which template determines guest for showthread?

[testbot]

can someone help me find where the code decides if a member is a guest or not when it shows the thread?

for some reason i can't find where it decides to show the "you do not have permission to view this" or the actual thread content.

i'm sure i've just been staring at it for too long and it's prolly right in front of me somewhere really simple.

thanks!

[Zachery]

Thats a usergroup permission.

Can view thread content

[testbot]

thanks for your reply.

i'm aware that's a user group permission. i'm just trying to find that line in the template for something we're developing. :)

[Zachery]

There is no line in any template. If the permission triggers, the generic_error message template is shownn with phrases on it.

[testbot]

well it's gotta trigger somewhere, right? there's code somewhere that determines if someone has permissions or not. if it's not in the styles> templates where would it be? is it hard coded in showthread.php?

thanks again. :)

[Zachery]

Its a permission check in either showthread.php or one if its included files. What exactly are you trying to do?

[testbot]

weaken security :lol:

as odd as that sounds esp from me.. you don't know me but i worked in network security for over 10 years so it just sounds odd saying that.

so yea, i'm trying to create a simple backdoor to a specific forums content. the general discussion is set for guests to view threads but not the content. you know, tease them but make them join or login to view the actual content. pretty standard action.

the problem is that i also want to be able to submit content to bookmarks, rss feeders and other stuff w/o having to make it viewable by public. we thought that we can make that forum specific by passing something like && forum==5 && bd=98.

now we don't really care if a guest figures out that they can simply adds ?forum=5&bd=98 to the url or something like that to view the content of general discussion without logging in. more power to um if they figure that out but it'll still have the desired affect of enticing the average user to join or login while still being able to use rss feeders by adding that to the url.

does that make sense?

[testbot]

so there's no way to do this w/o changing the source code?

[testbot]

sorry to bump

[Lynne]

If you look at the code for the showthread.php page, you'll see that forum permissions are checked around line 444. So, use one of the hooks prior to that to change the permissions if bd=98 (or whatever).

[testbot]

i'll give that a try... thanks :)

[testbot]

ok, i suck. lol

i don't suppose someone wants to help me make this happen?

[testbot]

guess not haha

[testbot]

so i'm still working on this and i've decided the best way is to use the external_complete hook.

i think i just need to recreate the query without the following 'AND thread.visible = 1' and 'AND post.visible = 1' but i'm not sure. i feel like there's a better way.

maybe something like

if ($_REQUEST['forumid'] == 5 && $_GET['secretpass'] == 'somerandomsh!t')
{
-recreate case rss here-
or maybe
-recreate query here-
}

i feel like ya don't like me anymore since i ranted a bit in another thread. lol

anyway, can you at least tell me if i'm on the right track? if you're feeling really generous provide some detail. :)

[Lynne]

I just don't really know permissions - that is why I haven't posted any more in this thread (and I have no idea what other thread you are talking about).

What I was thinking is that you would want to set something like $vbulletin->bf_ugp_forumpermissions['canview'] to true if a certain parameter is passed. But, I've never played with it and so I really don't know if that would do it. You can try using a plugin before line 444 and setting that and $vbulletin->bf_ugp_forumpermissions['canviewthreads'] to true and see what the results are on a test site. If changing the permissions that way does what you want, then that is probably the easiest way to go about it.

[testbot]

oh, i get what you're saying now! thanks... i'll give that a try and report back. :)