XF 2.1 Users banned by warning system get Moderator banner

[djbaxter]

This has now happened twice so I am able to confirm it was not user error:

Members banned by accumulating points under the warning system do get banned but in the process they acquire a "Moderator" banner under their name.

They do not actually have any moderating powers but the fact that the banner appears is confusing to moderators as well as members.

 

[Liam W]

Out of curiosity, do you have anything set for the ‘Add usergroup on ban’ option? (It’s in the User discouragement and discipline category).

 

[djbaxter]

No. That option is just set to None. I haven't even used discouragement yet.

 

[Chris D]

That option isn't anything to do with discouragement itself. It's just all banning/warning/discipline options are all in the same group.

We'll need some specific reproduction steps here, assuming you can reproduce it easily, perhaps by banning a test user. Once it has been reproduced we'd need to see things like what their actual custom title is set to, which members the user is a group of, the user title ladder configuration etc.

Certainly if it's not the "Add to usergroup on ban" option, then it could well be an add-on causing it. So if it is something you can reliably reproduce, trying to reproduce it with all add-ons disabled would be required.

 

[djbaxter]

All right - here's more information from a test user I set up:

1. I created the test user and 1 post from him.

2. Using his profile, I then gave him a temporary ban. This worked and he showed only as banned. No moderator banner.

3. I then created a series of additional posts and issue warning for those. Once the test user accumulated 10 points with those warning, the temporary ban kicked in and he was banned BUT he also now displayed the Moderator banner.

4. On checking that account, I could see that Moderator was now checked in his secondary groups. That was done by the automatic warning action.

5. Checking further, as far as I could tell he had no moderating abilities BUT due to the Moderator check in secondary groups he now had access to Moderator only threads, obviously a serious security and privacy issue.

I have now deleted the warning action until I can figure out a way to recreate it without this issue.

 

[Chris D]

Are you sure you don't have a warning action set like this?



Or a warning definition set like this?



There are only three places that would set the user group during a warning/ban and they are the option that @Liam W mentioned earlier, the warning definition configuration and the warning action configuration.

 

[djbaxter]

I just double checked all the individual warning definitions and none of them had any extra groups checked.

I had deleted the Warning Action entirely but it did not have any add to groups checked - the only thing for Action to take was Ban.

I have just created that again and double checked the action settings.

Then I again created a series of posts and issued warnings until the member reached 10 points. Again, the Moderator label appeared and checking the account I could see that Moderating was checked as a secondary user group.

 

[djbaxter]

Update: My apologies. I found one warning definition that for some reason assigned the Moderating secondary user group.

I will test this again with that corrected.

 

[djbaxter]

I can confirm that removing the erroneous secondary group from the single warning definition resolved the problem.

Note: The user did not have to receive that specific warning for the problem to occur, though. Just having it among the list of possible warnings was enough.