"Complete Upgrade" link should be shown to admin/staff only

[unproperlypropagated]

Guests and registered users shouldn't see this link.
This should be visible only to Admin, or Staff.

 

[Chris D]

That is only shown in debug mode. You shouldn't be running debug mode in production, or if you are, it should be gated behind known admin IP addresses.

The simple solution is disabling debug mode.

Regardless of that, the link just takes you to e.g. https://xenforo.com/community/install/

The upgrade cannot be completed unless the user logs in as an administrator.

Ultimately, it literally doesn't matter if it's shown in debug, or not, or to guests, or not, because anyone who knows anything about XenForo could access that link anyway, but not be able to use it unless they are logged in.

 

[unproperlypropagated]

okay thanks! I didn't know debug was enabled.

 

[CedricV]

okay thanks! I didn't know debug was enabled.

This should've given it away.

 

[Digital Doctor]

An upgrade is pending. The forum is now in debug mode.

 

[unproperlypropagated]

I don't want users to see that message cos it doesn't concern them.
If the upgrade enables debug mode.
And the message is shown only in debug mode to all users.
My suggestion is valid, don't show it to non staff members cos it's not for them.-

 

[Chris D]

The upgrade doesn’t enable debug mode. You will have done that. There’s nothing in the software that would enable it. It’s edited in src/config.php

 

[Digital Doctor]

Debug Mode

Config.php options | Manual | XenForo

End-user documentation for XenForo

xenforo.com

 

[unproperlypropagated]

The upgrade doesn’t enable debug mode. You will have done that. There’s nothing in the software that would enable it. It’s edited in src/config.php

Ok, but what about debug mode being enabled makes the message relevant to non staff?
I don't understand this logic at all: "debug mode is ON therefore this message has to be shown to everyone".

why?

 

[Chris D]

Debug mode indicates the site is not a production site so you’re unlikely to have non staff seeing it.

To prevent non staff seeing it, either disable debug mode or only enable debug mode for specific IP addresses.