• MetaBlog
  • Flarum 0.1.0-beta.16 (RC 1) Released

🔐 User edit permission has been split to groups edit, credentials edit and attributes edit permissions. We've also added checks to ensure that anyone trying to edit an admin's credentials or add/remove users to/from the admin group is an admin. (flarum/core#2620)

I hope I'm not being stupid but I noticed something while doing a quick test. I gave the mods group the permission to edit user attributes, everything works well and as described, mods can't make themselves admins or edit credentials. But, they can still change an admin's nickname, avatar, and all other attributes added by extensions. It's a little bit annoying since this permission is very essential for moderation so it wouldn't be a great decision to strict it for admins only.

What I'm thinking of is, perhaps, protect the admins from being edited, whether it's a credential or an attribute, you just can't edit it for admins. That way, splitting permissions wouldn't be that necessary, or maybe it would for some communities, I'm not sure. I would rather just keep it as it is and only protect admins from being edited.

You guys know more than I do so I'll just keep this here in case you consider it one day.

    Mark73 I hope I'm not being stupid but I noticed something while doing a quick test. I gave the mods group the permission to edit user attributes, everything works well and as described, mods can't make themselves admins or edit credentials. But, they can still change an admin's nickname, avatar, and all other attributes added by extensions. It's a little bit annoying since this permission is very essential for moderation so it wouldn't be a great decision to strict it for admins only.

    We decided to only restrict editing of admin groups and credentials since those attributes are essential to security. If one of your mods gets their account corrupted and they edit your avatar, you're stuck with a possibly obscene avatar for a little bit. If they edit your username / password / email, they can hijack your account and effectively complete control over your forum and its data. I want to emphasize that in a well-protected and organized organization, moderator accounts shouldn't be getting compromised. This system is just a failsafe so that if they do, that bad actor can't get to admins.

    Mark73 the community extensions in question could add their own logic to also make their permissions take into account whether the actor and target are admin. The extension API is very flexible.

    almalino And I finally installed my first flarum forum and it works great! I will not post url here as forum is empty yet. May be later when I finalize it look and feel and when it has some messages

      ICANN I was able to post, but I think I found a bug. What I was doing was pasting something I found online. Flarum did not detect anything inside the text editor. The moment I actually typed something out, myself, it allowed me to post.

      @askvortsov Yes, I've recently found that editors can still have this problem. How is the progress on this issue?

      7 days later
      5 days later

      I just updated to beta.16 and I can't send emails anymore. I'm using the mailgun driver, trying to send a test mail and I just get "Oops! Something went wrong. Please reload the page and try again."

      Flarum core 0.1.0-beta.16
      PHP version: 7.4.3
      Loaded extensions: Core, date, libxml, openssl, pcre, zlib, filter, hash, pcntl, Reflection, SPL, session, standard, sodium, mysqlnd, PDO, xml, apcu, calendar, ctype, curl, dom, mbstring, FFI, fileinfo, ftp, gd, gettext, iconv, json, exif, mysqli, pdo_mysql, apc, posix, readline, shmop, SimpleXML, sockets, sysvmsg, sysvsem, sysvshm, tokenizer, xmlreader, xmlwriter, xsl, Phar, Zend OPcache
      +-----------------------------+------------------+--------+
      | Flarum Extensions | | |
      +-----------------------------+------------------+--------+
      | ID | Version | Commit |
      +-----------------------------+------------------+--------+
      | flarum-markdown | v0.1.0-beta.16.1 | |
      | flarum-tags | v0.1.0-beta.16 | |
      | flarum-sticky | v0.1.0-beta.16 | |
      | flarum-nicknames | v0.1.0-beta.16 | |
      | flarum-likes | v0.1.0-beta.16 | |
      | fof-username-request | 0.5.0 | |
      | fof-user-bio | 0.5.0 | |
      | fof-socialprofile | 0.3.0 | |
      | fof-moderator-notes | 0.5.0 | |
      | fof-links | 0.6.0 | |
      | fof-formatting | 0.4.0 | |
      | fof-byobu | 0.6.1 | |
      | flarum-flags | v0.1.0-beta.16 | |
      | zerosonesfun-bbcode-audio | 2.0.4 | |
      | flarum-lang-english | v0.1.0-beta.16 | |
      | flarum-bbcode | v0.1.0-beta.16 | |
      | fof-best-answer | 0.4.0 | |
      | fof-drafts | 0.4.0 | |
      | fof-impersonate | 0.8.0 | |
      | fof-merge-discussions | 0.5.1 | |
      | fof-polls | 0.3.2 | |
      | fof-split | 0.7.0 | |
      | fof-user-directory | 0.6.0 | |
      | matteocontrini-imgur-upload | v3.8.0 | |
      | flarum-lock | v0.1.0-beta.16 | |
      | flarum-mentions | v0.1.0-beta.16 | |
      | flarum-statistics | v0.1.0-beta.16 | |
      | flarum-suspend | v0.1.0-beta.16 | |
      +-----------------------------+------------------+--------+

        clarkwinkelmann This is what it's giving me!

        [2021-04-05 20:33:32] flarum.ERROR: Error: Class 'GuzzleHttp\Client' not found in /var/www/html/flarum/vendor/flarum/core/src/Mail/MailgunDriver.php:50
        Stack trace:
        #0 /var/www/html/flarum/vendor/flarum/core/src/Mail/MailServiceProvider.php(59): Flarum\Mail\MailgunDriver->buildTransport()
        #1 /var/www/html/flarum/vendor/illuminate/container/Container.php(829): Flarum\Mail\MailServiceProvider->Flarum\Mail\{closure}()
        #2 /var/www/html/flarum/vendor/illuminate/container/Container.php(714): Illuminate\Container\Container->build()
        #3 /var/www/html/flarum/vendor/illuminate/container/Container.php(652): Illuminate\Container\Container->resolve()
        #4 /var/www/html/flarum/vendor/illuminate/container/Container.php(1365): Illuminate\Container\Container->make()
        #5 /var/www/html/flarum/vendor/flarum/core/src/Mail/MailServiceProvider.php(68): Illuminate\Container\Container->offsetGet()
        #6 /var/www/html/flarum/vendor/illuminate/container/Container.php(829): Flarum\Mail\MailServiceProvider->Flarum\Mail\{closure}()
        #7 /var/www/html/flarum/vendor/illuminate/container/Container.php(714): Illuminate\Container\Container->build()
        #8 /var/www/html/flarum/vendor/illuminate/container/Container.php(652): Illuminate\Container\Container->resolve()
        #9 /var/www/html/flarum/vendor/illuminate/container/Container.php(987): Illuminate\Container\Container->make()
        #10 /var/www/html/flarum/vendor/illuminate/container/Container.php(907): Illuminate\Container\Container->resolveClass()
        #11 /var/www/html/flarum/vendor/illuminate/container/Container.php(868): Illuminate\Container\Container->resolveDependencies()
        #12 /var/www/html/flarum/vendor/illuminate/container/Container.php(714): Illuminate\Container\Container->build()
        #13 /var/www/html/flarum/vendor/illuminate/container/Container.php(652): Illuminate\Container\Container->resolve()
        #14 /var/www/html/flarum/vendor/flarum/core/src/Http/RouteHandlerFactory.php(74): Illuminate\Container\Container->make()
        #15 /var/www/html/flarum/vendor/flarum/core/src/Http/RouteHandlerFactory.php(34): Flarum\Http\RouteHandlerFactory->resolveController()
        #16 /var/www/html/flarum/vendor/flarum/core/src/Http/Middleware/ExecuteRoute.php(27): Flarum\Http\RouteHandlerFactory->Flarum\Http\{closure}()
        #17 /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\ExecuteRoute->process()
        #18 /var/www/html/flarum/vendor/flarum/core/src/Api/Middleware/ThrottleApi.php(33): Laminas\Stratigility\Next->handle()
        #19 /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Api\Middleware\ThrottleApi->process()
        #20 /var/www/html/flarum/vendor/flarum/core/src/Http/Middleware/CheckCsrfToken.php(44): Laminas\Stratigility\Next->handle()
        #21 /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\CheckCsrfToken->process()
        #22 /var/www/html/flarum/vendor/flarum/core/src/Http/Middleware/ResolveRoute.php(67): Laminas\Stratigility\Next->handle()
        #23 /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\ResolveRoute->process()
        #24 /var/www/html/flarum/vendor/flarum/core/src/Http/Middleware/SetLocale.php(50): Laminas\Stratigility\Next->handle()
        #25 /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\SetLocale->process()
        #26 /var/www/html/flarum/vendor/flarum/core/src/Http/Middleware/AuthenticateWithHeader.php(55): Laminas\Stratigility\Next->handle()
        #27 /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\AuthenticateWithHeader->process()
        #28 /var/www/html/flarum/vendor/flarum/core/src/Http/Middleware/AuthenticateWithSession.php(32): Laminas\Stratigility\Next->handle()
        #29 /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\AuthenticateWithSession->process()
        #30 /var/www/html/flarum/vendor/flarum/core/src/Http/Middleware/RememberFromCookie.php(52): Laminas\Stratigility\Next->handle()
        #31 /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\RememberFromCookie->process()
        #32 /var/www/html/flarum/vendor/flarum/core/src/Http/Middleware/StartSession.php(61): Laminas\Stratigility\Next->handle()
        #33 /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\StartSession->process()
        #34 /var/www/html/flarum/vendor/flarum/core/src/Api/Middleware/FakeHttpMethods.php(29): Laminas\Stratigility\Next->handle()
        #35 /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Api\Middleware\FakeHttpMethods->process()
        #36 /var/www/html/flarum/vendor/flarum/core/src/Http/Middleware/ParseJsonBody.php(28): Laminas\Stratigility\Next->handle()
        #37 /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\ParseJsonBody->process()
        #38 /var/www/html/flarum/vendor/flarum/core/src/Http/Middleware/HandleErrors.php(57): Laminas\Stratigility\Next->handle()
        #39 /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\HandleErrors->process()
        #40 /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/MiddlewarePipe.php(84): Laminas\Stratigility\Next->handle()
        #41 /var/www/html/flarum/vendor/middlewares/request-handler/src/RequestHandler.php(84): Laminas\Stratigility\MiddlewarePipe->process()
        #42 /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php(61): Middlewares\RequestHandler->process()
        #43 /var/www/html/flarum/vendor/middlewares/base-path-router/src/BasePathRouter.php(101): Laminas\Stratigility\Next->handle()
        #44 /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php(61): Middlewares\BasePathRouter->process()
        #45 /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Middleware/OriginalMessages.php(42): Laminas\Stratigility\Next->handle()
        #46 /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php(61): Laminas\Stratigility\Middleware\OriginalMessages->process()
        #47 /var/www/html/flarum/vendor/middlewares/base-path/src/BasePath.php(53): Laminas\Stratigility\Next->handle()
        #48 /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php(61): Middlewares\BasePath->process()
        #49 /var/www/html/flarum/vendor/flarum/core/src/Http/Middleware/ProcessIp.php(24): Laminas\Stratigility\Next->handle()
        #50 /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\ProcessIp->process()
        #51 /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/MiddlewarePipe.php(84): Laminas\Stratigility\Next->handle()
        #52 /var/www/html/flarum/vendor/laminas/laminas-stratigility/src/MiddlewarePipe.php(73): Laminas\Stratigility\MiddlewarePipe->process()
        #53 /var/www/html/flarum/vendor/laminas/laminas-httphandlerrunner/src/RequestHandlerRunner.php(96): Laminas\Stratigility\MiddlewarePipe->handle()
        #54 /var/www/html/flarum/vendor/flarum/core/src/Http/Server.php(44): Laminas\HttpHandlerRunner\RequestHandlerRunner->run()
        #55 /var/www/html/flarum/public/index.php(22): Flarum\Http\Server->listen()
        #56 {main}

        Seems like the same problem so I'll try this! https://discuss.flarum.org/d/25972-error-class-guzzlehttpclient-not-found-in-mailgundriverphp/2

          User18 we are missing instructions for Mailgun requirements in our documentation. I have created an issue so we don't forget about it flarum/docs190

          You should be able to solve the issue by running composer require guzzlehttp/guzzle:^6.0|^7.0 in your Flarum folder (same place you would to install extensions).

          Guzzle is a dependency used by many extensions so if you installed any extension that used Guzzle then the issue wouldn't happen. That's probably why it stopped working after update, you must have removed all extensions that has Guzzle as a dependency.

            clarkwinkelmann Ahhh I see! yeah that's probably it because I had it all working before. Thanks so much for your help! Edit: That worked, thanks again!

            Hey everyone, a quick update. We're released v0.1.0-beta.16.1 patch versions of the Markdown and Nicknames extensions:

            • In markdown, the mdarea text editor helper has been having issues with some languages. You can disable it via a new switch in the extension's admin page
            • In nicknames, compatibility issues with the beta 16 search API changes have been fixed