As designed Rejected user can use contact us even though permission is set to never

[Kirby]

Affected version

2.1.10

We've got a spam user that was rejected but still does spam contact us, so we've set the permission to never.
Analyze permissions does show that the user can't use contact us, but in fact this is still possible.

 

[Chris D]

Are they banned or rejected? Or are they banned and rejected?

Unban them and I think that might stop the situation you're seeing.

 

[Kirby]

The user is only rejected. If the user is banned (no matter if he is rejected or valid) the permission does work.
This also happens when the user has any other state except Valid.

 

[Chris D]

Right, fair enough, I read the code backwards.

The failure here is that when the permissions for this user are checked, e.g.

$this->hasPermission('general', 'useContactForm')

Their permissions are checked against the "Unregistered / Unconfirmed" group as is standard when a user's account is no longer valid. User permissions are unable to override this.

Clearly the workaround for now is to ban the user (or set Unregistered / unconfirmed permissions to no), but we'll consider if changes need to be made in this particular case.

 

[Kirby]

Setting Contact us permissions to no for Unregistered unfortunately is not an option as we do want guests and all non-valid users to be able to use Contact us unless the permission is explcitly set to No or Never for spefific users.

 

[robdog]

So the rejected user can simply log out and use the contact form anyways?

 

[Kirby]

Yeah, that's unavoidable - but luckily those spammers (most likely semi-automated software) are not that clever.

 

[djbaxter]

Ban his IP. And then ban his IP for the contact form.

Not sure if that second ban requires this add-on:

[OzzModz] Contact Us Spaminator

There is a 10% tax added to our products. We do not offer invoices, you need to use your PayPal Receipt for your accounting or VAT needs. Tax will be added at checkout. Sick and tired of your inbox getting flooded with spam coming from the...

xenforo.com

 

[Mike]

So we have just made a tweak here, though in terms of what's being reported, I think we'd consider it as designed: we want users with different account issues/statuses to potentially be able to use the contact system (such as in the case of an incorrect rejection).

However, as a mitigation, we're now forcing CAPTCHA verification on the contact form if the account status is not valid. This should avoid the ability to completely automate spam on the contact form after you're logged in.

 

[Kirby]

So we have just made a tweak here, though in terms of what's being reported, I think we'd consider it as designed: we want users with different account issues/statuses to potentially be able to use the contact system (such as in the case of an incorrect rejection).

I strongly disagree here. If a permission is set to never for a specific user (not a usergroup), that permission really should determine what the user cannot do.

I've therefore posted a suggestion to change this behaviour:

Lack of interest - Permission set to never for a specific user should force the user to never have that permission

Follow-up to https://xenforo.com/community/threads/rejected-user-can-use-contact-us-even-though-permission-is-set-to-never.180946/post-1458678 If a permission (like Can use contact us) is set to never for a specific user, that user should never be able to have that permission, no matter which...

xenforo.com

At least Analyze permissions should show the correct results.