and if the denied users or groups really want to see what they're begin denied they only have to go to the thread creator's public profile and look at all posts by user to read everything in the thread. it's kind of like when children make something invisible by covering their eyes ;)

other than that little issue, the hack is beautiful and my users value it so much that they are willing to lose the searching facilities of VB in order to maintain the security of the hack.

Hello folks!

I am finally back after some testing and I also had a look at the source code of this addon aswell.

To make it short:

1. This addon is save only under certain additional conditions which need to be set by an admin
   
2. The addon has no flaws

Kinda paradoxical, or? But read on! :)

Here are now the results of my investigations regarding the so-called security flaws

The "search postings" issue is a flaw but not of the addon but of the cache.
You need to rebuild your search index cache to make the addon work 100%. After rebuilding there will be a message in the search posting preview "This is message from private thread". Technically the addon is flawless - the problem is the forum search cache.

How to fix that issue

• Rebuild your cache often via cron
• Allow the addon only in certain forums which aren't searchable
• Allow the addon only in certain forums which are restricted to certain usergroups only, but take care: then the problem applies to the members of the usergroup itself if you do not alter the search rules to the forum
• Turn of "posting preview" or reduce the number of letters (standard: 200, to be found in search.php)
• Use a spoiler to at least 200 letters for each posting

My suggestions
Use the addon only in forums where the search function is put off or at least restricted to titles only.

Rebuildung your Search Index Cache somehow sucks, because of the time gaps and the huge server load it creates.

So does this mod still work.

Does it really create thread privacy or are there loopholes?

If I'm reading Rene correctly the mod does create fully private threads if you limit it to forums that are not searchable, and if you rebuild your search cache often.

Unfortunately constantly rebuilding the search cache is not realistic due to the time and server resources required.

So this leaves us with the option of shutting off the search function on the board or limiting the mod to forums which have the search function disabled.

I have no problem with exchanging the search functionality for the private threads.

I am indifferent as to where the fault lies: I prefer to fix the flaws than to affix the blame. Whether you want to say the mod is flawed or the caching algorithm of VB is flawed, is immaterial to me.

I do believe the limitations and implicit requirements should be noted prominently in the mod's documentation so that admins are forewarned, rather than finding out about it after one of your members realizes that she posted info about her adulterous affairs in a private thread that wasn't all that private...

Can't find the ON/OFF Switch!!!

What does Admin Panel/Forum Rights/?

There is no such option in the Admin CP

Thanks!

go into the Admin CP -> Forums & Moderators -> Forum Manager

expand the forums and permission each in the Enable / Disable Private Thread Option towards the bottom.

I understand your point.

Understand mine.

My point is that the hack is GREAT. But it should be called "Private POSTS" instead of "Private Thread" :)

There is a plugin that is disabled by default:
Private Threads: Get Private/Restricted Users showthread_complete
What does that one do? Why is it disabled?

Also -- do you know how the mod interacts with mysql fulltext search? Does it still have the same problems?

Also -- is it still set up for admin only to be able to 'private' things?

It's an excellent mod -- I used the older version (long ago) and found them useful for our boards. Thanks for putting it together (it's BIG!) and thanks for supporting it.

One comment: I am running a huge board with many forums. It would be great if the admin controls had a setting that would propagate through child forums.

BUG: Edit (AJAX) of the first post of a thread results in the loss of the private flag for the thread.

A question, does this work with VB4?

Has anyone tested it?