[kh99]

Originally Posted by NachoTPAO

I want to be able to disable the password recovery function for staff members so that he can't use this method.

You can do that with a plugin. For instance you could do this (using a hook like global_setup_complete):

if (THIS_SCRIPT == 'login')
{
   $vbulletin->input->clean_gpc('r', 'a', TYPE_STR);
   if ($vbulletin->GPC['a'] == 'pwd' OR $_REQUEST['do'] == 'resetpassword')
   {

	$vbulletin->input->clean_array_gpc('r', array(
		'userid'       => TYPE_UINT,
		'u'            => TYPE_UINT,
		'activationid' => TYPE_STR,
		'i'            => TYPE_STR
	));

	if (!$vbulletin->GPC['userid'])
	{
		$vbulletin->GPC['userid'] = $vbulletin->GPC['u'];
	}

	if (!$vbulletin->GPC['activationid'])
	{
		$vbulletin->GPC['activationid'] = $vbulletin->GPC['i'];
	}

	$userinfo = verify_id('user', $vbulletin->GPC['userid'], 1, 1);

	if (is_member_of($userinfo, 5, 6, 7))
	{
		$user = $db->query_first("
			SELECT activationid, dateline
			FROM " . TABLE_PREFIX . "useractivation
			WHERE type = 1
				AND userid = $userinfo[userid]
		");

		if (!$user)
		{
			// no activation record, probably got back here after a successful request, back to home
			exec_header_redirect($vbulletin->options['forumhome'] . '.php');
		}

		if ($user['dateline'] < (TIMENOW - 24 * 60 * 60))
		{  // is it older than 24 hours?
			eval(standard_error(fetch_error('resetexpired', $vbulletin->session->vars['sessionurl'])));
		}

		if ($user['activationid'] != $vbulletin->GPC['activationid'])
		{ //wrong act id
			eval(standard_error(fetch_error('resetbadid', $vbulletin->session->vars['sessionurl'])));
		}

		// delete old activation id
		$db->query_write("DELETE FROM " . TABLE_PREFIX . "useractivation WHERE userid = $userinfo[userid] AND type = 1");

		$newpassword = fetch_random_password(8);

		eval(fetch_email_phrases('resetpw', $userinfo['languageid']));
		vbmail($userinfo['email'], $subject, $message, true);

		eval(standard_error(fetch_error('resetpw', $vbulletin->session->vars['sessionurl'])));
	}
   }
}

It's just the code that would normally get called when you click on the emailed link, but if you're a member of groups 5, 6, or 7, it does everything except the actual changing of the password. I kind of like that because if someone tries it they'll probably get frustrated wondering why it isn't working. But if you prefer a message saying that you can't do it at all, then you could just do something like this:

if (THIS_SCRIPT == 'login')
{
   $vbulletin->input->clean_gpc('r', 'a', TYPE_STR);
   if ($vbulletin->GPC['a'] == 'pwd' OR $_REQUEST['do'] == 'resetpassword')
   {
	$vbulletin->input->clean_array_gpc('r', array(
		'userid'       => TYPE_UINT,
		'u'            => TYPE_UINT,
		'activationid' => TYPE_STR,
		'i'            => TYPE_STR
	));

	if (!$vbulletin->GPC['userid'])
	{
		$vbulletin->GPC['userid'] = $vbulletin->GPC['u'];
	}

	$userinfo = verify_id('user', $vbulletin->GPC['userid'], 1, 1);

	if (is_member_of($userinfo, 5, 6, 7))
	{
            eval(standard_error(fetch_error("Forum staff members are not allowed to use this function.")));
        }
   }
}

If you decide to try one of these you'll probably want to test it.