Multiple account login detector (AE Detector)
 

Same plug-in found here:

https://vborg.vbsupport.ru/showthread.php?t=107566

There are no differences as this plug-in works with both 3.5 and 3.6 versions of vBulletin.

If you are like me and migrated from .threads, a common modification was an "AE detector", a simple mod that saved a cookie of a history of ids logged into on your site. If someone logged into more than one account, you got a PM letting you know that your site was being accessed from multiple accounts.

Over the years this was very helpful in identifying users who were posting under multiple accounts (alter-egos!) and users who would return after being banned.

You might be wondering why I don't use the vbcookie call - well, thats because on logout all vB cookies are cleared, so we need to store a cookie that is not effected by the login/logout process.

New Installation
1. Add New Product with attached XML
2. Go to vBulletin Options -> AE Multiple Login Detection Settings and set your specific settings.

Time to install: Easy - 2 minutes.

Upgrade
If you installed this as a Plug-in manually, you can delete that plugin and install this Product, just make sure to go into the Options and set them accordingly.

I hope you find this useful and will click INSTALL if you use it; should it prove useful to enough people I can look at making this installation more automated without the need for edits and an Admin Options page.

To upgrade you will want to reimport this XML file and edit your options accordingly.

1.0.3
-----
. Added a check to ensure that users weren't deleted when reporting violations
. added htmlspecialchars_uni call to username

Note: I am unable to get the call to construct_phrase with $vbphrase['multiplelogin_alert'] to work reliably, as such the $message variable is still set manually inside the plug-in and not via the phrase. If anyone has an idea of why this might not always work, I'm all ears.

1.0.2
-----
. Updated to include exclusion groups, users
. Changed so PM is sent by ae sender id

1.0.1
-----
. Released as a Product (thank you PHPGeek2k3 for your help)
. Added option to post to a forum versus send a PM (or both)
. All settings moved into Admin Option

1.0.0
-----
Initial release.

This is the same plug-in as the one found in the 3.5 forum; just cross-posted here for the benefit of 3.6 users.

If for some reason your userids change - weather you reinstalled, started over or whatever; the best way to avoid getting false reports based on the users old userid is to edit the name of the cookie used by the AE Detector:

In Plugin Manager under the login_verify_success section edit the AE Detector: Login checker plug-in code.

Change each instance of "IDstack" to some new name for the cookie to be used. There are four of them all in the first 21 or so lines of the code.

1. if(isset($_COOKIE['IDstack']))
2. $idstack = $_COOKIE['IDstack'];
3. setcookie("IDstack", $idstack, time()+10368000, "/");
4. setcookie("IDstack", $idstack, time()+10368000, "/");

Still as useful as ever.

A treat to install and to use....

Although it's not a completely safe way to keep out annoying people, it really comes in handy. Thanks

This worked very well for me in the past stopping some idiots, so just installed on 3.6.

Excellent, thank you.

Sounds really useful, given it an install :)

You my friend are grade A meat. yum.

installed and tested, work fine, thank you :)

Works great, thanks.

awesome and clicked install. good job!

Essential plug-in, thanks!

Thank you, MPDev. :)

ok well u may know this but the hack version still comes up as 1.03 but here u have it listed as 1.0

Installed.

Thanks!

C:)

clicked install, very easy import and setup :)
...mauisun

Found in Options screen:

IS: List of usergroups that to not repot multiple logins sepertated by ","'s

Suggest:
Do not report multiple logins for these usergroups ID's (comma-separated list)

I suspect it would be better if all phrases were placed in the Phrase library.

An example phrase hardcoded in the xml:
Even better would be to give AE its own category in the Phrase library instead of sticking them in the VB category.

Otherwise, very cool!

Installed 1 m in tested and works 3.6.0 zero hassles

great hack
thxs
MarkAnthony
Musiciansquarters.com
Myspace.com/obeheimhaven

Right on....installed. ;)

Thank you for sharing.

Gonzo

Am I right in believing this can catch users hiding behind proxies (who otherwise don't clear their cookies after every session)?

Does AED generate a report for every additional (2nd, 3rd, 4th, etc.) identity found? Or does it just identify the first pair of overlapping accounts?

Put another way:
1 - Problem member gets banned
2 - Problem member re-registers
3 - AED spots overlap and generates report
4 - Problem member gets banned again
5 - Problem member re-registers again
6 - Does AED generate another report at this point?

It seems that the admin userID selected to generate a report thread does so from the computer of the overlapping users. The IP of the overlapping users' computer appears for the admin userID.

Anyway to prevent the IP logging behavior?

Otherwise, using the ID of one of the overlapping users to generate the report thread seems more appropriate.

p.s., neat hack!!

ignore me wrong hack

installed, testing it out. *clicks installed

Sometimes you get a hubby and a wife that both post from the same computer.

What would really be cool is if there was a way to set it to post a usernote to both duplicate registration ID's automatically (john123 = Jane456). That way I dont have to got post a note on there to keep track of dupe registrations.

Another cool feature would be to query for all duplicates; ie: run a report.

I like the hack though!!

You could add them into the exception list, no?

Thank you MPDev

Install

For some reason this isnt creating a thread when I KNOW users have more then one userid, anyone explanation as to this may be happening? Im running 3.6.1

If they clear their cookies or use another computer then you wont know. People using dial up are a pain, and those who have more than one ISP.

Every additional account on that computer generates a new report.

did u know... that this mod is probebley my most useful and important addition to my forums...cheers

-b6

BUGS?

1 - Please move all the phrases into the Phrase library

2 - Fix the custom phrase bugs
I ended up having to edit the XML file to change phrases there.

3 - Have Report threads indexed in search properly
I have reports sent to a dedicated Mod-only forum with "Index New Posts in Search Engine" set to Y. Usernames are not found when searching this dedicated forum unless I go into admincp and reindex.

4 - Have report threads update the post counts properly
The Bot that generates these threads always has a "0" post count.

5 - Some unintended interaction between PM and thread generation
Had both PM and thread generation set to Y. Everything worked fine for weeks. Changed PM option to N. Threads no longer generated. This was reported as a problem on the AED for 3.5 thread also.


RECOMMEND ADDING A USE TIP TO YOUR ADMIN POST:
1 - Set up a bot account to be the author of any AED threads and PMs.
This will save people a lot of grief as otherwise the admin IP shows up associated with all the overlapping accounts.


POSSIBLE ENHANCEMENTS

1 - Skip user overlaps that have been previously reported
I realize that detecting this on the user's machine is unreliable for cookies, especially if the perp is using different computers and what not. Perhaps AED can detect if an identical post in an existing thread already exists? Or by comparing the userID's in the cookie to a logfile of past matches on the server?

2 - Automatically change new overlapping user's group assignment based on prior account's group
E.g., move new account "B" into usergroup "3" if earlier account "A" is in usergroup "2" (e.g., if member account A is in a "banned" group).

3 - Option to flush cookies
Or possibly an option to change the cookie domain; or add a trigger date to the cookie.
If a forum resets userID's, this plugin becomes worse than useless.

4 - Option to add current IP's to PM/thread for reported overlaps.

5 - Option to force acceptance of cookie
As pointed out by another user on the AED 3.5 thread, troublemakers with 1/2 a brain can get around this utility. Forcing cookie use (an option to deny access if cookie not present/written and/or detecting matching accounts against the logfile) would not affect most members at all.

6 - Create username variables for all cases
It would be nice to have variables for each reported username in both linked and unlinked states as well as for "all" user names.

Well, I installed as this was one of the most useful that I used in 3.5.x but it does not work on my 3.6.1 board....it does not generate a PM or start a new thread....

Well, i used this hack and it is still one of my favoured, but since today it does not work :( I've upgraded to vb362 and don't get messages if users share their login. Is there a way how i can test the functionality?

I do have v3.6.2 and this hack is running smoothly.

Also running 3.62 with no problems....

I must have a conflicting hack installed or something as this is not working for me at all :(

Im running 3.6.2 & im having the same exact problem.

kudos :)

If for some reason your board changes userids, please refer to the second post:

https://vborg.vbsupport.ru/showpost....79&postcount=2