Allow Limited Usergroup Changes Through ModCP

09 July 2005 UPDATE: Changegroup.php reworked for security

Thanks to boy genius KirbyDE this file has been reworked to secure that users who aren't already in your selected groups cannot be changed by your mods (with a check on attempted overrides).

To update, simply upload the new changegroup.php file in the zip to your /modcp/ directory. No other changes/modifications need to be made.

Please post if there are any problems!

######################################

08 May 2004 UPDATE: Modified file for error reported in post #16

Please download the new file and replace the old one with it. Post if there are any problems!

######################################

Hi all!

Here is the deal with this hack. We have usergroups set up with various permissions, mostly based on limiting their functions if they abuse their rights as a member (limiting them from certain forums, putting them under moderation, etc...).

Our mods need to be able to move our members into (and out of) these restricted groups rather than banning them, but at the same time, they should not be able to move members into (or out of) the mod, admin, waiting for confirmation groups, etc...

NOTE: Banned Groups are NOT touched in this hack -- this is for all groups OTHER than those addressed by the banning function as I wanted to keep that seperate!


What this hack does:

• Add a token to each usergroup that the admin can set to say 'yes' or 'no' that the mods can move users into and out of the group.
• Adds a token on the mod permissions level -- super mods can change allowable groups by default, and regular mods can only make these changes if you assign it on a mod by mod basis.
• Adds the functionality to the ModCP for the mods to make the changes.

Changes that need to be made:

Phrases to add: 5

PHP file edits:

• admincp/usergroup.php (1 change)
• admincp/moderator.php (1 change)
• includes/init.php (2 changes)
• modcp/user.php (4 changes)

New PHP file:

• changegroup.php (attached in this zip -- upload to your modcp folder)

Included in this zip:

• Modification .txt file
• changegroup.php
• Screenies!

The screen shots below are of the ACP -- adding the tokens to the Usergroup and giving permissions to the mods.

Enjoy, and as always, if anyone has any constructive feedback, or needs any help, post away.

[Praxin]

Here ya go

[BlasterT3]

Christine, i think this is a great hack and is perfect for my rpg mod. my sugestion and request to you is be able to select what mods can control what editable usr groups

[Christine]

Originally Posted by Praxin

Here ya go

Praxin, I am not seeing that the admin is an eligible group in this shot.

Applicant, Guild Members and Registered are the only options.

With that, how are mods able to change someone to admin status??

[Christine]

The vB recently anounced Critical Update is affected by this hack.

Please go to:

http://www.vbulletin.com/forum/showthread.php?t=125480

And download the 3.0.5 init.php file ASAP to plug this vulnerability.

You will need to modify that file in order to run this hack.

In the new init.php, please make the following changes:

Find: (line 792 in a clean file)

PHP Code:

'isbannedgroup'         => 32 


Replace with:

PHP Code:

 'isbannedgroup'         => 32,
 'ismodifiablegroup' => 64 


Find: (line 844 in a clean file)

PHP Code:

    'caneditreputation'     => 4194304 


Replace with:

PHP Code:

     'caneditreputation'     => 4194304,
 'canmodify' => 8388608 


[Praxin]

Originally Posted by Christine

Praxin, I am not seeing that the admin is an eligible group in this shot.

Applicant, Guild Members and Registered are the only options.

With that, how are mods able to change someone to admin status??

I didnt say they can change someone to admin status, they can change someone FROM admin status to one of the listed groups

[Christine]

Apologies -- I see what you are saying. Let me take a look at that.

[mrcrx]

ok, I got it working with some help. But now when I try to do a search for a user in my admin control panel the screen is blank. If i go out and back in I get the normal screen but then it goes to the smaller screen and I dont have the ability to change anything on the user from one screen. I can only do it with the links. Do I have to turn someting off or on? Thanks rob

[Watson]

Cheers for this, great addition for my using Miserable Users hack

[Watson]

just to clarify, I installed this again.

Only my super mods can edit user groups, so how would I go about giving this access to my mods also?

I can only see the group is modifiable option, not the group can modify groups option

Watson

[mustang_lex]

What usergroups are the moderators able to switch users from?

Thank You