Recent Topics leaks titles/authors from password-protected forums

[avandenberghe]

Summary

get_forum_list() in core/recenttopics.php builds the forum list from f_read and f_list_topics ACL only. On a password-protected forum, phpBB grants f_read to everyone and enforces the forum password separately — so a passworded forum is included for users who have not entered the password, and its topic titles, last-post subjects, and authors are exposed in the Recent Topics block on the index page, on viewforum, and on the standalone /app.php/rt pages.

Core phpBB hides this same information until the password is entered:

• The index blanks the last-post subject of a passworded forum.
• viewforum requires the password before showing any topic list.
• Search and the feeds exclude passworded forums the user hasn't opened.

Steps to reproduce

1. Set up a clean board with a password-protected forum containing at least one topic.
2. As a guest (or any user who has not entered the forum password), view the index page.
3. Observe that the passworded forum's topic title appears in the Recent Topics block, while the forum list on the same page correctly blanks the last-post subject for that forum.

Location

avathar/recenttopics/core/recenttopics.php, method get_forum_list():

$forum_ary = array();
$forum_read_ary = $this->auth->acl_getf('f_read');
$forum_list_ary = $this->auth->acl_getf('f_list_topics');
foreach ($forum_read_ary as $forum_id => $allowed)
{
    if ($allowed['f_read'] || !empty($forum_list_ary[$forum_id]['f_list_topics']))
    {
        $forum_ary[] = (int) $forum_id;
    }
}
$this->forum_ids = array_unique($forum_ary);

Suggested fix

Exclude forums the user has not unlocked, using the same core mechanism the index/viewforum/search/feeds already rely on (phpbb\user::get_passworded_forums()):

$this->forum_ids = array_unique($forum_ary);
$this->forum_ids = array_diff($this->forum_ids, $this->user->get_passworded_forums());

[avandenberghe]

Same class of bug as postlove 2.2.6:

Added forum_access::drop_locked() and applied it everywhere a forum set is built from acl_getf('f_read'), in lovelist.php and summary_listener.php; f_read ignores forum passwords, so password protected content was leaking, including to unauthenticated requests via the love list route

postlove's fix (avathar/postlove/service/forum_access.php) doesn't call phpbb\user::get_passworded_forums() — that method scans every passworded forum on the board. Instead it runs the same FORUMS_TABLE / FORUMS_ACCESS_TABLE join scoped to the candidate $forum_ids, then array_diffs the locked ones out. Recommend porting the same forum_access::drop_locked() service (or an equivalent scoped query) into recenttopics rather than calling get_passworded_forums() directly, for consistency with postlove and to avoid the unscoped full-table scan.

Confirmed only one call site needs it: get_forum_list() in core/recenttopics.php is the only place recenttopics builds a forum set from acl_getf('f_read').