[Logician]

Originally posted by rochen
http://yoursite.com/forum/misc.php?action=iamacustomer&user=username ? So they don't need to login or whatever after...

it wouldnt be a good idea since you can put others username there..

Most people has already set cookies on in the forum settings and if this is the case, they wont need to login when they visit that page. (I assume the username you refer is vb username?)

also is there anyway I can check the refer of the "iamacustomer" to stop anyone just putting the link in their browser? For example if refer = xyz.com OK if not then NOT OK... ?

I was expecting this question.. :glasses:

Referrer is not a secure enough mainstay as it can easily be manipulated. If you want to secure the dir you have to check another criteria of the visitor which you can count more. I dont know what this would be for your site.

But if you still want the referrer check anyway, here is how:
edit global.php (in forum dir, not admin dir)

right after <?php add:

PHP Code:

$log_referrer=getenv('HTTP_REFERER'); 


Then in the hack code you can check it like:

PHP Code:

if ($log_referrer!="your url here") {show_nopermission();} 


This is not tested and I dont know how good it will work but this is the general algorithm for referer page check..

Regard my suggestion above..

Enjoy..

@mist: yw but IMO following an URL for usergroup change is not the best solution for you.. Check this solution for making it password/special user profile field based.. Should fit better to your needs..