Allow Limited Usergroup Changes Through ModCP

09 July 2005 UPDATE: Changegroup.php reworked for security

Thanks to boy genius KirbyDE this file has been reworked to secure that users who aren't already in your selected groups cannot be changed by your mods (with a check on attempted overrides).

To update, simply upload the new changegroup.php file in the zip to your /modcp/ directory. No other changes/modifications need to be made.

Please post if there are any problems!

######################################

08 May 2004 UPDATE: Modified file for error reported in post #16

Please download the new file and replace the old one with it. Post if there are any problems!

######################################

Hi all!

Here is the deal with this hack. We have usergroups set up with various permissions, mostly based on limiting their functions if they abuse their rights as a member (limiting them from certain forums, putting them under moderation, etc...).

Our mods need to be able to move our members into (and out of) these restricted groups rather than banning them, but at the same time, they should not be able to move members into (or out of) the mod, admin, waiting for confirmation groups, etc...

NOTE: Banned Groups are NOT touched in this hack -- this is for all groups OTHER than those addressed by the banning function as I wanted to keep that seperate!


What this hack does:

• Add a token to each usergroup that the admin can set to say 'yes' or 'no' that the mods can move users into and out of the group.
• Adds a token on the mod permissions level -- super mods can change allowable groups by default, and regular mods can only make these changes if you assign it on a mod by mod basis.
• Adds the functionality to the ModCP for the mods to make the changes.

Changes that need to be made:

Phrases to add: 5

PHP file edits:

• admincp/usergroup.php (1 change)
• admincp/moderator.php (1 change)
• includes/init.php (2 changes)
• modcp/user.php (4 changes)

New PHP file:

• changegroup.php (attached in this zip -- upload to your modcp folder)

Included in this zip:

• Modification .txt file
• changegroup.php
• Screenies!

The screen shots below are of the ACP -- adding the tokens to the Usergroup and giving permissions to the mods.

Enjoy, and as always, if anyone has any constructive feedback, or needs any help, post away.

[Christine]

Ok -- will look at that for you. Give me a few days as I am trying to fix a few things to get 3.0.3 up.

[Spydertech]

Thanks again!!

[teksigns]

would it be possible to modify this code to add users into
a secondary usergroup rather than moving them.....

i would rather moderator be able to add secondary usergroups
and remove secondary groups .....

[House_of_Crazed]

I was thinking the same, Teksigns

*shrugs*

[Burley]

Hi Christine,

Great hack. Clicks install

But i've got some questions for you.
On my forum we have several user groups with private forums. I was thinking of using your hack to allow the mods of those forums to add and remove users from those groups (and thus from that part of the forum).

It all works, however the mod of group A can move users to group B. That should not be possible. Mods should only be allowed to grant or remove acces to their own forum.

Can you help me out with this?

[Praxin]

Nice hack - finally got around to installing it, after a few months of lazyness

One thing I had to do was an additional hack to modcp/index.php - the moderators that have access to this hack dont actually have any other 'user' mod privileges, so this was needed

Find :

if (can_moderate(0, 'canunbanusers') OR can_moderate(0, 'canbanusers') OR can_moderate(0, 'canviewprofile') OR can_moderate(0, 'caneditsigs') OR can_moderate(0, 'caneditavatar'))

and Replace with :

if (can_moderate(0, 'canunbanusers') OR can_moderate(0, 'canbanusers') OR can_moderate(0, 'canmodify') OR can_moderate(0, 'canviewprofile') OR can_moderate(0, 'caneditsigs') OR can_moderate(0, 'caneditavatar'))

Hmm - an addition to the above - I just managed to remove my own admin access using a simple, very little access, mod account. Whereas this isnt a problem for my boards because the only mods with this access are within easy reach if they do mess something up, this could be a problem for boards which may have a disgruntled mod.

There are no checks in changegroup.php at all to check what group the user being moved is a member of.

[Praxin]

Also, this mod completely ignores the unalterable users feature

[Christine]

Hi all,

My apologies -- I have been traveling and totally forgot about the request for secondary groups. I will look at that this week.

Praxin, I am not sure what you are referring to, but in the hack, each usergroup can be set in the ACP as 'modifiable' or not. If you set Admins to not be modifiable, then admins will not be able to be changed by mods and additionally, the option to change someone into an admin will not be an option for mods.

[Praxin]

As per attached - admin usergrp is set to no, and it is ignored

[Christine]

Hi Praxin,

Can you screen shot the dropdown in the mcp for usergroup changes?