database, we've come to believe that a moderator did review and likely approve the post. The topic title might need an update and I'll change it if/when we solve this.

Based on what we think the database is showing us, we are now thinking the problem is inconsistencies in the database when the post was approved. Something didn't work as it should have and has left an inconsistency.

For an unapproved post, what values should be in the phpbb.post_visibility, phpbb_posts.post_delete_time and phpbb_posts.post_delete_user? What should the values change to when a moderator approves the post? What other tables/fields get updated?

Based on my layman's checking of the database and previous approved posts on our board this is what I think also should happen when a post is approved. When a post is approved, phpbb_topics.topic_posts_unapproved should be decremented and phpbb.topic_posts_approved should be incremented and should match the number of posts on the topic. Correct? There should also be a corresponding entry into the phpbb_log table correct?

In our case, those things haven't happened. So we're seeing an empty Moderation queue (expected) but an inconsistent message that a post needs approval, and no approval message in the Moderation log.

During our debug testing, we have found one case how moderator approval can be bypassed. If the moderator soft-deletes the post awaiting approval, then restores the post, the post becomes approved. The moderator log shows the soft-delete and restore, but no approval. That's not the case here.
Normal people… believe that if it ain’t broke, don’t fix it. Engineers believe that if it ain’t broke, it doesn’t have enough features yet. – Scott Adams

Post Reply

Return to “[3.2.x] Support Forum”