Admin link shows to unregistered guests, and other inappropriate usergroups.

[Lucutious]

Link to my site: http://www.eq2-harmsway.org/beta
SMF version: 1.1.5
TP version: 1.0.5 beta
Theme name and version: Fs Gray (1.1)
Mods installed:

• Are You Human? Anti-Bot Registration Check 1.3
• SMFbuy 1.4
• TinyPortal 1.052
• Hide SMF Version 1.0.2
• Reason For Editing Mod 1.14

Related Error messages: N/A

Greetings!

I am not entirely sure that the TP forums are the best place for this issue, but I am hopeful that if they are not I can be pointed to the place it is appropriate.  This may in fact be a TP or theme issue, but it might be a SMF thing.  I apologize if this is the wrong place.

Problem: Guests, and some usergroups with limited permissions can see an "admin" link at the top of the forums.  Obviously, they should not see this link.  Clicking on it does nothing, so they can't do anything - but the link is still there.  I would like to fix it so it does not show to usergroups that have no business in the admin panel.

(As a side note, I also have another button, DKP, that I would like to be hidden from certain usergroups, so I'm hoping that by learning how to do 1, I can learn how to do the other.)

Thank you for your time,

[G6Cad]

It is as you same more an SMF support question, but also a theme question as the links in the menu are generated in the theme.

If you look in your default theme, you see how the admin button are coded, there are one line of code there that checks whether your admin or some other member group. If that code is missing from your templates index.template.php, everyone will see the admin button.

Hope this help you 

[Lucutious]

G6,

It appears that my index.template.php has the code you specify, here is my menu section of the index.template.php.  Can you spot the error? My eyes are cross-eyed from looking at this, I can't seem to get it.

Code Select Expand

// Show the menu up top. Something like [home] [help] [profile] [logout]...
function template_menu()
{
   global $context, $settings, $options, $scripturl, $txt;

   // Work out where we currently are.
   $current_action = 'home';
   if (in_array($context['current_action'], array('admin', 'ban', 'boardrecount', 'cleanperms', 'detailedversion', 'dumpdb', 'featuresettings', 'featuresettings2', 'findmember', 'maintain', 'manageattachments', 'manageboards', 'managecalendar', 'managesearch', 'membergroups', 'modlog', 'news', 'optimizetables', 'packageget', 'packages', 'permissions', 'pgdownload', 'postsettings', 'regcenter', 'repairboards', 'reports', 'serversettings', 'serversettings2', 'smileys', 'viewErrorLog', 'viewmembers')))
      $current_action = 'admin';
   if (in_array($context['current_action'], array('forum', 'search', 'admin', 'calendar', 'profile', 'mlist', 'register', 'login', 'help', 'pm')))
      $current_action = $context['current_action'];
   if ($context['current_action'] == 'search2')
      $current_action = 'search';

   if ($context['current_action'] == 'theme')
      $current_action = isset($_REQUEST['sa']) && $_REQUEST['sa'] == 'pick' ? 'profile' : 'admin';

   // Are we using right-to-left orientation?
   if ($context['right_to_left'])
   {
      $first = 'last';
      $last = 'first';
   }
   else
   {
      $first = 'first';
      $last = 'last';
   }
   // Show the start of the tab section.
   echo '
        <ul>';
   
   // Show the [home] button.
   echo '<li', $current_action == 'home' ? ' id="active"' : '', '><a href="', $scripturl, '">' , $txt[103] , '</a></li>';

   // Show the [forum] button.
   echo '<li', $current_action == 'forum' ? ' id="active"' : '', '><a href="', $scripturl, '?action=forum">' , "Forum" , '</a></li>';

   // Show the [help] button.
   echo '<li', $current_action == 'help' ? ' id="active"' : '', '><a href="', $scripturl, '?action=help">' , $txt[119] , '</a></li>';

   // How about the [search] button?
   if ($context['allow_search'])
   echo '<li', $current_action == 'search' ? ' id="active"' : '', '><a href="', $scripturl, '?action=search">' , $txt[182] , '</a></li>';

   // Is the user allowed to administrate at all? ([admin])
   if ($context['allow_admin'])
   echo '<li', $current_action == 'admin' ? ' id="active"' : '', '><a href="', $scripturl, '?action=admin">' , $txt[2] , '</a></li>';

   // Edit Profile... [profile]
   if ($context['allow_edit_profile'])
   echo '<li', $current_action == 'profile' ? ' id="active"' : '', '><a href="', $scripturl, '?action=profile">' , $txt[79] , '</a></li>';

   // Go to PM center... [pm]
   if ($context['user']['is_logged'] && $context['allow_pm'])
    echo '<li', $current_action == 'pm' ? ' id="active"' : '', '><a href="', $scripturl, '?action=pm">' , $txt['pm_short'] , ' ', $context['user']['unread_messages'] > 0 ? '[<strong>'. $context['user']['unread_messages'] . '</strong>]' : '' , '</a></li>';

   // The [calendar]!
   if ($context['allow_calendar'])
   echo '<li', $current_action == 'calendar' ? ' id="active"' : '', '><a href="', $scripturl, '?action=calendar">' , $txt['calendar24'] , '</a></li>';

   // Show the [dkp] button.
   echo '<li', $current_action == 'something' ? ' id="active"' : '', '><a href="http://dkp.eq2-harmsway.org">' , "DKP" , '</a></li>';

   // the [member] list button
   if ($context['allow_memberlist'])
   echo '<li', $current_action == 'mlist' ? ' id="active"' : '', '><a href="', $scripturl, '?action=mlist">' , $txt[331] , '</a></li>';

   // If the user is a guest, show [login] button.
   if ($context['user']['is_guest'])
   echo '<li', $current_action == 'login' ? ' id="active"' : '', '><a href="', $scripturl, '?action=login">' , $txt[34] , '</a></li>';

   // If the user is a guest, also show [register] button.
   if ($context['user']['is_guest'])
   echo '<li', $current_action == 'register' ? ' id="active"' : '', '><a href="', $scripturl, '?action=register">' , $txt[97] , '</a></li>';

   // Otherwise, they might want to [logout]...
   if ($context['user']['is_logged'])
   echo '<li', $current_action == 'logout' ? ' id="active"' : '', '><a href="', $scripturl, '?action=logout;sesc=', $context['session_id'], '">' , $txt[108] , '</a></li>';
   echo '
           </ul>';
}


[Lucutious]

I don't mean to be rude, so if "bumping" a post once is not allowed I apologize, I'm just hoping someone can lay eyes on this and see what's going on.  I figured out how to hide the DKP link, I just made it check for the calendar permission, as they are both granted for the same membergroups.

Admin link still shows to guests ><

[Lucutious]

I found the error, marking this as closed.

[IchBin]

So you mind sharing what the error was for others?

[Lucutious]

It was actually a TinyPortal feature that didn't fully integrate into the FS Grey theme.

I have my permissions set such that guests can't do anything.  They literally have 0 permissions.  In back-tracking, I found that the guest membergroup had 1 permission, so I went and looked, and nothing was checked.  Then it occured to me, maybe something didn't fransfer right.  I swapped myself to default theme, and sure as hell, "Can read TP news" was checked.

I think when I originally granted that permission I thought it was the frontpage news, or the banner news, I don't know.  I surely didn't think I was giving them any sort of administrative permissions.

Anyways, swapping to default showed the permission that was in error, I fixed that and the Admin link went away.

G6's comment also allowed me to take a re-think into something else that I had a problem with.  The DKP button was showing to everyone.  Since I didn't wany my DKP site to be published to the world, I decided to tie it in with the calendar permission.  I added the

Code Select Expand

if ($context['allow_calendar']) above the DKP button, and now both the calendar and the DKP button are shown to those that are allowed to see the calendar.  I'm sure it's a bit sloppy, and I'm sure there's a way to make a permission of it's own - but for my purposes, this works.

[IchBin]

Ah thanks for that. I'm going to do some testing on that. If I can replicate I'll add it to the bugtracker.