[RedFoxy]

Originally Posted by RedFoxy

INTERNAL SECURITY WARNING!
USER are ALWAYS able to edit their messages!!! That's a security warning for my forum!

On my forum isn't allowed to trade by chat and everyone that trade using chat is banned, now they can trade and edit their messages!!!

I looked in the configuration but there isn't something about editing, just only delete!

Ok I "fixed" it with a patch on the template, just it don't show the edit's buttons, vsa-chatbox need a real fix to prevent a JavaScript and vsa-chatbox's code injection about edit.

To patch it you must:

Open: vsa_chatbox

Search:

				<td width="1%" align="{vb:stylevar right}">{vb:rawphrase edit}&nbsp;</td>

Replace with:

				<vb:if condition="(($bbuserinfo[userid]==$vsacb_msg_arc[userid]) AND $vsacb_canmod) OR $vsacb_canmod">
					<td width="1%" align="{vb:stylevar right}">{vb:rawphrase edit}&nbsp;</td>
				</vb:if>

Open: vsa_chatbox_archive_bit

Search:

					<vb:if condition="($bbuserinfo[userid]==$vsacb_msg_arc[userid]) OR $vsacb_canmod">

Replace with:

					<vb:if condition="(($bbuserinfo[userid]==$vsacb_msg_arc[userid]) AND $vsacb_canmod) OR $vsacb_canmod">

Search:

		<vb:if condition="($bbuserinfo[userid]==$vsacb_msg_arc[userid]) OR $vsacb_canmod">

Replace with:

		<vb:if condition="(($bbuserinfo[userid]==$vsacb_msg_arc[userid]) AND $vsacb_canmod) OR $vsacb_canmod">

REMEMBER THAT IS A PATCH THAT DON'T SOLVE DEFINITELY THE TROUBLE, it don't fix the javascript or the code, a user with right knowledge can bypass that patch and use directly the javascript to edit the messages