Multiple account login detector (AE Detector)

If you are like me and migrated from .threads, a common modification was an "AE detector", a simple mod that saved a cookie of a history of ids logged into on your site. If someone logged into more than one account, you got a PM letting you know that your site was being accessed from multiple accounts.

Over the years this was very helpful in identifying users who were posting under multiple accounts (alter-egos!) and users who would return after being banned.

You might be wondering why I don't use the vbcookie call - well, thats because on logout all vB cookies are cleared, so we need to store a cookie that is not effected by the login/logout process.

New Installation
1. Add New Product with attached XML
2. Go to vBulletin Options -> AE Multiple Login Detection Settings and set your specific settings.

Time to install: Easy - 2 minutes.

Upgrade
If you installed this as a Plug-in manually, you can delete that plugin and install this Product, just make sure to go into the Options and set them accordingly.

I hope you find this useful and will click INSTALL if you use it; should it prove useful to enough people I can look at making this installation more automated without the need for edits and an Admin Options page.

To upgrade you will want to reimport this XML file and edit your options accordingly.

1.0.3
-----
. Added a check to ensure that users weren't deleted when reporting violations
. added htmlspecialchars_uni call to username

Note: I am unable to get the call to construct_phrase with $vbphrase['multiplelogin_alert'] to work reliably, as such the $message variable is still set manually inside the plug-in and not via the phrase. If anyone has an idea of why this might not always work, I'm all ears.

1.0.2
-----
. Updated to include exclusion groups, users
. Changed so PM is sent by ae sender id

1.0.1
-----
. Released as a Product (thank you PHPGeek2k3 for your help)
. Added option to post to a forum versus send a PM (or both)
. All settings moved into Admin Option

1.0.0
-----
Initial release.

[Quarterbore]

Well, I figured it out... and man is this UGLY!

My problem is that I did a fresh install of vB 3.6 and I used Impex to IMPORT all of my forums, threads, and users! Well, a sizable percentage of my users userid CHANGED!

So now, these users have the old cookie from the old site on their systems PLUS the cookie for the new software. I assume that once everybody visits the updated forums that these errors will stop happening but with over 2000-members I may get these crazy errors for quite some time.

I know that the maximun shift I saw in userid was 4 so I may code the system to ignore userids that are 4 or less apart. This really hurts as this was a very handy tool!

[MPDev]

Well, that would do it. If they logged in under the old system and it has their userid recorded; then that would be a problem for you.

[Quarterbore]

Can I please request a little programing help with my issue?

I know that my members USERID behaves in a VERY predictable way when comparing the original userid to the new userid. Here is the breakdown:

If USERID is # - then I want the system to ignore...

(788 or less) (ignore Userid+1 as a duplicate)
(789 to 960) (report any duplicates)
(961 to 1550) (ignore Userid-1 as duplicates)
(1551 to 1762) (ignore Userid-2 as duplicates)
(1763 to 1843) (ignore Userid-3 as duplicates)
(1844 or higher) (report all duplicates!)

Now, I know this code is done by the "Login Checker" plugin and the code I need to add these conditional is here:

PHP Code:

if( empty($idstack) )  
                    {  
                        $idstack = ",{$vbulletin->userinfo['userid']},";  
                        setcookie("IDstack", $idstack, time()+10368000, "/");  
                    }  
                    else  
                    {  
                        if(!strstr($idstack, ",{$vbulletin->userinfo['userid']},"))  
                        {  
                            $idstack .= ",{$vbulletin->userinfo['userid']},";  
                            setcookie("IDstack", $idstack, time()+10368000, "/");  
      
                            $Unums = split(",", $idstack);  
                            $andids = null;  
                            $numvs = 0;  
                              
                            for ($i = 0; $i < (sizeof($Unums)); $i++)   
                            {  
                                if( verify_id('user', $Unums[$i], FALSE, -1, -1) )  
                                {  
                                    if (!empty($Unums[$i]) && is_numeric($Unums[$i])) {          
                                        $checkuser = $vbulletin->db->query_first("SELECT username FROM " . TABLE_PREFIX . "user WHERE userid={$Unums[$i]}");  
                                        if ( !empty($andids) ) $andids .= "and";  
                                        $andids .= " [url=". $vbulletin->options['bburl'] ."/member.php?u=" . $Unums[$i] . "] ". $checkuser['username'] ."[/url] ";  
                                        $numvs++;  
                                    }  
                                }  
                            }  
                              
                            // Make sure we have at least 2 valid user violations  
                            if ( $numvs < 2 ) return;  
                              
                            $allowsmilie = '1';  
                            $visible = '1'; 


Now, would the best way for me to fix my self induced problem be to write a series of conditional like this:

PHP Code:

// Adjust for IMPORT ID issue
$loggedinuser = $vbulletin->userinfo['userid'];
if (!empty($Unums[$i]) && is_numeric($Unums[$i])) { 
     If ($loggedinuser <= 188 AND $loggedinuser == Unums[$i] + 1){$numvs--;}
     If ($loggedinuser >= 961  AND $loggedinuser <= 1550 AND $loggedinuser == Unums[$i] - 1){$numvs--;}
     If ($loggedinuser >= 1551  AND $loggedinuser <= 1762 AND $loggedinuser == Unums[$i] - 2){$numvs--;}
     If ($loggedinuser >= 1763  AND $loggedinuser <= 1843 AND $loggedinuser == Unums[$i] - 3){$numvs--;}
} 


I assume that I have the variables figured out but this will be really hard fro me to test on my live site to figure out if it is eliminiatig the correct accounts! I addedd this right above the "// Make sure we have at least 2 valid user violations "

EDIT - FWIW, there is a bug in that code as I just tried it... It have me a syntax error as well as a headers resent error and I had to disable pluggins to remove the pluggin from my system. I still think the basic concept may work but this is not the right place or way to do it!!!

I'll update if I figure this out but from my count this impacts about 1700 members on my site so dealing with that many alerts is a huge problem!

[markblair]

Originally Posted by NeitherSparky

All right - I have installed this in 3.6.0 and it is working. For some reason though, while it is successfully sending a post to my Staff forum it is NOT sending me a PM even though I have specified Send PM on Multiple Login Detection=Yes (can it not do both?). Otherwise it is fine.

edit: Figured out what I did wrong, it should be fine now.

What was causing this issue? I am having the same problem. I'm getting the new thread but no PM is being sent. And both options are turned on.

[Nick0r]

For me it's not creating a thread, no matter what - never worked in 3.5 either for some reason.

[NeitherSparky]

Originally Posted by markblair

What was causing this issue? I am having the same problem. I'm getting the new thread but no PM is being sent. And both options are turned on.

I took a screencap of my settings, not only to answer your question but hopefully to help people having trouble getting the thing to create a thread too.

The reason the PMs weren't working was simple enough - the default setting for the "Users who recieve the PM upon multiple login detection" is "Administrator" and my username on my forum isn't "Administrator", its Sparky! So I just changed that.

As for the thread creation, you have to mark "Enable New Thread Creation on Multiple Login Detection?" - Yes, and then put in the correct "ForumID For AE Multiple Login Detection reports", AND set the "Userid of who PM sender / Alert poster" to someone who has permission to post in that forum - 1 being of course myself (the target forum is a Staff forum). For the users to ignore, I have myself and my test account, which is number 2.

I hope this helps *somebody*. :P

[MPDev]

Since we have alot of people (including myself) who have it working on 3.5 and 3.6, if you cannot get it to work you probably did one of the following: installed it incorrectly, have the setting set wrong or have something installed that is interfering with our app (although we have no known plugins that do this).

[voteforbird]

Will this work with 3.6.0? Thanks.

[Mattikana]

Originally Posted by voteforbird

Will this work with 3.6.0? Thanks.

It works for me on 3.6 Gold, I have the PM report enabled and the thread rpeort disabled.

[cyclical]

I am still getting false positives...