Question [Merged topic] RSS Feed for Registered Users?

Guys guys, come down.

The proposed feature of including non-public forums content in the RSS feed will be in Kunena 1.6.


You dont see it yet in the developers version yet, but thats only because it is awaiting review by the lead developers. But dont worry, it will come soon enough

Here is a screenshot of the rss features in the 1.6:

Kelco83 wrote:

Well, just looking at the feed the forum provides in comparison to Joomla's something is off. Maybe its a bug.

Can I ask you a question? What if you restrict a Joomla article on your website, so that it can only be seen by registered users? Can anyone discover the existence, or the contents, of that article via the Joomla RSS feed?

We are about to merge the RSS code into the K1.6 branch.

Both Matias and I are not yet convinced that anything but public messages can go into RSS.
In fact we both oppose it. The main reason for it being that it would be the biggest security back door into any site.

There are no controls of who gets to see what. Any private and moderator only messages would be seen by the entire web.
Just because you hide the RSS link on a password controlled page, does not mean anything.

You only need to copy that link to e.g. feed-burner and the rest of the world is made aware of the content.

So far I have not seen any way that could make RSS secure for non public messages. As long as that cannot be done (it might never be) we will not allow such a feature to go into the main line of the code.

Thanks for all the responses.

I can see both side of the discussion and understand that RSS in itself is not secure.

For my own use it was a desire to keep the feed going whilst and not be easily accessible to a casual visitor.

If the forum itself is not visible then the RSS link wouldn't be either so the only way to get access to it is to get the link from someone else or guess the link. I guess that if you were familiar to kunena the you could guess it.

Another thought is to be able to have the option to have the RSS feed visible to be set by the administrator. So that I could turn on or off the feature myself.

In your example, it would be very easy for a user to log in, grab the link and put it into a feedreader.
Simple as that. No guessing needed.

The visibility of the link is simply not enough.

I agree with fxstein on that part, but besides that, the way a forum works, should be up to that administrator.
The contribution (screenshot) mentioned earlier, gives the administrator great power - allowing him to choose.

I can easily see an example, where write access is for registrered people, but content is viewable by public. That would not be possible to support RSS wise, without an administrative setting.

But of course, the setting should never be "on" as default. THAT would be a security issue.

Well the feed works now. I'm not sure what fixed it, as I only changed security settings in htaccess.

edit: removed for redundancy.

[strike]I also just checked, and it doesn't appear that the links from the RSS feed mention itself but only the forum post urls.[/strike]

Yeah each referring link mentions the RSS feed itself instead of the originating post. Bummer to some ppl. But the reader is not picking up posts from my registration required categories. Works great for me.

Theres no way to tie the generation of content to the RSS feed based on the access rights on the user?

Even if there was, how would you express the dynamic variable rss url in joomla's static rss reader url setting?

Would I have to make x number of rss reading modules in joomla each with their corresponding security group?

Is there any possibility of getting feeds from those forums only accesible for special users (backend users)?

No.

The reason being: RSS feeds are public - there is no authentication.

That means anybody that gets the rss feed url will be able to read it. Therefore only public boards can be part of the RSS feed or security would be broken.

Oops! Sorry for not finding this topic.

I understand your concerns about security, but I asked because in SMF it is possible. I think they achieve it using cookies.

Anyway, thanks for your answer .