Incognito Bypassing The Perms System?

[kghector]

Quick Question.

On my forum, i have an area, where guests can access to submit a ban appeal, however in the perms, i have it so they can view the node, create a post, and post replies to their own post. I have it also set that they are unable to view content done by others.
https://gyazo.com/7bececfafc95bd5ac4b87fecf582b357?token=1a03a29ac3fd205152e391ddbf4611cf perms selected shown here.

You go to this forum and everything is blank as the perms has been set too.
https://gyazo.com/dfad3ce2c4687c296980a940622883e4


However if you copy the link, and open an incognito tab on google chrome, and paste the link. Every post by other users is viewable and they are able to click it and read what has been written in it.

Is this a breach in the perms system? OR am i doing something stupid?

 

[kghector]

Edit : i removed view thread content perm, and this resolved this issue. However its strange that when in a normal browser it was locked, but in incognito it got unlocked

 

[Freelancer]

If that's reproducable I think you found an exploit...

 

[Mike]

In incognito, you'd be a guest. I'm assuming that you didn't have the permissions set correctly for guests in that forum?

I've looked at the forum that I believe to be the one in question on your site (complaints, ban appeals...). I can see the forum, though not any threads within it, so I assume permissions may have been adjusted.

Alternatively, it could be something involving a permission cache update being triggered by you changing permissions. Generally, we've only seen add-ons interfere with that.

As I don't appear to be able to reproduce the issue now, it's hard to comment specifically. If you can setup a system to reproduce the issue, then we can get more details about your permissions to determine if it's expected.