[R-D]

Originally Posted by mechanist

Once the URL and the syntax for calling this addOn is public, everybody can abuse this redirector. This addOn does not check if the user is a valid member of the board. Is there any option to verify the user rights before the redirect will start ?
So far I can see, a few "guests" start using the redirect plugin.
Give it a try:
1. log out from vbulletin
2. try YOUR VBULLETIN BOARD URL/redirector.php?url=YOUR TARGE URL

Even without being logged on, you can use and off course abuse the redirect plugin.

Open redirector.php
Find:

// check for script path

Add above:

if (!$vbulletin->userinfo['userid'])
{
	print_no_permission();
}

That forces guests to login before they can use the redirector.php page. Doesn't stop them from seeing and copying the target link directly from the URL though
(eg. http://www.mysite.com/redirector.php?url=http://www.yoursite.com).

I added that as people were just copying my redirector.php URLs onto other sites. As I don't add ads, there was no point in letting them get away with that.