XF 2.2 How can a GUEST be able to post a thread on my forum

[oneobgynmd]

Im baffled. Lately we have been hit on a daily basis by spammers from Uganda and Nigeria who post everything from black magic, voodoo, spells, porn and women with phone numbers. Fortunately 99% are rejected when they apply as a registered member. In our group permissions a GUEST has permission only 1. to see forum 2. to view nodes, 3. to see threads and 4. to see content of threads. EVERYTHING else in GUEST permissions is set to NEVER> Today a user who under their name showed "GUEST" was able to post 2 new threads in one of our Sub Forums . How is this possible

 

[MentaL]

Anonymous Posting

Jan 23, 2019

Protect User Privacy and Encourage Open Discussion with Anonymous Posting Add-On

• truonglv
• anonymous anonymous posting
• Add-ons [2.x]

Anything like this installed?

 

[oneobgynmd]

NO

 

[Seeker-Smith]

Check you node permissions.

 

[Suzanne O]

Make sure you untick the box that says allow guests to post in admincp/options/registration

 

[oneobgynmd]

Do I need to set ALL node permission re posting to never ? GUEST isnt even a Group. Just Unregistered/unconfirmed

 

[oneobgynmd]

Node permissions are all set to default

 

[Seeker-Smith]

Are you getting the spam in all nodes or a specific one? Go through your Unregistered / Unconfirmed user group permissions. You must have something set wrong.

 

[oneobgynmd]

I wish that were the case. It only happened this once. All node permissions are set to default. In the affected subforum I just checked NEVER for unregistered, unconfirmed . Does that make sense?

 

[Seeker-Smith]

Node permissions should generally be set to Inherit. User group setting are where you give permission or not to post.

 

[oneobgynmd]

thats exeactly what we had as I assumed that was the case.

 

[oneobgynmd]

everything was set to INHERIT . When this happened I clicked never for post permission but just reverted back to INHERIT where it was to start. All my node permissions are set to INHERIT

 

[Seeker-Smith]

So your spam either came from an account with posting privilege or you have the Unregistered / Unconfirmed setting wrong.

 

[oneobgynmd]

as stated in the OP Unregistered/unconfirmed are ALL set to NEVER except for 4 1.see forum. 2. see nodes, 3. see threads and 4. see thread content which are set to YES

 

[Old Nick]

What is his username?
Analyze his permission : /admin.php?permissions/analyze

 

[oneobgynmd]

initially those that are set to NEVER were ALL at NO but we found that BANNED users could still be seen as on the forum even though they were banned. Should I reset all to NO except for those 4 YES
I appreciate all of you help BTW

 

[oneobgynmd]

What is his username?
Analyze his permission : /admin.php?permissions/analyze

I tried but when I clicked on the name it was dead and not in our database
It had GUEST as member group under his name

 

[Seeker-Smith]

The spam then came from a registered user and not a guest.

 

[oneobgynmd]

The spam then came from a registered user and not a guest.

NO. There was no member in our database with that name

 

[Max Taxable]

had GUEST as member group under his name

What's his name?