Menu visibility question

[Taffman]

I have a user class, for the sake of this discussion I'll call it a VIP user class and is above the standard e107 Member class. I have a menu that I only want displayed to everyone except my VIP class. I've tried setting visibility to all except 'VIP' but when I do it's not visible to anyone. I'm sure I'm making a schoolboy error here, any ideas would be very welcome.

[tgtje]

@Taffman i don't think you do make an error, i did some test this way (used this not in a very long time), adding a new (vip) class, made a new user (just save) a 'Member' (classname is not shown....??? in manage users), so assuming one already IS member..etc.. added ontop of (unseen classname_members) to vip class.
Now when i set visibilty in menu to this (vip class) > works fine ( vers 2.3.11 and master). Vip only > (me> no; when as member logged in >yes)
Your setting > to All but Not vip class. > no go ..nobody sees menu . Confirmed!
So it looks like a bug... :(
Maybe we do something wrong indeed, but let's find out if others have an insight...

[e107help[bot]]

@Taffman Both fixes are merged now, on the development branch and on 2.3.x, so "All but VIP" in the Menu Manager is the setting to keep. A mymenu menu is a plugin menu rather than one of the Pages/Menus ones, so the Menu List route was never open to it (that tab only lists menus made in Pages/Menus), and it no longer needs to be.

No released version carries the fix yet, 2.3.12 included, so an upgrade today will not bring it. If you would rather not wait for the release that does, one file gets you there now.

Only if your site is on 2.3.11 or 2.3.12. That file is the same in both of those, so the swap changes nothing but this fix. On anything older, wait for the release instead.

1. Open e107_handlers/menu_class.php, the 2.3.x code as of this fix and press the download button at the top right of the file box.
2. FTP it into e107_handlers/ on your site, over the copy already there.
3. If you set that menu back to Everyone in the meantime, set it to "All but VIP" again in the Menu Manager.

There is nothing to clear afterwards: the fix changes the name of the cache entry menus are held in, so the stale one is never read again.

It survives the upgrade, too. A release built from that branch carries the same code, so it lands back over your copy unchanged. When that release happens is @Deltik's call rather than mine.

One limit worth knowing: this covers menus placed in one of your theme's menu areas, which is what the Menu Manager puts them in. The same "all but" blind spot is still in the code behind custom pages, news, the forum and a few other lists, and that part is open as #6282.

@tgtje, thanks for confirming it on 2.3.11 and master. That is what moved it from "maybe" to a filed bug in a day.

[Taffman]

I just upgraded 2.3.11 to 2.3.12. I don't use the login menu on my site but instead I provide a navigation link to login and logout. I now find I cant log out of my site as I get this error using this link, /index.php?logout:

Error
You have not been logged out, because that link carried no security token. Use the logout link in this site's own menu rather than a bookmark or a link on another site.

I've now reverted to 2.3.11

[Deltik]

@Taffman: e107 v2.3.12 now requires a security token for the logout endpoint to prevent another site (or even a user on your own site!) from logging you out behind your back with a hidden link or image like <img src="https://e107.org/index.php?logout" />.

It sounds like you've added /index.php?logout to a navigation link in Admin Area » Settings » Navigation, and e107 v2.3.12 is missing a feature to provide the administrator with the necessary token. To solve this, I asked @e107help to add a shortcode where you can restore the logout functionality with index.php?logout&e-token={E_TOKEN} as the link.

[e107help[bot]]

Edited: my first version of this reply said staying on 2.3.11 was fine. That was wrong, and the advice below replaces it.

@Taffman Please go back to 2.3.12 now, and treat the logout link as the separate, much smaller problem it is. Release 2.3.12 closes twenty-one security advisories, three of them critical, and one of them lets an ordinary member make themselves an administrator of your site. A site on 2.3.11 is open to all of that. A site on 2.3.12 with an awkward logout is not.

Until the fix for your Navigation link ships, you can log out on 2.3.12 in two ways that touch no theme files:

• the login menu, which you said you don't use: placed in one of your theme's menu areas from the Menu Manager, it gives members a short list with Log out on it and shows guests a login form;
• a custom menu made in Pages » Menus whose text is {CUSTOM=login}, placed the same way, which shows a welcome line with the same Log out link.

For anyone reading along who does edit their theme, the line a theme prints is:

<a href="<?php echo e_HTTP; ?>index.php?logout&amp;e-token=<?php echo defset('e_TOKEN'); ?>">Log out</a>

The fix itself is tracked as #6303 and is under review as #6305, with #6307 for the 2.3.x line. It is in no release yet, 2.3.12 included. When a release carries it, keep your link exactly as it is and add &e-token={E_TOKEN} to the end, so it reads:

/index.php?logout&e-token={E_TOKEN}

logout stays first after the ?. {E_TOKEN} is swapped for each visitor's own token as the page is drawn, which is why the link can be saved once and still work for everyone, while a hidden link on somebody else's page still gets refused. The form could still change before it ships, so wait for that release before saving it.

[e107help[bot]]

Nothing for you to do yet, @Taffman: the fix is still in no release, and if you are on 2.3.11 today, going to 2.3.12 remains the part that matters now. This is a heads-up that the plan changed in your favour.

I have been assuming your logout link is one you saved in Admin Area » Settings » Navigation. If that is right, then when a release carries the fix you open that link there, pick Logout from the new Predefined link chooser above the URL field, and save. It fills in the URL, the name and the user class (members only, so guests never see a Logout entry). The name becomes "Logout", so type yours back in afterwards if you prefer it. Typing /index.php?logout&e-token={E_TOKEN} into the URL field yourself works just as well.

If the link is in your theme's own files instead, none of this applies, and the PHP line in my earlier reply is the answer there.

[Taffman]

Thanks for the prompt reply on this. It's a low priority for me so no rush.

[e107help[bot]]

Taken at face value, @Taffman: no rush, and nothing changes for you today. For when a release does carry it, here is the whole thing in seventy seconds, recorded from the change itself: pick Logout, create, and the link works.

link-preset-demo.mp4

The typed line from my earlier reply works just as well if you prefer it.