ISSUE SUMMARY:
My site is closed to the public. All JS... modules have been set to access=Registered, as have all items in the JomSocial Toolbar/menu. As expected, when not logged in and click on a JomSocial menu item, the public-user is redirected to login.

Unexpectedly, when the URL is crafted by removing "&Itemid=X" from the end of the URL, the user is granted access. How can I plug this hole?
Thank you,

STEPS TO REPLICATE:
1. Go to: we.seasideweb.com/index.php?option=com_c...sk=browse&Itemid=117
(since not a logged-in registered user, redirected to login as expected)
2 Got to: we.seasideweb.com/index.php?option=com_c...w=search&task=browse
(you'll see information that should be private only to registered users, namely my pic and name)
3
4
5
RESULT
EXPECTED RESULT
I want public-user who enters we.seasideweb.com/index.php?option=com_c...w=search&task=browse to be redirected to login, and *not* have the request to see the members list granted. I want to harden all the JomSocial toolbar links in the same way.
BROWSER

Hi, Rob.

This has nothing to do with JomSocial but rather with Joomla! Privacy restrictions are attached to... menu item ID. If you remove ID from URL... then no restrictions could be applied (the same goes for module assignment - you assign them to menu items ergo to menu item ID).

So how this can be fixed? First enable on your site SEF (Joomla! built in SEF will be enough). This will hide menu item ID from URL so it can't be removed.

You may also add condition to your template and wrap with it component display area. If user is not logged in - no component content will be displayed.