XF 2.0 I'm not sure if this is a security issue or an actual bug

[jeb35]

Somehow a guest has posted on our forum in Administrator chat when its hidden from everyone else. It is a spam post but just curious how the hell he was able to post this in a hidden staff chat area. Guest's shoudn't be able to post and when I'm logged out, I can't see any staff chat areas. I'll post screenshots below of his post and IP related stuff and also node permissions for Admin chat. Should I create a ticket as well?

 

[Paul B]

Are you sure an add-on isn't involved?

There is some text at the bottom of the post which is definitely not standard.

 

[jeb35]

If I edit his post that shows up at the bottom of it. So no add would be involved.

 

[sbj]

Are you sure it is not from an addon?

First look at it and it looks like you are running an addon for the "Contact Us", which posts automatically a thread in a designated area you have chosen in ACP. But I could be wrong.

 

[jeb35]

Are you sure it is not from an addon?

First look at it and it looks like you are running an addon for the "Contact Us", which posts automatically a thread in a designated area you have chosen in ACP. But I could be wrong.

Oh crap, my bad. We do have that addon installed. And I just checked email for the forum and 2 emails from that person just came through This can be disregarded. Sorry.