25 May 2009, 4:30

Hi guys, I am very new to mahara, but I am liking the possibility. In http://mahara.org/interaction/forum/topic.php?id=495 James said: "...and had to comment out the lines with php_flag and php_value." in the .htaccess file.

I have also  had to do this to get mahara to install on 1&1 shared hosting, can anyone comment on the security effect of this? I have now noticed that draft blog messages are visible to the whole world on my new install mahara and wondered if it were related to these changes or if it is a bug? Has anyone else noticed this?

25 May 2009, 7:23

Hi,

greetings from the Black Forest

About your blog messages; where are they visible? did you add a blocktype blogposting in your views? If you did not give permission to www the viwes will not be public.

Feel free if you need further assistance

Heinz

25 May 2009, 11:42

Hi Heinz, yes I have added a public view (http://wishful-thinking.co.uk/view/view.php?id=2&new= ) that includes the blogs, but I had a literal interpretation of the explanation when it says that  when the post is a draft, no one except you can see it. I had assumed that this meant that published blog entries would be visible, drafts would never. Depending on the way that I view the seperate blogs, this is what happens. It looks like different things are visible depending on how the page is called. From the blog entry on the view, I can access all the entries (eg http://wishful-thinking.co.uk/view/artefact.php?view=2&artefact=19). If I click on the link for the different blog categories (http://wishful-thinking.co.uk/view/artefact.php?view=2&artefact=14), it correctly only shows me the non-draft blog entries (although probably as I am logged in as the blog owner, shouldn't it show me them all like it does when I look at them via the my portfolio link?

25 May 2009, 18:55

Hi - the php_value and php_flag values will have no effect on the visibility of blog posts.

On the other hand, you may have found a bug in how Mahara displays blogs in views. We should double-check to see that draft posts do not show up using the 'blog' or 'recent posts' blocks. Though it's probably fine if they show up in the 'one blog post' block, as the user must have known what they were doing.