Possible Security Loophole! Dev Staff Please Read

[GAMER4EVER]

Post deleted by author

[Ron2K]

Here's a quick two-step guide to getting attention from the devs:

1. Delete your post, for obvious reasons.
2. Post on the security tracker.

[Highway of Life]

Here are some links...
Note you could probably post this in the Bug Tracker since it's not a coding security issue, of course, if in doubt about security, it's better to post in the security tracker.

For everyone: IF you believe you have found a Security Hole.
DO NOT post it in a public place.
Post it in the Security Tracker

[Kellanved]

Highway of Life is correct: this is not really a security issue. Passworded forums are more a gag than a security feature.

Moreover, you will notice that you are not actually able to read those topics without entering the password. Permissions are the tool to stop users from seeing topics.

[dhn]

As per kellanved, this is not a bug. The forum has the Active Topics feature turned on. If you don't want the topics to show, just turn the feature off on that forum (it is off by default anyway).

[Lastof]

This is something that should be pointed out in the docs (if it isn't already) , since it is inconsistent with some of the other features. Topics from passworded forums do not show up in the search unless you have already entered the password, but they do in the active topics. That is likely to confuse some users.

[APTX]

I'd feel really bad if the topic that matches my search query best would need a password I don't have.

[jojobarjo32]

Fortunately, this is a feature which won't be used too much (at least I hope... Permissions are far more powerful)

[Acyd Burn]

I am closing this with my statement that i exactly feel like the original poster. All over the forum permissions are applied to the level of actually not only reading the topics contents but also the title, therefore it is only consistent to not show passworded forum topics if the user has not entered the password.