Just noticed that a banned member could login
into other forum using converge.

Bug??

He is in Banned group, Banned group doesn't have any permissions, he can login but he can do nothing.

nope... I made a banned member post and he could.

he shows on the other forumas member and not banned.

You have to set up permissions for that user group.
Basically it shouldn't has any permissions.

No the permissions are in place nd working fine.

Like this?

Firstly, where did you ban them? Did you ban them at the board level by placing them in the banned group? Or are you talking about ban filters, and if so where did you add the ban filters (converge, or at the board)? Did you ban the user at the specific forum you are referring to, or a different site (because ban settings are not passed from one instance to the next)?

Ultimately, if the user is in the banned group, the banned group permissions apply. It doesn't matter if the site is converged or not, because IPB doesn't care in terms of the user's permissions how they logged in - only what group they are in.

I banned him on forum 1 (created him, then banned him from admin cp right there.)

I am not talking about ban filter ....

So basically I created a banned user from admin cp at forum1 >>>

then tried this banned user on forum 2 and he could login as a member.

( forum1 and forum2 are configured in converge )

At this point I was wondering if a user is banned on forum 1 and is an admin at forum2 ( both sites db have his same email id)

Then will he be able to login as a member/admin on banned forum?

Thats because he was banned at forum 1, he'd have to be banned at both. For example, even though I have admin rights in converge, I am a admin on one converged site, but could be a member on another converged site, converge doesn't carry groups across from site to site.

So is this not a security bug in converge? This should be taken care of by converge.A banned member is a banned member.

Maybe if converge checks for permissions for a member for that specific forum this would not happen.
May be create more tables in converge and import permissions of all sites that are imported into converge
and when some email id tries to do some activity on any forum, his gp permissions are checked and if he is not eligible, he be redirected accordingly.

No, it's in no way a security bug. Why would it not be entirely feasible for an admin to ban a user at one site but not all sites? I can see many times where this might be warranted. Say if you have a community site and a business site. You might need to ban them for acting out on the community site, but not want them banned from the business site (since they did pay for your software). Or you might ban someone from a forum intended for children while letting them have access to a forum intended for teenagers.

Converge does not carry across permissions or groups.

Has been stated numerous times, but I feel the need to restate it here. In the future, at some point, we may (as in possibly) add some sort of permissions/group support, but you have no idea how difficult this is. Forums do not match up from one site to the next. One site might be Nexus while another is Wordpress and another is IPB. How do you map groups between the three? Does Wordpress even have groups? What about permission masks? Which applications support multiple groups, and how would you replicate that in applications that DON'T support multiple groups? What about the setting to override permission masks for a member? What about if you remove a user's posting rights, should that remove them in other apps? How would you correlate that to a blog, for example?

There's a million and one issues with trying to share permissions. While it sounds nice in theory in a basic environment, once you start taking into consideration all these other factors, and the fact that IPB isn't the only application that can be or will be converged, you can see it starts getting much more complicated.

Question. If I ban a user in converge they are banned on all the sites?

They are banned from logging into Converge. I'd have to have a look again to see if it bans the login when performed via the APIs however (my memory seems off today, must be cuz it's Monday).

heh It was TECHNICLY Tuesday here when you answered the question