Bug Inline Moderation Authentication loop

[Jeniczek]

Deleting post via dropdown inline moderation menu with "Inline Moderation Authentication" active causing verification loop.

How to reproduce:
1] AdminCP -> Settings -> Option -> General Settings -> Enable "Enable Inline Moderation Authentication"
2] Create thread as user AAA and post one additional reply
3] Assign user BBB as thread administrator of the thread created in step above
4] Log on as user BBB, go to the thread and tick the checkbox in right-top corner of the second post (first reply) to select it for moderation
5] At the bottom-right, click on "Moderation Tools", choose "Delete posts" and "Submit"
6] Fill the reason for deletion and click "Delete Posts"
7] System will ask for enter the password (=Inline Mod Auth), so enter the password and click "Log In"
8] A redirect message showing "Redirecting... Thank you for logging in, <username>." after which the post supposed to be deleted, but...
9] ... Inline mod auth. page prompting to re-enter the password will appear again. Post is not deleted.

Note: Post can be deleted by Editing the post and then clicking on "Delete" without problems (there is no InLine re-auth process)


We don't have this mod installed on production yet, but in case of need i can prepare some (limited) admin access to our test environment.

Thank you in advance.

 

[Mokonzi]

If you can provide access that would be great. I'll try and reproduce this on my own dev install in the meantime

 

[Mokonzi]

Can I just check a couple of things. Are you giving the user full permissions a thread (i.e. checking every box in the permissions)?

I've gone through these steps locally on my dev machine and I've got no issues. I sign in once for the password and it soft deletes correctly.

 

[Jeniczek]

Nope, i only checked "Edit Posts", "Delete Posts" and "Moderate Posts". Anyway i just tried to check all boxes and the situation still persists.
I disabled all plugins except this Threadadmins to avoid conflicts.
Also created a new clean (unmodified) template to avoid some mess in customized templates.
And i thought that it could be some cookie mishmash so i tried to logon via another "clean" browser but still no luck :/

This "loop" is happening only for normal user with Thread-admin granted. There is no issue with admin/mod accounts.

Let me know what kind of access do you need.

 

[Mokonzi]

I've asked Fillip H. for some ideas on what might be the cause of this for you.

 

[Jeniczek]

Thanks!

FYI: I just finished with update of our live forum. I'll refresh test forum and install the mod tomorrow and after some clean up i'll give you also admin rights. In the meanwhile i'll try to somehow replicate the behavior on my local installation.

 

[Jeniczek]

I can now confirm that the bug is present also on untouched-fresh vBulletin 4.2.2. PL1 installation.

This is exactly what i did:
1] Installed vBulletin 4.2.2. PL1 , everything as default except the admincp and modcp directories have different names (specified in config.php) and database is using utf8 charset (enabled in config via $config['Mysqli']['charset'] = 'utf8'; )
2] Created user "moderator" and assigned him "Moderators" as an primary user group
3] Created user "tester" (Registered user as primary group)
4] Logged as user "moderator" and created new topic with two replies.
5] Installed "Threadmins and Group Moderators v2.0.9pl1"
6] As administrator i granted "Edit Post" and "Delete Post" to user "tester" via "DBTech - Threadmins" -> "Thread Admins" for the thread created in step 4.
7] Logged as user "tester", checked the latest post in the thread and then chose "Moderation Tools -> Delete Posts -> Proceed" and confirmed via "Delete Posts" button
8] Re-entered password and clicked "Log In"
9] "Thank you for logging in, test." appeared
10] Inline mod auth appeared asking again for password.

No template edits, no another configuration settings nor usegroup/forum permissions altered.

I hope this will help.


EDIT: I just installed vBulletin 4.2.0 PL4 on my local (Apache 2.4.4, PHP 5.4.14) and performed the steps above. Unfortunately the problem is same :/

 

[Mokonzi]

Very strange. Not sure at all what's causing this issue. I'll chat with Fillip H. again about it and see if we can figure out why.

PS, do you have different modcp/admincp directories on your main site as well?

 

[Jeniczek]

Yes, different modcp/admincp dirs are also on main site. Anyway when i was testing it on local i also tried to remove directories back to default values (and changes the definition in config file) and no change -> same issue :/

Let me know in case of more details/info needed, i will answer as soon as possible

Yea, and thank you again!

 

[Jeniczek]

Hi again,

any update regarding the issue please?

 

[Mokonzi]

Not yet, but the busy past few weeks haven't given me the time to look any further. I'll take another look and get back to you.

 

[Jeniczek]

Guys thanks for fixing this on the test site! Awaiting official update :]