Fixing Who's Online Location permissions
 

Hi all,

There's a problem with the "Can View Detailed Location Info for Users" permission in vB 5. It allows the user to see the thread titles from private channels if set to Yes. There's a bug report for it here: http://tracker.vbulletin.com/browse/VBV-12542
But they say it can't be fixed and they are just going to add a warning in the help text for it.

Well, why don't we create a mod to get it fixed? In the onlineuser_details template, there's the following condition:
If we add another condition along with this to check the channel id of the user's location, then we can easily prevent the thread titles from appearing.

My question is, how can I add this condition to check for the channel id?

Thanks

The condition you are listing is only for the little "?" on the page, not for the thread title.

Anyway, if you do a vardump of the $user[wol] array ( {vb:debugvardump $user[wol]} ), you'll see it doesn't have the channelid included (nor does the $user array itself). So, I'm not sure you can do it by channelid.

Is there any other way to solve this issue?

Where does the $user[wol] array get the user's location from? I mean, where is the source code for it? Maybe we can update the code there itself and supply this array with the channel name instead of the thread title whenever the user is inside a private channel.

The page gets the actual path from the session table. A channelid isn't stored there - only the actual path.

The template is rendered in the /core/vb/api/wol.php file.

Just quickly looking at it, the Who's Online API gets a "page key" parameter.

On conversations, it's set with the following parameters:

You could probably use that to alter what's saved to the database.

Thank you for the replies. Where does the location gets written to the session table? I tried to look for it but couldn't find it.

Dumping user[pagekey] on the /online returns NULL. Will it be safe to modify it in the conversations? I think wol checks the pagekey for differentiating between online users of the same page and the online user on the whole forum.

--------------- Added [DATE]1398571797[/DATE] at [TIME]1398571797[/TIME] ---------------

Added this in conversations but it doesn't seem to work. The nodeid still gets recorded in the session table.

Huh. Suppose you could possibly do something there, too. Not sure, and I don't have the code in front of me.

I was in api/wol.php::register(). That's where it's written to the database.

You don't want to change the page key that's generated...but rather change the session information being persisted in the database.

There can be an easier of doing this. How can I search for a substring inside the $user['location'] string?

--------------- Added [DATE]1398625222[/DATE] at [TIME]1398625222[/TIME] ---------------

Finally got it working!

Replaced the following code in onlineuser_details template:with:
Now it says Viewing Private Forum for anyone who is viewing a thread inside the private forums.

There's a mistake in the above code. {vb:raw user.location} cannot be accessed by all users, so I had to replace it with {vb:raw user.wol.params.1} and the number 7 will also be replaced based on the length of the string from the beginning until the category name.