SimpleMachines
Who's Online doesn't always check whether bots actually have permission to log in
Source: https://www.simplemachines.org/community/index.php?topic=582176.0
As reported by Arantor:
As per the screenshot, Google did get an error trying to view registration (because you can see the little red (!) icon there), but I don't see it getting a little (!) icon for the others... I just tried it myself and correctly got stopped so maybe the logging code doesn't work so well there?
Maybe it's minor, but it's still an inconsistency.
I can't see anything to do here.
- SMF functions as expected and stops them from acting.
- The Whos online comes from the online log.
- The online log does not check permissions before logging. Just logs that they navigated to that URL.
To perform the logging as requested, we would either have to perform a full set of permission checks before logging, or log after executing the page, expecting that we complete and that when we bail, we log where appropriate.
If we must do something, we could improve the ActionInterface to have a reasonable set of permissions that need to be checked per action/area/sa, and then have it logged. We would need the Whos online to say something else as well because they did visit the site again, get an updated session, and are continuing to browse the forums.
