Simple vB User login and access control on non vB pages

Hack Description

This is a cutdown version of the user authentication and access control system I use on the non vB pages on my website.

This uses the vB 3.5 login system to log you in and out. It allows you to move between your forums and other pages on your site while remaining logged in.

It allows you to do things such as restrict pages by usergroup, display different content depending on a user being logged in or not.
For example, you can have banner Adds displying to non members only, and/or let members access to specific content.

Ive cut it down to the bare minimum that it needs to work, no fancy stuff such as avatars, PM's, or even formating.

I will try and offer support, but work and family commitments mean I dont have much free time.

This code is a mix of my own, and pieces I have used from other hacks that are floating around.

This script has been confirmed as working on

• vB 3.5.x - All Versions

Changelog

Version 1.30 (24th April 2007)

• Fixed - // in paths bug
• Fixed - Javascript warning in some browsers
• Fixed - Tidied up some code

Version 1.20 (2nd December 2006)

• Fixed Logout incorrect path bug
• Made change to reduce compatibility problems with foreign scripts

Version 1.10 (4th Feb 2006)

• Changed login_inc.php so you only need to edit path in one place now.
• Added more commenting to login_inc.php
• Added usage instructions to instructions file
• Added troubleshooting guide with all common problems and fixes to instructions file.

Note: It is NOT necessary to update from 1.0 to 1.10.
There is no functionality changes or bug fixes between these 2 releases.

Version 1.0 (17th November 2005)

• Initial Release

Deluxe Version of this hack is now available
Has Avatars, PM's, Number of Posts etc.

Click Here


Click on Install
If you have this script installed then please click on the install link because;

• You will get notified if any security issues are reported.
• You will get notified when there are any upgrades to this script
• It gives me a warm fuzzy feeling and motivates me to develop more

Donations
First of all, to be clear. This script is 100% free.

However if you feel an urge to donate I'm not going to say no.
Donations can be made at http://www.billspaintball.com/vb3/bd_donate.php

[Billspaintball]

Originally Posted by Paris Holley

does not work in 3.6 rc2, including global.php causes scripts to become unresponsive

*nvm*

was a cookie conflict

You had me worried.
I went and upgraded my test site to 3.6 rc2 straight away.
All still running fine on rc 2

[Billspaintball]

Originally Posted by lightnb

I'm having an issue where including global.php causes my main script to stop functioning.

I've commented out your code, line by line to locate the problem, and my script works until I allow global.php to be called.

At that point, all of the links on the page stop working (the login box works fine).

It is a search results page, and the links are in this format:

PHP Code:

<a href="<?=$PHP_SELF?>?query=<?=$query?>&page=<?=$page?>&limit=5">5</a>

Any idea why global.php interferes with the functionality of these links?

Thanks,

Nick

Global may be using the variables $query and/or $page.
Put a simple echo statement on your page to see if those values are what you expect them to be.

[Evoir]

Billspaintball, First, thanks for writing this script and giving everyone a hand with it. I'm hoping that you can help me figure out what's going on.... I am unable to get it to work. I've read the troubleshooting guide and tried everything, and read all 12 pages of this thread. One other person was having this exact trouble, too, but it didn't seem to get resolved. Oh, I am using an IP address because the site is not live yet, it is in development. There are no subdomains.

Here's what happens.

I uploaded the file to here and I get the standard vB login screen. When I login, I get redirected to http://69.5.17.244/login.php, which produces an error because that file does not exist.

If I am logged in before I go to the above url, I see the actual html as if I am logged in. If I logout, I get redirected to vB logout screen. I click "return to previous screen" and I get sent to a standard vB login. When I attempot to login, I get redirected to /login.php which doesn't exist. (loop)

I have used your little script that gives you the path, and am using that path in the scripts below. I have tried changing the cookie path etc in your troubleshooting guide. I am really hoping to be able to use your script to limit access to non vB pages based on usergroup.

Here's my code (using your test code with my paths):

<?php 
chdir('/big/dom/xc5children/www/forums'); 
require_once('/big/dom/xc5children/www/forums/global.php'); 
?> 
<html> 
<body> 
<?php
if ($vbulletin->userinfo['usergroupid'] == '6' )
    {
    echo "This is only visible to people in usergroup 6";}
    ?> 

<?php 
    require_once('/big/dom/xc5children/www/login_inc.php'); 
?> 
</body> 
</html>

and login_inc.php

<?php
// Edit the line below to show path to your forums
$forumpath = "/big/dom/xc5children/www/forums";


// You dont have to edit anything underneath here,
// but you can if you wish to style the login box
// to match the style of your site.


// We check if user is logged in
if ($vbulletin->userinfo['userid']!=0) {

// If Logged in display welcome back message
echo "Welcome Back, <b>";
echo $vbulletin->userinfo['username'];
echo " !</b><br>";

// If logged in display logout link
echo "<a href=\"".$forumpath."login.php?$session[sessionurl]do=logout&amp;logouthash=$logouthash";
echo $vbulletin->userinfo['logouthash'];
echo "\">";
echo "<font size=\"1\" face=\"verdana\">Log Out</font></a>
";

} else { // If user is not logged in, we do this stuff

// Display text and link to register.
echo "
	You have to <a href=\"".$forumpath."/register.php?s=$session[sessionhash]\"
	target=\"_parent\"><b>register</b></a>  before you can post on our forums or use our advanced features.
	";

// Display login boxes + button
// You can style this with html or CSS as normal if desired.
echo"
	<form action=\"".$forumpath."/login.php\" method=post onsubmit=md5hash(vb_login_password,vb_login_md5password,vb_login_md5password_utf)>
	<script type=text/javascript src=\"".$forumpath."/clientscript/vbulletin_md5.js\"></script>
	User Name:<br>
	<input name=vb_login_username type=text id=navbar_username onfocus=if (this.value == '$vbphrase[username]') this.value = ''; size=10 />
			
	<br>Password2:<br>
	<input name=vb_login_password type=password size=10 />
	</br>
		
	<label for=cb_cookieuser_navbar><input name=cookieuser type=checkbox id=cb_cookieuser_navbar value=1 checked=checked />
	Remember Me?<br /></label>
	
		
	<input type=submit title=$vbphrase[enter_username_to_login_or_register] value=\"Log In\" />
		
	<input type=hidden name=s value=$session[sessionhash] />
	<input type=hidden name=do value=login />		
	<input type=hidden name=vb_login_md5password />
	<input type=hidden name=vb_login_md5password_utf />

	</form>
";

}
?>

[StriderX7]

The scripts works well but I have a slight problem.

I've installed the login box on my Joomla page as a module and it works fine for the most part. It logs in ok and shows the "Please Wait While We Transfer You" screen on my forum. Then when it does redirect me it still has the login form there instead of the "Welcome Back, USERNAME" message.

I know that it does log me into the forum properly though because I created a Joomla vBulletin Who's Online module and that shows the username as online.

HELP!

[Billspaintball]

In then login_inc.php file, what happens if you change // Edit the line below to show path to your forums
$forumpath = "/big/dom/xc5children/www/forums"; to a full url.
For example
$forumpath = "http://www.yoursite.com/forums/";

Originally Posted by Evoir

Oh, I am using an IP address because the site is not live yet, it is in development. There are no subdomains.

I wonder if that messes with the cookies causing the loop.

[Billspaintball]

Originally Posted by StriderX7

The scripts works well but I have a slight problem.

I've installed the login box on my Joomla page as a module and it works fine for the most part. It logs in ok and shows the "Please Wait While We Transfer You" screen on my forum. Then when it does redirect me it still has the login form there instead of the "Welcome Back, USERNAME" message.

I know that it does log me into the forum properly though because I created a Joomla vBulletin Who's Online module and that shows the username as online.

HELP!

That sounds like a cookie problem.
Have you tried the troubleshooting on post 2 yet?

[Evoir]

Billspaintball,

Thanks for the quick support. I appreciate it!

It does seem like a path issue, because it is not recognizing the forums path, and is redirecting to /login.php instead of /forums/login.php for the redirect.
It should not be showing the standard vB login, but rather the more simple login that is located in login_inc.php, right?

Originally Posted by Billspaintball

In then login_inc.php file, what happens if you change // Edit the line below to show path to your forums
$forumpath = "/big/dom/xc5children/www/forums"; to a full url.
For example
$forumpath = "http://www.yoursite.com/forums/";

I tried this (but using the IP address http://69.5.17.244/forums/) and no go.

I have tried multiple cookie settings in vB...

Path to Save Cookies "/"
Cookie Domain "blank"

but I have also tried other combinations. I should not be seeing the standard vB login, right?

[Evoir]

Aha! I found out what the problem was! I had my forums to not allow unregistered users to view the forums. So, vB was kicking in it's login before your login_inc.php could kick in. Then, on login_inc.php I had to change the
forumpath:

// Edit the line below to show path to your forums
$forumpath = "/forums/";

This works just fine.

I'd prefer to have the forum hidden from everyone except registered users within certain usergroups. But, I think that is incompatible with this script. IS there a way around this?

[StriderX7]

Originally Posted by Billspaintball

That sounds like a cookie problem.
Have you tried the troubleshooting on post 2 yet?

Yep, my settings are already how the troubleshooter says they should be

[lightwave]

How do I make this work across different subdomains?