group membership : unstable behavior ?

ornanovitch

Hey there !

From times to times, some of my forum users complain because they suddenly can't see theirs group tags discussions anymore. Each time this happens, I discover that members in question have been "kicked" from their group (i.e. in the edition modal, the group they were into is unchecked)

As I'm the only admin, and as on my forum only admin can modify a user, it seems to be an unstable behavior of the group mechanism or something like that. Has anyone ever seen that before?

As many extensions refers to groups, for their permissions parameters, or more directly, I don't really know from where to start my investigations.

askvortsov

ornanovitch Is there any chance these users are logging in via SAML? If that's attempting to sync groups, it could be the source of the issue easily. Tbh, I would recommend disabling that feature. Other than that, trust levels is the only extension I know of that actively edits user groups, but that behavior is determined by statistics from the forum itself, so it should be significantly more stable.

ornanovitch

Thx for those suggestions !

askvortsov Is there any chance these users are logging in via SAML? If that's attempting to sync groups, it could be the source of the issue easily

I don't think so, because we aren't using your Sync Attributes feature, and SAML is only for a few staff people (including me and I never had this problem)...

askvortsov trust levels is the only extension I know of that actively edits user groups

We aren't using trust levels, so it must be something else... 🤔

askvortsov

ornanovitch could you share php flarum info?

ornanovitch

askvortsov of course !

Flarum core 0.1.0-beta.15
PHP version: 7.3.19-1~deb10u1
Loaded extensions: Core, date, libxml, openssl, pcre, zlib, filter, hash, pcntl, Reflection, SPL, session, sodium, standard, mysqlnd, PDO, xml, calendar, ctype, curl, dom, mbstring, fileinfo, ftp, gd, gettext, gmp, iconv, json, ldap, exif, mysqli, pdo_mysql, Phar, posix, readline, shmop, SimpleXML, sockets, sysvmsg, sysvsem, sysvshm, tokenizer, wddx, xmlreader, xmlwriter, xsl, zip, Zend OPcache
+-------------------------------+------------------+--------+
| Flarum Extensions             |                  |        |
+-------------------------------+------------------+--------+
| ID                            | Version          | Commit |
+-------------------------------+------------------+--------+
| flarum-lock                   | v0.1.0-beta.15   |        |
| flarum-markdown               | v0.1.0-beta.15   |        |
| flarum-mentions               | v0.1.0-beta.15   |        |
| flarum-sticky                 | v0.1.0-beta.15.1 |        |
| flarum-tags                   | v0.1.0-beta.15   |        |
| flarum-subscriptions          | v0.1.0-beta.15   |        |
| flarum-lang-english           | v0.1.0-beta.15   |        |
| fof-formatting                | 0.3.1            |        |
| fof-linguist                  | 0.5.0            |        |
| fof-merge-discussions         | 0.5.1            |        |
| fof-split                     | 0.6.0            |        |
| rooaaar-lang-french-extended  | v1.17.0          |        |
| flarum-statistics             | v0.1.0-beta.15   |        |
| flarum-suspend                | v0.1.0-beta.15   |        |
| qiaeru-lang-french            | v1.9.1           |        |
| fof-upload                    | 0.12.5           |        |
| bokt-redis                    | 0.2.0            |        |
| fof-byobu                     | 0.6.1            |        |
| fof-terms                     | 0.6.1            |        |
| fof-reactions                 | 0.5.0            |        |
| fof-links                     | 0.5.3            |        |
| flarum-emoji                  | v0.1.0-beta.15   |        |
| clarkwinkelmann-circle-groups | 0.2.3            |        |
| fof-user-directory            | 0.5.0            |        |
| fof-nightmode                 | 0.7.1            |        |
| fof-user-bio                  | 0.4.2            |        |
| flarum-nicknames              | v0.1.0-beta.15   |        |
| askvortsov-help-tags          | v0.3.1           |        |
| flarum-flags                  | v0.1.0-beta.15   |        |
| fof-doorman                   | 0.3.0            |        |
| clarkwinkelmann-group-list    | 0.2.0            |        |
| askvortsov-saml               | v2.1.1           |        |
| fof-drafts                    | 0.3.2            |        |
+-------------------------------+------------------+--------+
Base URL: https://[xxxxx].[xxxxx]org
Installation path: /var/www/flarum
Debug mode: off

ornanovitch

I wonder if there would be a way to track all past user's groups changes...

luceos

ornanovitch try the audit extension. Not sure the free version logs all that though. @clarkwinkelmann can answer that.

ornanovitch

clarkwinkelmann luceos thanks you !

I think I just find out what's going on, and it seems to be some logical issue with the edit users permission associated with the View hidden group badges permission:

As I'm the only admin, and as on my forum only admin can modify a user

Ooops I made a mistake here, in fact I created a 'sub-admin' group which has the right to edit users. But in the same time, only admin has the right to view hidden group badges. So here is what happens:

let's say we have A, B, C and D groups, and let's say C has an hidden group badge
admin puts @user into A, B and C
now a 'sub-admin' with the edit users permission but without View hidden group badges wants to add @user to the D group. He cans because D doesn't have a hidden group badge, so he does it
just after that sequence, @user can't see anymore the tags readable by the C group and complains
admin find out that @user isn't in the C group anymore.

I hope you follow me^^ : when the 'sub-admin' edits the user's groups, if the user is in a group which has a hidden group badge, it's like if this group were unchecked when the query is sent.

So, step to reproduce:

make 3 groups
- group A which has the edit users permission but not View hidden group badges
- group B which has some tag read rights privilege and a hidden group badge
- group C which is standard
add user1 to group A and user2 to group B. At this step, user2 can see some special non public tags
with user1, edit user2 and add him to group C.
at this step, user2 is not in group B anymore

Tell me if you want me to open an issue on this.

ornanovitch

I'll look at this, thanks !

edit: it seems it should be enough to start

user.groups_changed: When the groups of the user are changed (data logged: old groups, new groups)

I'll update this post if I see something...

clarkwinkelmann

Yes, Audit Log Free should log anytime the group is changed manually by a moderator/admin. If an extension is changing it, it probably won't be logged.

askvortsov

Ahhhh that makes sense!

ornanovitch Tell me if you want me to open an issue on this.

Please do, thank you so much for the research on this!

luceos

ornanovitch this is ridiculous and insane 🤯 . But glad you found the cause of all this.

ornanovitch

ahah ok I'll do that, glad to have helped a little for a more stable flarum 😄