Severity: CRITICAL
Location: src/Controllers/ForumController.php:1106-1231
Bug: Author/mod check runs, but no Forum::canView — a post author removed from a private forum can still edit/delete.
Fix: Add forum-visibility gate after thread lookup.
Status: open. Will reply with remediation details when resolved.
Resolved.
Added Forum::canView + !Forum::isPreviewOnly guards after thread lookup to all three handlers in src/Controllers/ForumController.php:
deletePost()editPost()updatePost()A post author who was later removed from the private forum can no longer edit or delete their old posts. Moderators from unrelated forums are also now confined to their own forum's scope through the same gate.
Returns 404 on failure (rather than a flash redirect) so the path no longer leaks "this post exists" to an unauthorized caller.
Locking this thread.
We noticed you are visiting from a mobile device. We are glad you are here, but know that 6502ish is best experienced on the desktop. Some features are not easily used via mobile and your experience may vary from the full experience via desktop.