Solved Users can delete all topics??!!

One of the users of my new K2.0.1 forum just pointed out to me that a regular user can check the boxes beside all topics in a category and then use the drop-down to delete them! Is this a bug? I looked at this thread www.kunena.org/forum/K-2-0-Support/12426...lete-their-own-posts but it didn't really answer the question.

Here is a screenshot of what a regular user sees:




This seems to be a serious error, and I don't know what to do about it. Attached is my config report.

Database collation check: The collation of your table fields are correct

Legacy mode: Disabled | Joomla! SEF: Enabled | Joomla! SEF rewrite: Disabled | FTP layer: Disabled |

This message contains confidential information

htaccess: Exists | PHP environment: Max execution time: 300 seconds | Max execution memory: 512M | Max file upload: 128M

Kunena menu details:

Warning: Spoiler!

ID	Name	Menutype	Link	Path
150	Forum	mainmenu	Itemid=141	kunena-2012-07-16
141	Forum	mainmenu	view=home&defaultmenu=142	kunena
142	Index	mainmenu	view=category&layout=list&catid=0	kunena/index
143	Recent Threads	mainmenu	view=topics&mode=replies	kunena/recent
144	Create New Thread	mainmenu	view=topic&layout=create&catid=	kunena/newtopic
145	Unanswered Threads	mainmenu	view=topics&mode=noreplies	kunena/noreplies
146	My Threads	mainmenu	view=topics&layout=user&mode=default	kunena/mylatest
148	Forum Help	mainmenu	view=misc	kunena/help
149	Forum Search	mainmenu	view=search	kunena/search
147	Profile	mainmenu	view=user	profile

Joomla default template details : redevopurplehaze | author: Red Evolution | version: 1.0.2 | creationdate: 13/06/11

Kunena default template details : Blue Eagle 2.0 | author: Kunena Team | version: 2.0.1 | creationdate: 2012-07-07

Kunena version detailed: Kunena 2.0.1 | 2012-07-07 [ Balozi ]
| Kunena detailed configuration:

Warning: Spoiler!

Kunena config settings:
board_offline	0
enablerss	1
threads_per_page	20
messages_per_page	20
messages_per_page_search	20
showhistory	1
historylimit	10
shownew	1
disemoticons	0
template	blue_eagle
showannouncement	1
avataroncat	0
catimagepath	category_images
showchildcaticon	1
rtewidth	450
rteheight	300
enableforumjump	1
reportmsg	1
username	1
askemail	0
showemail	0
showuserstats	1
showkarma	0
useredit	1
useredittime	0
useredittimegrace	600
editmarkup	1
allowsubscriptions	1
subscriptionschecked	0
allowfavorites	1
maxsubject	50
maxsig	1000
regonly	1
changename	0
pubwrite	0
floodprotection	0
mailmod	1
mailadmin	-1
captcha	0
mailfull	1
allowavatarupload	1
allowavatargallery	1
avatarquality	75
avatarsize	1024
imageheight	800
imagewidth	600
imagesize	1024
filetypes	txt,rtf,pdf,zip,rar,iff,doc,css
filesize	2048
showranking	1
rankimages	1
userlist_rows	30
userlist_online	1
userlist_avatar	1
userlist_name	0
userlist_posts	1
userlist_karma	0
userlist_email	0
userlist_usertype	0
userlist_joindate	0
userlist_lastvisitdate	0
userlist_userhits	0
latestcategory	0
showstats	1
showwhoisonline	1
showgenstats	1
showpopuserstats	1
popusercount	5
showpopsubjectstats	1
popsubjectcount	5
usernamechange	0
showspoilertag	1
showvideotag	1
showebaytag	0
trimlongurls	1
trimlongurlsfront	40
trimlongurlsback	20
autoembedyoutube	1
autoembedebay	0
ebaylanguagecode	en-us
sessiontimeout	3600
highlightcode	1
rss_type	topic
rss_timelimit	month
rss_limit	100
rss_included_categories
rss_excluded_categories
rss_specification	rss2.0
rss_allow_html	1
rss_author_format	name
rss_author_in_title	1
rss_word_count	0
rss_old_titles	1
rss_cache	900
defaultpage	recent
default_sort	asc
sef	1
sefutf8	0
showimgforguest	0
showfileforguest	0
pollnboptions	4
pollallowvoteone	1
pollenabled	0
poppollscount	5
showpoppollstats	0
polltimebtvotes	00:15:00
pollnbvotesbyuser	100
pollresultsuserslist	1
maxpersotext	50
ordering_system	mesid
post_dateformat	ago
post_dateformat_hover	datetime
hide_ip	1
imagetypes	jpg,jpeg,gif,png
checkmimetypes	1
imagemimetypes	image/jpeg,image/jpg,image/gif,image/png
imagequality	50
thumbheight	32
thumbwidth	32
hideuserprofileinfo	put_empty
boxghostmessage	0
userdeletetmessage	0
latestcategory_in	1
topicicons	1
debug	0
catsautosubscribed	0
showbannedreason	0
version_check	1
showthankyou	1
showpopthankyoustats	0
popthankscount	5
mod_see_deleted	0
bbcode_img_secure	text
listcat_show_moderators	1
lightbox	0
show_list_time	0
show_session_type	0
show_session_starttime	0
userlist_allowed	1
userlist_count_users	1
enable_threaded_layouts	1
category_subscriptions	post
topic_subscriptions	every
pubprofile	0
thankyou_max	10
email_recipient_count	10
email_recipient_privacy	bcc
captcha_post_limit	0
keywords	0
userkeywords	0
image_upload	registered
file_upload	registered
topic_layout	flat
time_to_create_page	1
show_imgfiles_manage_profile	1
hold_newusers_posts	0
hold_guest_posts	0
attachment_limit	8
pickup_category	0
article_display	intro
send_emails	1
fallback_english	1
cache	1
cache_time	60

| Kunena integration settings:

Warning: Spoiler!

Kunena - AlphaUserPoints Disabled
Kunena - Community Builder Enabled: access=1 login=1 activity=1 avatar=1 profile=1 private=1
Kunena - Gravatar Disabled
Kunena - JomSocial Disabled
Kunena - Joomla Enabled: access=1 login=1
Kunena - Kunena Enabled: avatar=1 profile=1
Kunena - UddeIM Enabled: private=1

| Joomla! detailed language files installed:

Warning: Spoiler!

Joomla! languages installed:
en-GB	English (United Kingdom)

Third-party components: CommunityBuilder 1.8.1 | UddeIM 2.8

Third-party SEF components: None

Plugins: Content - Kunena Discuss 2.0.1

Modules: Kunena Latest 2.0.1

This does not happen here at www.kunena.org - and it would be somewhat embarrassing if it did, wouldn't it? Therefore the problem is local to your website.

My guess is you have added your registered users into the administrator group. Administrators can delete anything.

No, I have checked very thoroughly, and the registered users are not in the Admin group.

I did figure out that while those boxes and options are there, if you try to use them you get a message at the top saying "you do not have moderator privileges". But it does seem to delete all of the user's own posts in any thread you check the box for.

It also appears that a user can see the boxes and options only in categories where he has made a post in one of the threads in that category. If you go to another category, where you have not made a post, they aren't there.

This is very mysterious...

Thanks for your help.

Maybe your users are not in the Administrators group but, instead, you have set some Joomla ACL permission for the Kunena component that has granted everyone who uses Kunena "administrator" privileges; it's very easy to do, too. Joomla ACL permissions are tricky things to get around if you're not extremely careful with them. I stay clear of those areas. Many less problems that way.

yeah it seems like it is an issue with how you have setup your joomla ACL.

this works fine for me.

You both may be on to something. I created an ACL group called "Moderators". But the categories in which my Registered users are seeing this behavior are categories where the access is set to Registered.

I'm going to try to remember all the places where I used that "Moderators" group and see if I can back it out, then delete that group. Maybe that will solve the problem. I'll post back here with any updates.