vb.org Archive
Page 3 of 4 12 3 4
Show 40 post(s) from this thread on one page

vb.org Archive (https://vborg.vbsupport.ru/index.php)
-   vBulletin 2.x Full Releases (https://vborg.vbsupport.ru/forumdisplay.php?f=4)
-   -   Password Protected Forums (vB3 Style) (https://vborg.vbsupport.ru/showthread.php?t=50012)

SemperFidelis 05-06-2003 05:52 PM
Quote:
04-23-03 at 06:35 PM xiphoid said this in Post #76
We really needed this hack, and after looking at it, I threw it towards Scott and he fixed it in 1 minute, lol.

Here is version 1.2 which at least works on one of the sites I have it installed on. So hopefully it works for you too.

The changes are the forumdisplay and showthread text that you have to replace, the whole chunck. So, to upgrade, just remove it from those 2 files again and put this stuff instead.

Moo
Ok
A few problems here

I have applied the modifications that were kindly supplied by xiphoid (cheers for those)

Now when I go to view a thread, I am getting :
Code:
Database error in vBulletin 2.3.0:

Invalid SQL:
        SELECT security,forumpass,passtimeout
        FROM forum
        WHERE forumid =

mysql error: You have an error in your SQL syntax near '' at line 3

mysql error number: 1064

Date: Wednesday 07th of May 2003 02:46:23 AM
Script: http://localhost/rnas/rnas/showthread.php?s=&threadid=7
Referer:
Also when modifying a forum to incorporate the protection, Im still getting this :
Code:
Password protection enabled, yet no password was submitted.
(Forum access can be gained by leaving the password field blank on entry.)
In this instance, it appears the password is still being applied though.

redstaing0 05-06-2003 09:15 PM
i have install the hack but dont work 100% beusoe if you test any work 8488 and real password was vb200325 and the user can com in the Protected Forums and can test any t and they can oben how ican fixe it and why dont work 100%

Thankes for helpp it is real cool hack if they work in the my from i need to the hacks very much

SemperFidelis 05-10-2003 05:33 AM
Has anyone come up with a complete 100% working version of this hack yet ?

S.Shady 05-10-2003 09:34 PM
Quote:
05-03-03 at 09:41 PM marlborosat said this in Post #79
idem
Database error in vBulletin 2.3.0:

Invalid SQL:
SELECT security,forumpass,passtimeout
FROM forum
WHERE forumid =

mysql error: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 3

mysql error number: 1064

and everyone else getting mysqp errors.
put them in one at a time i was putting them in at the same time and getting the same error. but sucess every time putting 1 in at time

Restless_ca 05-10-2003 11:06 PM
Very very nice hack.

tomsch 05-11-2003 06:48 PM
i have 2 problems with this

first is i can't change the password once its set or anyting else for that matter it just won't update those feilds


Password protection enabled, yet no password was submitted.
(Forum access can be gained by leaving the password field blank on entry.)
Record updated!

thats what it says when i try to update for some reason the password var is not being set

and the second it would appear the once a user has a cookie you can access the forum without entering the pass and after the time out period i had mine set for 60 mins i waited 2 days and was able to get access

any ideas for a fix??

John 05-12-2003 10:54 AM
Sorry everyone, I've been away for the past couple of months - now I'm back, and I've got a bit of time to fix any issues there are with my current hacks.

Is the modified version that xiphoid posted working fine? If so, should I update the original?

tomsch 05-14-2003 07:43 PM
i'd like to click install but i can't get it to work:)

amp2000 05-15-2003 12:21 PM
Quote:
Is the modified version that xiphoid posted working fine? If so, should I update the original?
I'd like to know the answer to that myself, can anyone confirm they have a fully working version ??

Cheers
amp2000

amp2000 05-15-2003 06:26 PM
For everyone getting errors similar to the following from xiphoid's update
Code:
Database error in vBulletin 2.3.0:

Invalid SQL:
SELECT security,forumpass,passtimeout
FROM forum
WHERE forumid =
The problem is that $forumid isnt in single quotes, example, instead of
Code:

Open up: root/showthread.php

Find:
-----------------------------------------------------------
eval("dooutput(\"".gettemplate("showthread")."\");");
-----------------------------------------------------------

Replace with:
-----------------------------------------------------------
// Showthread Password Protection Code
// Updated by Scott
$forumid = $foruminfo['forumid'];
$seccheck = $DB_site->query_first("
        SELECT security,forumpass,passtimeout
        FROM forum
        WHERE forumid = $forumid
");
The above code is wrong, use the code below instead of the above from the readme.
The only difference is '$forumid' now has quotes around it. Hope that helps yas ;)

Code:

Open up: root/showthread.php

Find:
-----------------------------------------------------------
eval("dooutput(\"".gettemplate("showthread")."\");");
-----------------------------------------------------------

Replace with:
-----------------------------------------------------------
// Showthread Password Protection Code
// Updated by Scott
$forumid = $foruminfo['forumid'];
$seccheck = $DB_site->query_first("
        SELECT security,forumpass,passtimeout
        FROM forum
        WHERE forumid = '$forumid'
");
I have installed this on a 2.3.0 vBulletin & can see no problems (other than the above which is now corrected) with the hack.
But then again I've only installed the hack from xiphoid's 1.2 version so I dont know what the bug was with Shaolyen's 1.1 version.
If someone can tell me how to reproduce the flaw I'll test it out & let yas know if it works. If anyone is reluctant to tell me how to reproduce the flaw will you pleeeez see does it work on the new updated instructions, ie v1.2, I need to know whether this is secure or not before I use it.

This is a great hack Shaolyen, I'll be definitely clicking install if this works, thanks!

Almax 05-15-2003 10:04 PM
Quote:
05-11-03 at 08:48 PM tomsch said this in Post #86
i have 2 problems with this

first is i can't change the password once its set or anyting else for that matter it just won't update those feilds



Password protection enabled, yet no password was submitted.
(Forum access can be gained by leaving the password field blank on entry.)
Record updated!


thats what it says when i try to update for some reason the password var is not being set




and the second it would appear the once a user has a cookie you can access the forum without entering the pass and after the time out period i had mine set for 60 mins i waited 2 days and was able to get access

any ideas for a fix??

And the exact same here
and if its register_globals on/off
how do i turn them on/off ?

nefarious 05-17-2003 10:20 PM
Installed Xiphoid's fix with amp2000's changes and it still doesn't work.

I am still able to enter a bogus password, hit the back button and then refresh and you can get in...

Any clues on how to fix this?

SemperFidelis 05-19-2003 12:21 PM
Cheers for the fix amp2000
:)

nefarious 05-19-2003 12:56 PM
I have installed the 'fixes' but I can still get in without a password.

If you enter a wrong password you get a second chance to enter one, OK so far, but if you now hit the back button and then the refresh, bingo you are in ...

tomsch 05-22-2003 02:00 AM
same prob here. i did notice that no cookie was sent. so i'm guessing a null check might be needed???

anyone have an idea??

:disappointed:

Smoothie 05-22-2003 07:32 AM
Quote:
If you enter a wrong password you get a second chance to enter one, OK so far, but if you now hit the back button and then the refresh, bingo you are in ...
yep, exactly the same problem I reported way back. Had to uninstall, its worthless as is.

dano 05-22-2003 12:29 PM
Well that sucks, I was going to install this today :(

MentaL 05-24-2003 07:09 PM
gonna test on 2.9..

MentaL 05-24-2003 11:21 PM
works

Shepski 06-06-2003 11:59 AM
has anyone managed to figure out a solution to the refresh to enter forum problem. I want to install this hack but cant if this problem exists as it wont take users long to find out the bypass :(

blackice912 06-10-2003 06:00 PM
Indeed sounds like a nice hack, but no way if they can bypass it.

csidlernet 06-17-2003 04:52 AM
Thanks very much.
/me hits install

Sn00peh 07-01-2003 09:05 AM
if i click on the "go to last post" link next to the username who last posted, i get into the forum without a password.... my fault?

Sn00peh 07-18-2003 01:15 PM
anyone having the same problem? please, this is kinda urgent :\

Frozen Dreams 07-21-2003 12:07 PM
Quote:
03-12-03 at 03:09 PM Shaolyen said this in Post #14
The glitch I left in was this line of code (in two places) which gives access to the forum on the second incorrect attempt.

PHP Code:
setcookie('cookpass['.$forumid.']', $seccheck[forumpass], 0); 
I've deleted it and updated the instructions.

those lines are actually still in the changes the txt file asks for ... once in showthread and once in forumdisplay ... I removed them and whatever I tried (backbutton etc) I couldnt get in at all without the proper password ;)

and I dont know if those changes did it - but I get the password prompt when clicking last post button on forum index as well

[high]* Frozen Dreams clicks install[/high]

LordJMann 07-24-2003 02:23 AM
I applied this hack and updated it after I heard people were getting in without a password, and it still has the same problem...

One of the guys who is getting in says it hows it setting his cookies... Any ideas?

Sn00peh 08-04-2003 10:00 PM
well, i wouldn't recommend this hack, due to it's major security holes... i've uninstalled it.

-HipNoTiK- 08-21-2003 01:22 AM
Well, this sure doesnt work in 2.3.2 :disappointed: Does anyone know of something clse to this that will work with 2.3.2?

Toky0 08-21-2003 01:30 AM
I think it will work with 2.3.0 some what. I'm not switching over to 2.3.2 =/ Only to 3.0.0 and up.

nefarious 08-21-2003 07:35 AM
I am sticking with it, only a couple of users have worked out the bypass and the password is given out to members who ask for it (it is a slightly lame adultish forum) and it is really there to stop casual lurkers.

Hopefully 3 will be out soon enough and then it shouldn't be a problem anymore...

grov 11-12-2003 08:03 PM
Is there anything one could do to modify this hack so that it isn't possible to bypass the password ?

Regards.

poetic 11-25-2003 08:02 AM
ok, i added

PHP Code:
  maketableheader("Forum Security");
  echo "<tr class='".getrowbg()."' valign='top'>\n<td><p>Choose Forum Security</p></td>\n<td><p><select name=\"security\">\n";
      echo "<option value=\"1\" SELECTED>Regular Forum Security</option>\n";
      echo "<option value=\"2\">Password Protected Security</option>\n";
  echo "</select>\n</p></td>\n</tr>\n";
  makeinputcode("Forum Password<br><font size=1>If password protection is enabled, you must 
  choose a password <br>needed to access the forum.</font>","forumpassword");
  
  echo "<tr class='".getrowbg()."' valign='top'>\n<td><p>Password Timeout<br><font size=1>The time until the password times out.
  <br>After the this occurs, the user will have to enter the password again to gain access.</font></p></td>\n<td><p><select name=\"passtimeout\">\n";
      echo "<option value=\"60\" SELECTED>60 Seconds</option>\n";
      echo "<option value=\"600\">10 Minutes</option>\n";
      echo "<option value=\"1800\">30 Minutes</option>\n";
      echo "<option value=\"3600\">1 Hour</option>\n";
      echo "<option value=\"36000\">10 Hours</option>\n";
      echo "<option value=\"86400\">1 Day</option>\n";
      echo "<option value=\"604800\">1 Week</option>\n";
      echo "<option value=\"2419200\">1 Month</option>\n";
      echo "<option value=\"29030400\">1 Year</option>\n";
  echo "</select>\n</p></td>\n</tr>\n"; 
after

PHP Code:
  makechoosercode("Custom style set for this forum","styleset","style",$forum[styleid]);
  makeyesnocode("Override users custom styles<BR>(will force this forum's specified colors)","styleoverride",$forum[styleoverride]); 
in admin/forum.php in attempts to be able to assign a password to existing forums instead of just having that option of adding a password wen creating forums. i then assign the attributes and the password and the cookie timout, then click save changes. but it dosen't actually save, the password is not applied and i go back into edit and the same forum and the password area is back to its original state can someone please help

ronb 11-25-2003 06:58 PM
I installed this hack and i do not see anything in the admin cp. Any ideas as to what i did wrong?

poetic 11-26-2003 06:57 AM
^^the option to set a password is only avalible when you make a new forum, so when u make a new forum right where u set the name and permissions at the very bottom if u followed the instrucstions right it should be there

zsmom 12-03-2003 09:48 PM
I just installed it on 2.3.2 and it works fine. Any forums that I really really need to keep people out of I use access masks for or make the forum hidden. Like someone else said, it works great to just keep out the casual lurkers.

* clicks install

ronb 12-11-2003 04:47 PM
i installed this hack and it worked fine until we tried to add another forum. We're getting an sql error. Here's what we're getting.

Database error in vBulletin Control Panel 2.3.0:

Invalid SQL: INSERT INTO forum
(forumid,styleid,title,description,active,displayo
rder,parentid,
parentlist,allowposting,cancontainthreads,sponsorn
ame,sponsorimg,
sponsorurl,daysprune,newpostemail,newthreademail,
moderatenew,allowhtml,allowbbcode,allowimages,allo
wsmilies,allowicons,
styleoverride,allowratings,countposts,moderateatta
ch,security,forumpass,pastimeout)
VALUES
(NULL,'1','Temporary MOB','','1','4','41',
'','0','1','','',
'','30','','',
'0','0','1','0','
s','1',
'0','1','1','0','1','','60')
mysql error: Unknown column 'pastimeout' in 'field list'

mysql error number: 1054

Any ideas as to how i can fix this so we can add more forums?

MaDCaT75 12-25-2003 05:06 AM
Uh did anyone fix the password exploit yet where you can input any password and you can still get in!? :confused:

Oblivion Knight 12-25-2003 05:58 AM
Seems to be working with no problems on 2.3.3 using the file posted in #76 and the fix posted in #90.. I'm not able to bypass the forum password using the method discussed in this thread, and the forum password updates fine when entering a new one.

Could anyone point me in the right direction to make this mod work with this.? Currently the forum password protection can be bypassed by clicking on the title of the last thread shown on the forum summary.

Roody 01-06-2004 01:21 PM
I would like to use this hack to keep an Asst. Admin from accessing a certain forum on a site I admin. Unfortunately since he has Admin CP access he could read the password. You mentioned in your first post about setting it up so the password have asterisks or another symbol to replace the password so it couldnt be read in the AdminCP.

How do I go about making this happen?

skullycapone 02-02-2004 01:27 AM
ok can someone help me a little i am kinda new to this and was wondering how to run the queries


All times are GMT. The time now is 04:20 AM.
Page 3 of 4 12 3 4
Show 40 post(s) from this thread on one page

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.

X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.01471 seconds
  • Memory Usage 1,846KB
  • Queries Executed 10 (?)
More Information
Template Usage:
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (5)bbcode_code_printable
  • (3)bbcode_php_printable
  • (6)bbcode_quote_printable
  • (1)footer
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (6)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (3)pagenav_pagelink
  • (1)post_thanks_navbar_search
  • (1)printthread
  • (40)printthreadbit
  • (1)spacer_close
  • (1)spacer_open 
Phrase Groups Available:
  • global
  • postbit
  • showthread
Included Files:
  • ./printthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/class_bbcode_alt.php
  • ./includes/class_bbcode.php
  • ./includes/functions_bigthree.php 
Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • printthread_start
  • pagenav_page
  • pagenav_complete
  • bbcode_fetch_tags
  • bbcode_create
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • printthread_post
  • printthread_complete