Password Protected Forums (vB3 Style)

-/\-/\-/\-/\-/\-/\-/\-/\-/\-/\-/\-
Password Protected Forums (vB3)
By Shaolyen
email: John@eovie.com
msn: John@eovie.com

TESTED ON A FRESH vB 2.3.0
-\/-\/-\/-\/-\/-\/-\/-\/-\/-\/-\/-

Introduction
-----------------------------------------------------------
This hack is fairly simple in what it does.

If a user tries to access a password protected forum, they will be
prompted for the password. Once entered correctly they'll be able
to browse the forum as normal. It's as simple as that!

There are a few extras in this. When a user enters a password and
it's verified as being correct, a cookie is sent to their PC
containing the password. This will ensure that they don't need to
log in every time they access the protected area, until the cookie
expires.

The cookie timeout time for each protected forum can be set in the
AdminCP. (You can choose anything from 1 minute to 1 year.)

Password protected forums are denoted by the text
"[Password Protected]" tagged on the end of the forum description.
If you don't have a forum description for your password protected
area, "[Password Protected]" will take its place.

Please bear in mind:
? Threads will appear in searches, but the title, author, etc. are
all set to "Restricted". A password is needed to access these threads.
? The password in the cookie IS NOT ENCRYPTED. This is for a
reason, so the password can be viewable in the AdminCP. If
anyone would prefer MD5 encryption in their cookies, let me know.
? In the very near future I will be adding on options to enable
MD5 encryption.
? When you specify "Regular Forum Security" in the AdminCP and
a password has been entered, that password will not be recorded.

Security level, password, and timeout times can be specified when
creating or editing a forum.
(AdminCP > Forums & Moderators > Add | Modify)


Warning
-----------------------------------------------------------
BACKUP YOUR DATABASE AND FORUM FILES BEFORE YOU EVEN THINK ABOUT APPLYING THIS HACK!
-----------------------------------------------------------

Shameless Plug
-----------------------------------------------------------
This hack was written for the fine people at xAviaHosting -
www.xaviahosting.com. Pay them a visit (Or I'm a dead man!)
-----------------------------------------------------------

Shameful Plea
-----------------------------------------------------------
I'm poor as always, I'd be seriously grateful for any donations..!
If you have a few spare pennies in that Paypal account, my address
is "John@eovie.com" - share the wealth!
-----------------------------------------------------------

Screenshots:
-----------------------------------------------------------
Password protected indicator
Password prompt
AdminCP Settings
Search results 1
Search results 2
-----------------------------------------------------------

Update 1.0 > 1.1
-----------------------------------------------------------
? Search blocking enabled.
Screenshots:
Search results 1
Search results 2

Available here
-----------------------------------------------------------

[Almax]

05-11-03 at 08:48 PM tomsch said this in Post #86
i have 2 problems with this

first is i can't change the password once its set or anyting else for that matter it just won't update those feilds



Password protection enabled, yet no password was submitted.
(Forum access can be gained by leaving the password field blank on entry.)
Record updated!


thats what it says when i try to update for some reason the password var is not being set




and the second it would appear the once a user has a cookie you can access the forum without entering the pass and after the time out period i had mine set for 60 mins i waited 2 days and was able to get access

any ideas for a fix??

And the exact same here
and if its register_globals on/off
how do i turn them on/off ?

[nefarious]

Installed Xiphoid's fix with amp2000's changes and it still doesn't work.

I am still able to enter a bogus password, hit the back button and then refresh and you can get in...

Any clues on how to fix this?

[SemperFidelis]

Cheers for the fix amp2000

[nefarious]

I have installed the 'fixes' but I can still get in without a password.

If you enter a wrong password you get a second chance to enter one, OK so far, but if you now hit the back button and then the refresh, bingo you are in ...

[tomsch]

same prob here. i did notice that no cookie was sent. so i'm guessing a null check might be needed???

anyone have an idea??

:disappointed:

[Smoothie]

If you enter a wrong password you get a second chance to enter one, OK so far, but if you now hit the back button and then the refresh, bingo you are in ...

yep, exactly the same problem I reported way back. Had to uninstall, its worthless as is.

[dano]

Well that sucks, I was going to install this today

[MentaL]

gonna test on 2.9..

[MentaL]

works

[Shepski]

has anyone managed to figure out a solution to the refresh to enter forum problem. I want to install this hack but cant if this problem exists as it wont take users long to find out the bypass