Guest users role issues

[John Robi]

Hello,

I am the fourth administrator of the forum since its launch in 2008. I have noticed more and more when I sign in there are some quantity of Guests users on line.

The way our forum should run, Guests should have no access to view the forum until signed in or registered. I looked into the Guest’s on line and found something odd, (see Guest Online Shot below). Looking at the information presented for online Guests indicates users are accessing: viewing User Control Panel; Index Page; viewing member profile; or who is online. On the screen, the text for the above is in blue so they are links. I clicked on the link, viewing User Control Panel, and the Board Index screen appeared showing all the forums and their category's. This shouldn't be allowed.

I then looked at Group forum permissions. And, selected "look up user group: Guest". Then selected a forum to view and found Guest Forum permissions role is No Access, (see Guest Role Shot below). I then looked at Advance Permissions, (see Advance Permissions Shot below). Advance Permissions shows, No, to all actions which is how it should be.

Further, it looks like Guest User permissions is assigned to Newly Registered User Features, (see Guest User Permissions Shot below). And, Advanced permissions shows, No, to all items, (see Guest User Permissions; Advance Permissions Shot below).

I don’t know why phpBB3 is reporting Guests are viewing pages of the forum as found in the screen shot; Guest Online Shot below.

I have read through the user guide but, have not found any place referring to this issue.

Any thought on this will be very welcomed.

Yours,
John

Guest Online Shot:

Guest Role Shot:

Guest Forum Permissions Shot:

Advance Permissions Shot:

Guest User Permissions:

Guest User Permissions; Advance Permissions Shot:

[KevC]

This used to be in the FAQ but I think it's been taken out. They are not actually seeing those pages. They're seeing a screen saying they don't have permission to view it.

It's easy for you to test.
Open another browser, copy the URL for something like a profile or the memberlist, and then paste it in to the other browser and you'll see what they see and you'll see your IP linked to that action in 'who is online' to show that it's you.

[KevC]

Ah found it in the /docs folder
docs/FAQ.html#viewonline

[John Robi]

Hello KevC,

Open another browser, copy the URL for something like a profile or the memberlist

I read your first reply though I got lost on the copy the URL part. I looked at a profile but could not identify anything like a URL. Then looked at the member list and the only thing I see is the email address, no URL. Would you please expound a little more on finding/identifying the URL part.

In your second reply, using the link, I found this information:

Quote,"The session information tells us who this user is. Therefore in order to determine what a user can do on a page we first need the session details."

Question, how do I find the session detail? And, would there be a session detail for a guest?

Thank you so much,
John

[KevC]

The URL in the browser address bar.

memberlist.php
or
memberlist.php?mode=viewprofile&u=1912496

I'm not a coder but I think the session information is all in the database. Bottom line is it's not worth the trouble to find it all out. Just see if you can do what I said with the URL and it'll show you that they are not seeing what you think they are.

[John Robi]

Hello KevC,

I followed your recommendation about accessing member URL though that resulted in information about members. Did I miss something? My concern is about guests, specifically those users arriving at the forum who are not registered members.

On a different laptop, to act as a guest, I did enter URL with the domain plus ending in /phpbb3/index.php and /phpbb3/viewonline.php. The response was, Must be logged in to view ... At the same time using my first laptop logged in as an administrator I was able to see a new guest arrive and accessing the index.com. The IP of the new guest was that of my other laptop.

So, all is good I think. What I find disturbing is the length of time and the number of guests arriving on line trying to access different areas of the forum.

Thank you for your assistance,
John

[Mick]

Normally you’d have the guests group forum permissions set to one of two things, no access where the guest can’t see anything other than the log in page or read only where the guest can see the board but can’t post.

[KevC]

On a different laptop, to act as a guest, I did enter URL with the domain plus ending in /phpbb3/index.php and /phpbb3/viewonline.php. The response was, Must be logged in to view ... At the same time using my first laptop logged in as an administrator I was able to see a new guest arrive and accessing the index.com. The IP of the new guest was that of my other laptop.

Yes that's all exactly correct. That is what all your visiting guests are seeing.

What I find disturbing is the length of time and the number of guests arriving on line trying to access different areas of the forum.

That's perfectly normal and it's been like that for years. You have numerous search/indexing bots that will appear as guests, you will have spambots looking for sites they can sign up to, you'll have real users before they click 'login' and new people just looking for that subject.

[John Robi]

Hello all,

Thank you for your valued assistance.

KevC, I feel more comfortable after reading your last reply. Although I have many Bots listed in the database, as you pointed out there are many search robots looking to index websites. I so kindly thank you.

In gratitude,
John