Simple vB User login and access control on non vB pages

Hack Description

This is a cutdown version of the user authentication and access control system I use on the non vB pages on my website.

This uses the vB 3.5 login system to log you in and out. It allows you to move between your forums and other pages on your site while remaining logged in.

It allows you to do things such as restrict pages by usergroup, display different content depending on a user being logged in or not.
For example, you can have banner Adds displying to non members only, and/or let members access to specific content.

Ive cut it down to the bare minimum that it needs to work, no fancy stuff such as avatars, PM's, or even formating.

I will try and offer support, but work and family commitments mean I dont have much free time.

This code is a mix of my own, and pieces I have used from other hacks that are floating around.

This script has been confirmed as working on

• vB 3.5.x - All Versions

Changelog

Version 1.30 (24th April 2007)

• Fixed - // in paths bug
• Fixed - Javascript warning in some browsers
• Fixed - Tidied up some code

Version 1.20 (2nd December 2006)

• Fixed Logout incorrect path bug
• Made change to reduce compatibility problems with foreign scripts

Version 1.10 (4th Feb 2006)

• Changed login_inc.php so you only need to edit path in one place now.
• Added more commenting to login_inc.php
• Added usage instructions to instructions file
• Added troubleshooting guide with all common problems and fixes to instructions file.

Note: It is NOT necessary to update from 1.0 to 1.10.
There is no functionality changes or bug fixes between these 2 releases.

Version 1.0 (17th November 2005)

• Initial Release

Deluxe Version of this hack is now available
Has Avatars, PM's, Number of Posts etc.

Click Here


Click on Install
If you have this script installed then please click on the install link because;

• You will get notified if any security issues are reported.
• You will get notified when there are any upgrades to this script
• It gives me a warm fuzzy feeling and motivates me to develop more

Donations
First of all, to be clear. This script is 100% free.

However if you feel an urge to donate I'm not going to say no.
Donations can be made at http://www.billspaintball.com/vb3/bd_donate.php

[Billspaintball]

Originally Posted by beejeebers

How would I pull the password value out before it gets encrypted?

You cant see the actual vB password from vB, it is encrypted.

Spose you could use vb_login_password but if you start using that all over your site it will be a security weakness.

[ViperCC]

Originally Posted by ApplePro

Hello guys,

When I run sample script (test.php), I'm getting an error about headers:



I've checked script and there are no spaces before first 4 lines of code.

By the way, I see this only when I logged out. When I logged in (through vBulletin), I see this:



How can I fix this?

PS: I have lastest vBulletin version installed. And the installation is fresh (just one thread).

You need to either disable error output (which should be done on all Production level machines), or you need to reduce the errors that PHP reports (Notices aren't really errors, and don't really need to be logged on a production system. They're good for development.)

You'll either need to edit your php.ini file (requires root access to the machine), set a flag in your .htaccess file, or even set the config option in your PHP somewhere with ini_set().

Reference PHP's error logging manual for more info: http://us2.php.net/manual/en/ref.errorfunc.php

[ViperCC]

I'm having some issues using this, wondering if anyone else is seeing the same.

When global.php is included, I get the following fatal error:

Fatal error: Call to a member function query_first_slave() on a non-object in /home/jay/web/web/forum/includes/functions.php on line 1178

The line of code it's trying to run starts as follows:

$user = $vbulletin->db->query_first_slave("

This is in the "fetch_userinfo" function. It seems that the db object isn't being instantiated properly. I'll dig around some and see if I can't figure out what's wrong, just wanted to post a message first. This is in VB 3.6.7 PL1.

[ViperCC]

I believe I found my issue. I was putting the initialization code inside a class in my script. This was causing the "global $vbulletin;" bit inside VB's functions to lose the $vbulletin object's context. Would certainly be nice to see VB goto more OO based code, that functions.php file is crazy! 5261 lines!

[brandondrury]

Here's a new update to my problems with the hack redirecting to the forum/index.php every single time in Firefox.

I started programming a new site back in May in which I used this mod for well over 50 external php pages. It worked great with both IE and Firefox. Then just today (just days before the site launch) it begins the problems with Firefox again.

I had (stupidly) changed my URL in admincp from domain.com/forum to domain.com/forum/ (I didn't notice the message that said "do not use a /").

Because I had made several changes in the admin, I didn't realize what I had done. I noticed my links pointing to the forum with the system had two slashes // in them. I just went in and removed one of the slashes.

So now I've figured out what I have done and have tried changing them back to the way they originally worked and Firefox has decided to start it's old antics again. It now redirects to the forum/index.php every single time.

Brandon

[thegabriel]

I want to integrate my CMS written in smarty coding with VBulletin. I implemented the above code and it was working fine with the sample script. But when I try to integrate it with my CMS, I am not able to access the session variable value when I am return back to CMS. The session is still active in VBulletin and I am able to browse through the forum.

I tried the settings suggested in this thread about how I should change the cookie path settings. Wondering if anyone could help me figure out where I am going wrong.

[HaCaoChien]

I got this message:

Warning: array_keys() [function.array-keys]: The first argument should be an array in /includes/functions.php on line 4840

Warning: preg_replace() [function.preg-replace]: Empty regular expression in /includes/functions.php on line 4840

How can I fix it?

[HaCaoChien]

That warning alway show if user do not loged in. When loged in (from board or sth like that), every thing is ok

[F4Flake]

Ok, after messing around with this for ages wondering why it appeared to work and not work I realised that .....

If you're running your forum on a localhost test server... apache doesn't handle the cookies correctly....

anyone any ideas how I can force my localhost to do the cookies?

sorted... don;t worry.

[Ezo]

$_GET
doesn't seem to stack with this mod..