Stop Members Bypassing Restrictions By Logging Out

[AngelBlue]

This addon has been withdrawn.

[codershark]

compatible to 3.7 ?

[Endurer]

Excellent work buddy, I defnitely need this one. Thanks a lot.

[citroenar]

Great, some members logout and create new account.no more.

[codershark]

But what happens when they empty his browser cache (incl. cookies) ????

[AngelBlue]

compatible to 3.7 ?
I don't know, because I don't use 3.7. Try it and see if it will work?

Great, some members logout and create new account.no more.
This won't stop them logging out and creating a new account. You need the "Multiple Account Registration Prevention" product to do that.
My mod is more focussed on stopping them using guest access as a second account.

But what happens when they empty his browser cache (incl. cookies) ????

It will stop working if they clear their cookies, obviously.
Thing is, most people only clear their cookies rarely, if ever.
Most internet users don't know about cookies. So this system will work on them.

Stopping someone who knows about cookies, IPs, proxies, etc from evading bans or limits on your website requires installing a bunch of different security mods to block multiple account creation, multiple account use, proxy use, and a bunch of other things. Even then, they may still be able to do it if they really know what they are doing.

My product here is not intended to be a comprehensive security solution, it is intended to be *one* tool that you *can* use as part of a wider system. Like the Linux/UNIX philosophy... one small, but efficient, powerful and widely compatible, tool for each job.

[bigcurt]

Thanks a lot..marking installed for right now and will install soon. Any errors for anyone yet?

It would be incredibly nice if you could set which usergroups use this and which don't. I would like my regular users to be able to log out just not my banned ones.

[AngelBlue]

Thanks a lot.

You're welcome :)

Any errors for anyone yet?
None for me :)

It would be incredibly nice if you could set which usergroups use this and which don't. I would like my regular users to be able to log out just not my banned ones.

Try editing the product file, replacing:

if (!isset($_COOKIE['NGBaccess'])) {
// we do NOT use vbsetcookie, because cookies set with vbsetcookie() are erased when the user logs out!
setcookie("NGBaccess", "yes", time()+31104000, "/");
}


with:

if (
!isset($_COOKIE['NGBaccess']) AND
!($vbulletin->userinfo['permissions']['genericoptions'] &
$vbulletin->bf_ugp_genericoptions['isnotbannedgroup'])
) {
// we do NOT use vbsetcookie, because cookies set with vbsetcookie() are erased when the user logs out!
setcookie("NGBaccess", "yes", time()+31104000, "/");
}


That *might* get the result you want, assuming the code is good and you've set all your banned groups to "is not a banned group: false" in your usergroup options.

If you haven't, you might try this :


if (
!isset($_COOKIE['NGBaccess']) AND
in_array($bbuserinfo['usergroupid'], array(8,9,10))
) {
// we do NOT use vbsetcookie, because cookies set with vbsetcookie() are erased when the user logs out!
setcookie("NGBaccess", "yes", time()+31104000, "/");
}

Where : "8,9,10" is a comma-separated list of the groups you want this to apply to. Don't actually use 8,9 and 10 unless these really are your banned groups :)

Please let me know if the isnotbannedgroup code above works :) If it does, I might consider releasing an update to this hack which lets you choose whether to apply it to all registered members, banned members, or an admin-supplied list of group ids.

[Konstantinos]

what happens to users who log in via net cafe and want to log out but they wont be able to do so , it risks the security of their account doesnt it ? maybe it whould be good if it was per usegroup (for banned and COPPA users)

[AngelBlue]

what happens to users who log in via net cafe and want to log out but they wont be able to do so , it risks the security of their account doesnt it ? maybe it whould be good if it was per usegroup (for banned and COPPA users)

Please read the modification description.

This mod does not stop registered users logging out, it just stops them from being able to read the forums while logged out. The purpose is not to prevent members logging out entirely, but rather, to prevent members logging out in order to bypass restrictions which apply to them when they are logged in.

[Konstantinos]

so its useless for admins who already have guests not be able to view the forum

[AngelBlue]

so its useless for admins who already have guests not be able to view the forum

No, actually it is quite useful for them!

The biggest reason to let guests see your forum is to entice them to register by showing them what they COULD get if they registered.

The biggest reason not to let guests see your forum is to force them to register - if they can browse as a guest, why do they need to register?

With this mod, you can let first time visitors see your forum, so they are tempted into registering, and once registered, they have to remain logged-in to view the forum. So you can get the best of both worlds. This mod works especially well with the limited guest viewing system, forming a combination that drives people to register and then stay registered and logged in.

[Big Boss]

Thanks for this! Been waiting for something like this for a long time.

[bigcurt]

I edited that piece of code just as you said..and I am not sure why it isn't working but as a banned user I can log off and log back in just fine ( and see the forum after log out )..all that.

[AngelBlue]

The cookie only gets set when the member views a thread or forum. If you try to test this by clearing your cookies then logging into an *already banned* account, it won't work.... because you don't have the cookie.
It would, however, work for the person that was banned, because they would (presumably) have viewed at least one thread before they got banned, and thus would have the cookie set.

If you *really* want it to work for banned users who have cleared their cookies previously, you could add something like the following to the plugin definitions :

<plugin active="1">
<title><![CDATA[NGB System [Profile Start Check]]]></title>
<hookname>global_start</hookname>
<phpcode><![CDATA[
if ($userinfo['usergroupid'] == 8) {
($hook = vBulletinHook::fetch_hook('ngb_plugin')) ? eval($hook) : false;
}
]]></phpcode>
</plugin>


Doing this would, however, probably be pointless, because if the banned person has cleared their cookies once since they last viewed a thread, the odds are they will just clear their cookies again if you re-set the cookie when they login with a banned account.

[bigcurt]

OK, would this be an adequate test of the system:

Make a user
look at a thread
Ban that user
Login as that user and test?

Would that be a good test/would it hurt my other account at all?

[AngelBlue]

OK, would this be an adequate test of the system:

Make a user
look at a thread
Ban that user
Login as that user and test?

Would that be a good test/would it hurt my other account at all?

Banning one user shouldn't affect any other user accounts unless you have something like AE Multiple Login Detection installed.

Once you have viewed a thread while logged in (you have to not be in vB's default banned usergroup, id 8, in order to read threads), it should deny you the ability to read the forum threads as a guest, until you clear your cookies.

What exactly are you trying to test? Are you trying to test that this product will stop people who have previously read a thread while logged in from continuing to read threads if they log out? If so, just install, read a thread, logout, and see if you can still read threads.

Are you trying to test that this mod stops users you have banned from browsing the forum as a guest? It will stop them reading threads, but only if they read at least one thread before you banned them.

[Allnick]

This is an interesting add on.
One thing though.....I find it good practise to view as a guest myself at times.
For instance after creating a new forum and setting permissions. I need to see what guests can view, as well as registered users.

I presume Admin (me) would have to clear cookies to view as a guest.
It would be good to have the Admin account unaffected.

[AngelBlue]

This is an interesting add on.
One thing though.....I find it good practise to view as a guest myself at times.
For instance after creating a new forum and setting permissions. I need to see what guests can view, as well as registered users.

I presume Admin (me) would have to clear cookies to view as a guest.
It would be good to have the Admin account unaffected.


Try editing the product file before importing, replacing:

if (!isset($_COOKIE['NGBaccess'])) {
// we do NOT use vbsetcookie, because cookies set with vbsetcookie() are erased when the user logs out!
setcookie("NGBaccess", "yes", time()+31104000, "/");
}


with:

if (
!isset($_COOKIE['NGBaccess']) AND
!in_array($bbuserinfo['usergroupid'], array(6)) )
) {
// we do NOT use vbsetcookie, because cookies set with vbsetcookie() are erased when the user logs out!
setcookie("NGBaccess", "yes", time()+31104000, "/");
}


You can replace the "6" here with "6,5" (IIRC) to also exempt supermods. You will need to clear your cookies once before this exemption applies.

[AngelBlue]

Removed the beta tag, as this hack has been in use for awhile now without issues.

[AngelBlue]

Version 2.0 released.
2.0 adds many new features, and makes the mod much more configurable.
However, it hasn't been tested as extensively as the old, smaller mod was.

To upgrade, uninstall the old product file, install the new product file, and go to vB admincp -> options -> No Guest Bypass to configure the new settings.

[mark|3]

Is there a 3.7 update?

thanks

[reverse1312]

It is a nice idea and it has an immediate effect on how many users log in :-)
Though I think I will have to uninstall because it prevents Googlbot's crawling my site. I see Googlebot is for ever seeing Forum index page...
Is there a mean to avoid it ?

Uninstalled

[Vtec44]

Is there a 3.7 update?

thanks

I have it on 3.7 Gold, and it blocks all guests (registered and unregistered).

[AngelBlue]

I no longer support this mod.

[reverse1312]

I no longer support this mod.

Thanks for telling us !!

:-)

Martin