• Q Restriction on Web bug?

    From Dumas Walker@VERT/CAPCITY2 to All on Thu Dec 5 11:01:43 2024
    If a Q restricted user logs into the bbs via telnet, SSH, etc., they are only shown the QWK menu and if they choose to "quit back to the BBS," the system immediately logs them off. The Q-restricted account cannot access any message areas, or anything else on the system.

    If a Q restricted user logs onto the web interface (both the older "runes" or the newer ecweb), they are able to access message areas and even post using their QWK ID.

    I would call this a "bug" since it is allowing the web interface to act in a different (and unintended) manner from the terminal interface, but I am also guessing there is some way that I can add something to an existing INI file to prevent this behavior?

    Thanks!
    $$
    ---
    � Synchronet � CAPCITY2 * capcity2.synchro.net * Telnet/SSH:2022/Rlogin/HTTP
  • From Digital Man@VERT to Dumas Walker on Thu Dec 5 14:13:32 2024
    Re: Q Restriction on Web bug?
    By: Dumas Walker to All on Thu Dec 05 2024 11:01 am

    If a Q restricted user logs into the bbs via telnet, SSH, etc., they are only shown the QWK menu and if they choose to "quit back to the BBS," the system immediately logs them off. The Q-restricted account cannot access any message areas, or anything else on the system.

    A Q-restricted account actually can perform a "normal" login by prepending a '*' to their login-id.

    If a Q restricted user logs onto the web interface (both the older "runes" or the newer ecweb), they are able to access message areas and even post using their QWK ID.

    I would call this a "bug" since it is allowing the web interface to act in a different (and unintended) manner from the terminal interface, but I am also guessing there is some way that I can add something to an existing INI file to prevent this behavior?

    You can set SCFG->Servers->Web Server->Login Requirements (in v3.20a) to "REST NOT Q" and then Q-restricted users won't be able to authenticate with the web server. There's probably other ways to limit access to (e.g. webctrl.ini files and maybe something ecWeb-specific), but that's a true brute-force way.
    --
    digital man (rob)

    Synchronet "Real Fact" #80:
    85 SBBSecho registrations were sold (at $49) between 1994 and 1996
    Norco, CA WX: 69.2�F, 49.0% humidity, 1 mph WNW wind, 0.01 inches rain/24hrs ---
    � Synchronet � Vertrauen � Home of Synchronet � [vert/cvs/bbs].synchro.net
  • From Dumas Walker@VERT/CAPCITY2 to DIGITAL MAN on Fri Dec 6 11:20:00 2024
    If a Q restricted user logs into the bbs via telnet, SSH, etc., they are only shown the QWK menu and if they choose to "quit back to the BBS," the system immediately logs them off. The Q-restricted account cannot access any message areas, or anything else on the system.

    A Q-restricted account actually can perform a "normal" login by prepending a '*' to their login-id.

    Should they be able to post, though? In the test I tried, it used the QWK accounts handle, which is <name> Bbs. I know they need to be able to post
    when uploading REP packets, and probably message the sysop, but should they be able to post to public message areas when logged on via the terminal?

    You can set SCFG->Servers->Web Server->Login Requirements (in v3.20a) to
    REST
    NOT Q" and then Q-restricted users won't be able to authenticate with the web server. There's probably other ways to limit access to (e.g. webctrl.ini
    iles
    and maybe something ecWeb-specific), but that's a true brute-force way.

    OK, thanks. I will try that.


    * SLMR 2.1a * "�Beavis! �Donde esta su hall pass?"
    ---
    � Synchronet � CAPCITY2 * capcity2.synchro.net * Telnet/SSH:2022/Rlogin/HTTP
  • From MRO@VERT/BBSESINF to Dumas Walker on Fri Dec 6 17:21:19 2024
    Re: Q Restriction on Web bug?
    By: Dumas Walker to All on Thu Dec 05 2024 11:01 am

    If a Q restricted user logs into the bbs via telnet, SSH, etc., they are only shown the QWK menu and if they choose to "quit back to the BBS," the system immediately logs them off. The Q-restricted account cannot access any message areas, or anything else on the system.

    If a Q restricted user logs onto the web interface (both the older

    "runes"
    or the newer ecweb), they are able to access message areas and even post using their QWK ID.

    haw! this is about me, right?
    why didnt you just ask me

    ---
    � Synchronet � ::: BBSES.info - free BBS services :::
  • From MRO@VERT/BBSESINF to Dumas Walker on Fri Dec 6 17:23:12 2024
    Re: Q Restriction on Web bug?
    By: Dumas Walker to DIGITAL MAN on Fri Dec 06 2024 11:20 am

    Should they be able to post, though? In the test I tried, it used the QWK accounts handle, which is <name> Bbs. I know they need to be able to post when uploading REP packets, and probably message the sysop, but should they be able to post to public message areas when logged on via the terminal?

    You can set SCFG->Servers->Web Server->Login Requirements (in v3.20a) to
    REST
    NOT Q" and then Q-restricted users won't be able to authenticate with the web server. There's probably other ways to limit access to (e.g. webctrl.ini
    iles


    your msg areas are not setup correctly. that is the issue.
    they also are setup in a messy fashion. you take all the various msg net subs and combine them.
    ---
    � Synchronet � ::: BBSES.info - free BBS services :::
  • From Digital Man@VERT to Dumas Walker on Fri Dec 6 16:24:50 2024
    Re: Q Restriction on Web bug?
    By: Dumas Walker to DIGITAL MAN on Fri Dec 06 2024 11:20 am

    If a Q restricted user logs into the bbs via telnet, SSH, etc., they are only shown the QWK menu and if they choose to "quit back to the BBS," the system immediately logs them off. The Q-restricted account cannot access any message areas, or anything else on the system.

    A Q-restricted account actually can perform a "normal" login by prepending a '*' to their login-id.

    Should they be able to post, though? In the test I tried, it used the QWK accounts handle, which is <name> Bbs.

    Spaces aren't allowed in QWK account names (since spaces aren't allowed in QWK-IDs because spaces aren't allowed in MS-DOS filenames), so I would hope that account's handle (alias) is not actually "<name> Bbs".

    I know they need to be able to post
    when uploading REP packets, and probably message the sysop, but should they be able to post to public message areas when logged on via the terminal?

    It's never been an issue before. Is it an issue for you?
    --
    digital man (rob)

    Synchronet/BBS Terminology Definition #79:
    sudo = Superuser Do
    Norco, CA WX: 77.8�F, 19.0% humidity, 0 mph W wind, 0.00 inches rain/24hrs
    ---
    � Synchronet � Vertrauen � Home of Synchronet � [vert/cvs/bbs].synchro.net
  • From Dumas Walker@VERT/CAPCITY2 to MRO on Sat Dec 7 10:31:00 2024
    they also are setup in a messy fashion. you take all the various msg net
    ubs
    and combine them.

    Aside from sysops, when users go looking for a message area to ask a
    question in, do you think they do it by topic or by network?

    I do have users. The only regular user here who is a sysop is me. The
    rest are not sysops. The board is set up in a logical way for users.
    As best as I can tell, they don't care what network a message area is a
    part of so long as it has traffic and isn't full of assholes.


    * SLMR 2.1a * He does the work of 3 Men...Moe, Larry & Curly
    ---
    � Synchronet � CAPCITY2 * capcity2.synchro.net * Telnet/SSH:2022/Rlogin/HTTP
  • From MRO@VERT/BBSESINF to Dumas Walker on Sat Dec 7 19:08:46 2024
    Re: Q Restriction on Web bug?
    By: Dumas Walker to MRO on Sat Dec 07 2024 10:31 am

    they also are setup in a messy fashion. you take all the various msg net
    ubs
    and combine them.

    Aside from sysops, when users go looking for a message area to ask a question in, do you think they do it by topic or by network?

    I get what you are trying to do. it's just messy how you did it.
    it doesn't work. tradional users will be confused because it's not something they are used to, new users will be confused because it's so convoluted.

    Did you ASK your users? perhaps you need to have it organized by network and then have an option to send them to 'computer help' msg subs. it's easy to do

    YOU think it's a logical way for users. it probably confuses them.
    go ahead and do what you want to do, you obviously can't take sincere criticism.


    part of so long as it has traffic and isn't full of assholes.

    hah good luck with that.

    ---
    � Synchronet � ::: BBSES.info - free BBS services :::