Multiple Account Detection & Prevention
 

It happens all of the time. Some members will make multiple accounts to back their own opinion or get an extra vote in a poll. Here's a modification that will detect and prevent multiple accounts, as well as notify the administration about multiple accounts. Inspiration for this modification came from the work of MPDev (creator of the Multiple Account Login Detector) and randominity (creator of the Multiple Account Registration Prevention). This is basically a combination of those two modifications but with new and improved functionality.

This is not an update to the "Multiple Account Login Detector (AE Detector)" nor is it an update to the "Multiple Account Registration Prevention." If you have either one of these (or both of them) installed, you should uninstall them before installing this modification.

With the initial release of Multiple Account Detection & Prevention, I believe that I have fixed previous bugs/complications as well as improved the efficiency and logic of the code. This is my first publicly released modification. I would appreciate any comments and suggestions!

Confirmed! This works perfectly on all vBulletin 3.6, 3.7, and 3.8 versions.

Unfortunately, I cannot give support right now. I may be able to help periodically, but until my schedule yields some more free time, I won't be much support. Please check back in a week or two.

Basic Details
File Edits: None
Template Edits: None
New Files: 6
Hooks/Plugins: 3
Global Phrases: 36
Install Time: 2 Minutes or Less
Install Difficulty: None, Very Easy

Features and Settings
- Login Detection
- Registration Prevention (Multiple Methods)
- Ignore Child Accounts
- Ignored Users
- Ignored Usergroups
- Ignored ISPs
- Prevention Usergroup
- IP Address Based Prevention
- Extended IP Address Prevention
- IP Address Time Inclusion
- Banned Account Check
- Primary Banned Usergroup
- Cookie Expiration Time
- Cookie Refreshing
- Cookie Name
- Cookie Reset
- Multiple Account Reporter
- Reports via PM
- PM Report Recipients
- Reports via New Thread
- Forum for Report Threads
- Verbose Mode
- BB Codes: LIST, URL, CODE

How it Works
With every newly recognized login/registration, an account-counting cookie is set (or added onto) with the member's User ID. Depending on the settings, Multiple Account Detection & Prevention will analyze the cookie during login/registration to see if there are any multiple accounts.

Login Detection offers cookie-checking and reporting. Registration Prevention offers the same thing, plus more advanced features. First of all, when it prevents an account from registering, it actually moves the registrant to the Prevention Usergroup so that the administration can review the case. This also allows for customized privileges for recognized multiple registrants. Registration Prevention also has IP address detection which finds out just as much information about users. Depending on an administrator's preference, this modification can also reban a new registrant if one of their previous accounts has been banned. In fact, if the administration wishes, multiple registrants can simply be denied registration all together.

Whenever there is a detection/prevention, the modification will report the information to the administration through private messages, a new thread, or both (depending on settings). The Multiple Account Reporter can be any valid user.

Known Issues
- vB Optimise users: Reporting via thread seems to get messed up by vB Optimise, so try reporting via PM instead.
- PhotoPost vBGallery users: The registration handling appears to not work properly when PhotoPost vBGallery is enabled.

From what I can tell, these known clashes have been caused by the other modification's coding. The author of vB Optimise will not even work with me to fix it. Until they improve their coding, I'm not sure if I can do anything about these issues. As far as I know, administrators that do not use the above modifications will not have any problems.

Installation / Upgrade
Unzip the package (madp.zip), upload the files to your forum location, and import the product file (allow overwrite if upgrading). Please read the ReadMe.txt file that is packaged with the modification for more information.

Please remember to mark this modification as installed if you use it!
If you like it, nominate it for the Mod of the Month!

Thank you! :D

History (Changelog)

1.1.3 (March 31, 2009)
- Fixed a bug that caused reporting errors for owners of multiple accounts

1.1.2 (March 31, 2009)
- Fixed a bug that caused some IP address confusion
- Fixed a bug in login that caused reporting for deleted 'ghost' accounts
- Fixed a bug in registration that may have caused false negatives

1.1.1 (January 13, 2009)
- Fixed a bug that caused an "empty" warning when checking Ignored ISPs
- Removed a useless variable in the Login Detection plugin

1.1.0 (December 30, 2008)
- Fixed a bug from stripos() that caused an error within PHP4
- Added BB Code options for reporting
- Added Verbose Mode with bunches of details
- Added Silent Mode
- Added several different methods for Registration Prevention, including disallow
- Added more phrases and made everything 100% phrase-based
- Improved small bits of code to be more efficient
- Revised a few more AdminCP Help Topics
- Revised phrases to be flexible with BB Code options
- Revised line breaks to be correct on Windows servers
- Rearranged the options in AdminCP, reporting settings are now separate

1.0.4 (December 27, 2008)
- Fixed a bug that caused the account-counting cookie to not be set or read properly
- Fixed a bug that caused multiple registrants to be placed in the wrong Usergroup

1.0.3 (December 19, 2008)
- Added 'Cookie Name' setting
- Added AdminCP setting validation code, AdminCP will complain if a setting is bad
- Revised code to be completely compliant with the vBulletin standard
- Rearranged the order of options in AdminCP

1.0.2 (December 19, 2008)
- Fixed an interpretation issue with the & entity, thanks 'ray-'
- Fixed a check that may have let some multiple accounts go undetected during login
- Added 'Ignored ISPs' setting
- Added 'Cookie Reset' option
- Added support for spaces in all 'Ignored' fields
- Added a blank index file (index.html) in the /madp/ directory
- Improved cookie-processing efficiency: replaced strstr() with strpos()/stripos()
- Improved ip-checking function efficiency slightly: removed an unnecessary variable
- Revised a few AdmcinCP Help Topics

1.0.1 (December 16, 2008)
- Fixed a careless mistake that lead to false positives with IP Address Prevention

1.0.0 (December 16, 2008)
- Initial Release

Thank you. Installed.

Installed

Edit:

This is no longer in the beta stage. Please read the Known Issues.

I'm going to give this a go. just wondering tho, is there a way to stop it showing detected accounts from certain IP address. eg. AOL etc.

Thank you, good job!.

In the current state, no, there's not a way to do that. I'll take that as a suggestion for a future release, however, I can't guarantee anything.

Edit:

By the way, it seems that I did fix the only bug with the 1.0.1 version. I thought that I failed to do so because I accidentally uploaded the fixed version to the wrong directory on my forum. Everyone that has version 1.0.1 (as of now) should be fine. I'll start focusing on coding for suggestions.

I used to use the original Multiple Account Login Detector and unfortunately had to uninstall it as it simply stopped working. So this mod is a god send.

Before diving in I have one question - I would like to run this mod in "silent mode" by this I mean that users will be allowed to create and use multiple accounts but their presence is reported to the mod team by creating a thread is a designated mod forum.

Does this mod allow me to do this?

Marked as installed

could you please add one more feature, can you add some kind of a note in the postbit about the other account the user uses?? and when i come to band someone the same thing appear???? because i have about 20 warning a day about multiple accounts and its a waste of time to check each time if the user has another account when i want to band some1

I'll definitely give this addon a try. Almost anything that sends a forum arzehole to hell is appreaciated.

Trust me, forum trolls and fake user are a plague. ;)

hello. is it bug-free? or a beta?

Somewhat, yes. But you have to trick it. For the Login Detection, it will always just notify you - no user will be moved to any Usergroup or anything like that. To trick the Registration Prevention from preventing an account, turn off the Reban option, and set an incorrect Usergroup ID for the Prevention Usergroup (i.e. an ID to a Usergroup that does not exist). This will still allow the modification to report each incident to you, and it will let you know that the Prevention Usergroup is set incorrectly, so the multiple registrant will not be prevented. I may add an option for this later, but since it has this workaround, this will be at a lower priority.

I'll be happy to add in a feature if I can, but I do not understand what you are trying to ask me. Could you please reword your request?

I know... Trust me, I know. :)

Yes, it is bug-free. The latest version (1.0.1) is stable and there are no known issues, and it should work flawlessly.

a German translation, there is not it? :(

The file in the root "Madp" copy? OKEY, you must also create htaccess?

On my site, I have a few members who live in the same address. If they both take turns on their pc, this will detect them & ban them?

Is there a way to stop that from happening. If not, this could be a bad idea for some boards.

Kiros72, please help me.

I'm sorry, but I do not know German. =[

Upload the folder called /madp/ to your forum directory (like /forums/madp/). Import the product file (product-kiros_madp.xml), and then configure the options. There is no need (no reason) to create a .htaccess file.

When they login, nothing will be done except a detection report. A user will not be affected unless he/she is registering - in which case, the registrant will be moved to the Prevention Usergroup or rebanned if a previous account is found to be banned. Again, the Login Detection will not prevent a user from logging in nor will it ban anyone; it will just notify you through PM/thread depending on your settings.

If you do not want to receive the notifications for those users who use the same computer, then add one of their User ID numbers to the Ignored Users and enable Ignore Child Accounts. With Ignore Child Accounts enabled, as long as a user is seen as a multiple of an ignored user (or Usergroup), the user will be ignored from any kind of detection.

Would that solve your problem? :)

Hello Kiros72.

1st I should therefore have the files directly into the root copy, but the whole folder named "madp"? ok what I understood.

2nd why no htaccess file? dan but everyone can access it or I see this wrong? I do not want a door for a hacker up. do you?

1: Your forum root folder is the root that I'm talking about. If your forums are located at www.example.com/forums/, then the forum root is the /forums/ directory. You must upload all of the contents (files and folders) of the 'upload' folder into your forum root.

2: All files in a default vBulletin installation are publicly accessible. There's no reason to make the files private as long as there is no room for an exploit. Since these files contain the plugin code and nothing more, it would not do anyone any good to try to access these files. Therefore, no .htaccess is needed.

If I hack your (zip) unzip, I get a folder. / Upload / madp.
Do I have this folder in the root add?

www.Forum-Germany.de/Forum/madp/ <- really?

So I copy your php files with others in the root, but the whole folder.

The entire folder should be copied. After the upload, you should have this:

www.forum-germany.de/forum/madp/detection.php
www.forum-germany.de/forum/madp/functions_madp.php
www.forum-germany.de/forum/madp/prevention.php
www.forum-germany.de/forum/madp/set.php

(IF www.forum-germany.de/forum/ is the location of your forums!)

The product file (product-kiros_madp.xml) also needs to be imported through the AdminCP product manager.

Thank you. I have it installed. It has 20 seconds. :D

But I'm still worried that hackers can use this folder to a virus or something in my forum to bring.
If I were a htaccess file would create, how must it look like? can you please tell me? : o I am sorry that I pester.

Yes, that would solve my problem, Thank you.:up:

I'm not sure that there would be a way to disallow public access but to allow vBulletin to still use it. This is partially why a .htaccess file is not included in this modification. The majority of the reason is because there is no way that any of these files can be used improperly. None of these files use $_GET, $_REQUEST, or $_POST. Only $_COOKIE is used and that will not even get called if someone manually accesses the files. You should not worry about this.

If you know how, you can simply copy the code from the files to the plugins, but this will make vBulletin consistently use more memory. The modification is coded with files to make everything faster and more efficient. Again, the files do not add any risk because they are only useful if vBulletin uses them - not if some person tries to.

Notta problem. Just remember to mark it as installed for updates ;)

ok I do not install htaccess.

another problem:

I was with the IE as admin and registered with the FF as a user. but there is no double account displayed. pn, etc. did not set anything.

What is the main difference between your mod and this here: https://vborg.vbsupport.ru/showthrea...Login+Detector

That is but in the description. ;)

Why don't you disable open directory listing, or just upload a blank "index.html"-file to this folder?

nobody can access your directory then without knowing the exact filenames.

Nice mod. Found a small error in 2 phrases.
In madp_reg_message:
madp_regip_message:
(I removed the URL-tags in the above to avoid being displayed as links)
The &amp; isn't being parsed. The link will now show up as and it should be

This works with cookies. If you have the IP Address Prevention, it should catch it, but if not, cookies will not carry through different browsers. Also, make sure you don't have your Admin account ignored.

The difference is the new and improved features, as well as faster, more efficient code.

Funny you should mention that, I actually thought that I did, but it appears that I only have it on my server... Apparently I forgot to package it. I'll reupload the package with a blank index.html. Of course, the version will remain the same.

Excuse me? I do not see any errors in that. If you removed the URL tags, that's modifying my modification, and then that's not my fault. If you keep the URL tags in there, it should display just fine. The &amp; string is the correct way to link anything with & in it - it doesn't break anything. Also, there's no reason to not link to the member info - it just makes things easier.

real? an empty index.html can protect me?

You don't get it. I removed the url-tags, otherwise you won't see that piece of code in my reply. I left it the way it was in the phrase.
Point is, the &amp; is not being parsed. In other words, the link that'll show up in the message or pm will be:
http://www.forum.com/member.php?do=g...p;username=ray instead of http://www.forum.com/member.php?do=getinfo&username=ray

Not clear enough? Here's how it would be on vb.org:
https://vborg.vbsupport.ru/member.ph...;username=ray-

Doesn't work, because the "&" isn't parsed.
What does work is:
https://vborg.vbsupport.ru/member.ph...&username=ray-

I have Multiple account login detector (AE Detector) installed.
https://vborg.vbsupport.ru/showthread.php?t=183268
Is this an upgrade for that or a completely different installation?

An empty index.html will just ensure that the files are not listed in the /madp/ folder. Nothing bad can come from someone knowing of the files in this folder, but it allows there to be a blank page instead of showing specific files.

Apparently, we are both right. &amp; is a correct and standard entity, however, it seems that the '&' in '&amp;' is being parsed, so it's turning out to be &amp;amp;.

The &amp; entity is a standard - just like &nsbp; and &copy; - but since this is affecting some browsers like Opera, I'll try it with a blank & in hopes that it will be correctly parsed into &amp;.

Thank you for bringing this up.

This is a completely different modification. You should uninstall the "Multiple account login detector (AE Detector)" and "Multiple Account Registration Prevention" before installing this modification.

OK thank you very much for response.

Great job ..... ANd thanks ,,

sorry my bad,
lets say that alessai1 and alessai2 are sharing the same computer

when i open alessai1 profile it will be great if there is a tab (anything else is fine) that shows alessai2 is sharing the computer with alessai1.....

when i want to give alessai1 infraction a note appears, that tell me alessai2 is sharing the computer with alessai1

another idea (dont really need it) if alessai1 and alessai2 posted in the same thread, a small icon appears on alessai1 postbit that takes you to alessai2 post (and same apply to alessai2 post).

those ideas will make our life much easier because to me right now the addon is useless because i have a big forum, and i cant prevent every one and cant check every thread created by the addon

I'm truly sorry, but at this time, I do not think I'll be able to add that. A few reasons: I would like this modification to remain as compatible as possible with previous versions, and there are major profile differences between vBulletin 3.6.x and vBulletin 3.7.x; also, such a feature would require a database table, and I don't want to get into database work if the modification doesn't require it to function properly; and finally, I wouldn't know where to begin with the install/uninstall code for a database-involved modification.

Maybe in time, if I learn more about the differences in vBulletin versions, install/uninstall code for database tables, and SQL, itself. For now, though, my only suggestion is to let the modification prevent multiple registrants, and then prune the multiple accounts on a weekly basis by going to the AdmcinCP home, clicking [View] next to 'Users to Moderate' near the top, and deleting all of them. That should work out nicely as long as you have the Prevention Usergroup set to 4 (Users Awaiting Moderation).

Again, I'm sorry that I cannot add in those features at this time =/

On a brighter note, I'm about to release version 1.0.2, which has a few improvements, a fix for the &amp; interpretation that 'ray-' brought up, and an added feature (Ignored ISPs).

Alright, version 1.0.2 has been released.

The Ignored ISPs feature has not been sufficiently tested, so while I will continue testing it on my forums, I would like feedback on this somewhat-beta feature.

I'll try to have version 1.0.3 out as soon as possible, which will enable administrators to have a custom name for the cookie instead of just IDstack.

Edit:

I have just finished up version 1.0.3 and I plan to release it later today - after a good bit of testing.