[Admin]

Replacing:

PHP Code:

if ($action=="finduser") {
  // get allowable forums:
    $forumsql=getallforumsql(); 


with:

PHP Code:

if ($action=="finduser") {
  // get allowable forums:
  if ($forumid) {
      $forumsql="forumid='forumid'";
  } else {
      $forumsql=getallforumsql();
  } 


is ok for most cases, but users will sooner or later find out they can search in any forums they want, including those they're not supposed to see.

So you need to do something a bit more complicated if you're afraid of this.