Deluxe vB User login and access control on non vB pages

Hack Description

This is the deluxe version of the user authentication and access control system I use on the non vB pages on my website.
For the simple no frills version look here.

This uses the vB 3.5 login system to log you in and out. It allows you to move between your forums and other pages on your site while remaining logged in.

It allows you to do things such as restrict pages by usergroup, display different content depending on a user being logged in or not.
For example, you can have banner Adds displying to non members only, and/or let members access to specific content.

It also displays the logged in users Avatar, number of unread PM's, New posts since last visit, total posts and total threads.
It also allows you to specify a maximum Avatar size, and resize any avatars larger than that, while keeping their height/width ratios in proportion!
Its very handy if you allow large avatars, but want a small format display on your non forum pages.

If the user is not logged in, a login box is displayed, along with total posts and total threads in the forums.

I will try and offer support, but work and family commitments mean I dont have much free time.

This code is a mix of my own, and pieces I have used from other hacks that are floating around.

This is a work in progress and currently a beta version. It was a little rushed as a few people were pushing for it Its missing a couple of planned things like newest member etc, but they will be added in a later version.

This script has been confirmed as working on

• vB 3.5.x - All Versions
• vB 3.6.x - All Versions

Known Bugs
Will not display Avatars correctly if they are kept in the file system (database avatars are fine)

Changelog

Version 2.20 (24th April 2007)

• Fixed - // in paths bug
• Fixed - Javascript warning in some browsers
• Fixed - Tidied up some code
• Fixed - Avatar display code bug

Version 2.10 (4th June 2006)

• Fixed - "MySQL Error : Invalid SQL " when using Database thread/forum marking.
• Fixed - Javascrip error in some versions of IE.

Version 2.00 (16th April 2006)

• Fixed - "MySQL Error : Unknown column 'newposts' in 'field list' "
• Fixed - Number of PM's not displaying in all installs.
• Added - Displays date and time of last login.
• Added - Total number of saved PM's.

To upgrade just overwrite the existing login_inc.php file with the new one.
You will need to re-edit the path on line 3 and also redo any formatting changes you may have done for the last version.

Version 1.0 (15th Feb 2006)

• Initial Release

Click on Install
If you have this script installed then please click on the install link because;

• You will get notified if any security issues are reported.
• You will get notified when there are any upgrades to this script
• It gives me a warm fuzzy feeling and motivates me to develop more

Donations
First of all, to be clear. This script is 100% free.

However if you feel an urge to donate I'm not going to say no.
Donations can be made at http://www.billspaintball.com/vb3/bd_donate.php

[Mysticales]

Any word on if my idea can work? We would love to use this on our site, which we run on a seperate server from the forums. Would love to be able to access usergroup permissions to setup usergroup page content on the site itself, but need to be able to do remote server access.

[Billspaintball]

Originally Posted by Mysticales

Any word on if my idea can work? We would love to use this on our site, which we run on a seperate server from the forums. Would love to be able to access usergroup permissions to setup usergroup page content on the site itself, but need to be able to do remote server access.

It might get it working if you change a couple of settings.
vB has cross site logins off by default as a security measure.

Have a look in the troubleshooting section here https://vborg.vbsupport.ru/showpost....49&postcount=2 to see what you can try.

[Billspaintball]

Originally Posted by Grasty

I just tried it and everything worked fine from the test page

I dont see what the difference is. But here is my code anyway

This is lines 144-159

I need to see more of the pages code than that.
You error may appear around there, but be caused elsewhere on the page.

That and i was wondering how to make it redirect right back to the home page, not to the forums, once you login

It does redirect stright back to the page you logged in from.
The error on your page is probably stopping it fron doing that.

[Mysticales]

Yea I have the site www.qj.net which we have on a seperate server from the forums, which means the main site and the forums wont BE on the same host and ftp. So meaning, the main site would 1st need to call the data off the SQL tables I assume, then apply it.

I would assume all one needs to use is the command in a php page for.

<?php
mysql_connect('sql server', 'user', 'password');
?>

Would that be all thats needed? Then remove the chdir line from the codes calling it?

I mean what would you think? Cause its not a matter of cross site on same host, its about crossing onto a different host server with same domain ending.

Edit:

After more studies.. I wonder if somehow we can replace the local path settings with a remote SQL calling. (Which I know sadly requires a IP for the sql server which I dont know if thats really easy to setup with most hosts)

// connect
$cs = mssql_connect ( 'server_name:port', 'username', 'password' ) or die ( 'Can not connect to server' );

// select
mssql_select_db ( '[database_name]', $cs ) or die ( 'Can not select database' );

//query
$sql = "SELECT * FROM [TABLENAME]";
$r = mssql_query ( $sql, $cs ) or die ( 'Query Error' );

// loop the result

while ( $row = mssql_fetch_array ( $r ) )
{
	/* do stuff */
}

Would be a idea for the remote calling. Unless somehow... there is a way to do cross server calling easier for vB access and database checking?

[Grasty]

PHP Code:

<?php
// Edit the lines below to show path to your forums
$forumpath = "http://grastyzone.net/forums";

// Set the maximum display size for the avatar
$maxw = 100; // Max thumbnail width
$maxh = 100; // Max thumbnail height

// ++++++++++++++++++++++++++++++++++
// Deluxe vB User login and access control on non vB pages
// Version 2.10 - June 4 2006
// By Bill  [email]bill@billspaintball.com[/email]
// ++++++++++++++++++++++++++++++++++


// ++++++++++++++++++++++++++++++++++
// You dont have to edit anything underneath here,
// but you can if you wish to style the login box
// to match the style of your site.
// ++++++++++++++++++++++++++++++++++



// We check if user is logged in
if ($vbulletin->userinfo['userid']!=0) {


// ++++++++++++++++++++++++++++++++++
// display avatar - resize if too big
// ++++++++++++++++++++++++++++++++++

$userid=$vbulletin->userinfo['userid'];
$file = $forumpath."/image.php?u=$userid";
list($width, $height, $type) = getimagesize($file);

if ( $width <= $maxw AND $height <= $maxh )// check width and height
   {// if width and height under size display unchanged
       echo "<img src=\"$file.$type\" align=\"center\" border=\"0\">";
   }
   else 
   {  
    if ($width > $maxw)//check if width is too wide
        { // if it is, resize
        $ratio = $width / $maxw; //work out resize ratio
        $newwidth = $maxw; // new width
        $newheight = ($height / $ratio); // new height at this resize
        }
        else
        {
        $newheight = $height; // if width is ok, set this cos we need it later
        $newwidth = $width; // if width was ok, set this cos we ned it later
        }
    If ($newheight <= $maxh )        
        {
        // if current height is ok, were done.
        } 
        
        else // either origional or resized height is too big
            if( $newheight >= $maxh )
            { // if resized height is still too big we resize it
            $ratio2 = $newheight / $maxh; //work out resize ratio
            $newheight = $maxh; // give $newheight a new value
            $newwidth = ($newwidth / $ratio2); // new width at this resize
            } // the value of $newwidth has just been changed
            else
            {// if were here then origional height is too big so we resize it
            $ratio2 = $newheight / $maxh; //work out resize ratio
            $newheight = $maxh; // give $newheight a new value
            $newwidth = ($newwidth / $ratio2); // new width at this resize
            }

        // now we can finally display resized pic
        echo "<img src=\"$file.$type\" border=\"0\" width = \"$newwidth\" height = \"$newheight\" align=\"center\">"; // display resized pic
   }
// +++++++++++++++++++++++  
// end avatar display code
// +++++++++++++++++++++++ 


// +++++++++++++++++++++++++++++++++++++++++
// As Logged in display welcome back message
// +++++++++++++++++++++++++++++++++++++++++
echo "Welcome Back, <b>";
echo $vbulletin->userinfo['username'];
echo " !</b><br>";

// As were logged in display logout link
echo "<a href=\"".$forumpath."login.php?$session[sessionurl]do=logout&amp;logouthash=$logouthash";
echo $vbulletin->userinfo['logouthash'];
echo "\">";
echo "<font size=\"1\" face=\"verdana\">Log Out</font></a><br>";

// Display last visit time and date
echo "You last visited: $pmbox[lastvisitdate] at $pmbox[lastvisittime]";
echo "<br>";

// Display PM Details and generate link to PM box
echo "<a href=\"".$forumpath."private.php?$session[sessionurl] \">Private Messages: </a> $vbphrase[unread_x_nav_compiled] $vbphrase[total_x_nav_compiled]";
echo "<br>";

} else { 



// ++++++++++++++++++++++++++++++++++++++++++
// If user is not logged in, we do this stuff
// ++++++++++++++++++++++++++++++++++++++++++

// Display text and link to register.
echo "
    You have to <a href=\"".$forumpath."/register.php?s=$session[sessionhash]\"
    target=\"_parent\"><b>register</b></a>  before you can post on our forums or use our advanced features.
    ";

// Display login boxes + button
// You can style this with html or CSS as normal if desired.
echo"
    <form action=\"".$forumpath."/login.php\" method=post onsubmit=md5hash(vb_login_password,vb_login_md5password,vb_login_md5password_utf)>
    <script type=text/javascript src=\"".$forumpath."/clientscript/vbulletin_md5.js\"></script>
    User Name:<br>
    <input name=vb_login_username type=text id=navbar_username size=10 />
            
    <br>Password:<br>
    <input name=vb_login_password type=password size=10 />
    </br>
        
    <label for=cb_cookieuser_navbar><input name=cookieuser type=checkbox id=cb_cookieuser_navbar value=1 checked=checked />
    Remember Me?<br /></label>
    
        
    <input type=submit title=$vbphrase[enter_username_to_login_or_register] value=\"Log In\" />
        
    <input type=hidden name=s value=$session[sessionhash] />
    <input type=hidden name=do value=login />        
    <input type=hidden name=vb_login_md5password />
    <input type=hidden name=vb_login_md5password_utf />

    </form>
";
// +++++++++++++++++++++++++++++++++++++++ 
// End of login box for non logged in user
// +++++++++++++++++++++++++++++++++++++++
}

// +++++++++++++++++++++++++++++++++++++++++++++++++++
// we want do display stats either way so they go here
// +++++++++++++++++++++++++++++++++++++++++++++++++++

// get total number of threads and posts
$getstats = $db->query_read('SELECT threadcount, replycount FROM ' . TABLE_PREFIX . 'forum');
while ($forum = $db->fetch_array($getstats))
{
    $totthreads += $forum['threadcount'];
    $totposts += $forum['replycount'];
}
$totthreads = vb_number_format($totthreads);
$totposts = vb_number_format($totposts);

// display total threads and total posts - Uses vB phrases, but change if you like
echo"<br /> $vbphrase[threads]: $totthreads<br />$vbphrase[posts]: $totposts<br /> ";

// Only display link and number of new posts if logged in
if ($vbulletin->userinfo['userid']!=0) {

// finds number of new posts
$newposts = $db->query_first("SELECT COUNT(*) AS count FROM " . TABLE_PREFIX . "post AS post " . iif($vbulletin->options['threadmarking'], 'LEFT JOIN ' . TABLE_PREFIX . 'threadread AS threadread ON (threadread.threadid = post.threadid AND threadread.userid = ' . $vbulletin->userinfo['userid'] . ')') . " WHERE dateline >= " . $vbulletin->userinfo['lastvisit'] . iif($vbulletin->options['threadmarking'], ' AND dateline > IF(threadread.readtime IS NULL, ' . (TIMENOW - ($vbulletin->options['markinglimit'] * 86400)) . ', threadread.readtime)'));
$newposts = vb_number_format($newposts['count']);

echo"<a href=\"".$forumpath."search.php?$session[sessionurl]do=getnew\">$vbphrase[new_posts]</a>: $newposts<br />";}
//  end of number of new posts stuff
?>

here you go, i just now tried replacing the one i changed with the one you posted. and it still gave me the error, the only thing i changed on this one was the forum path

[stuartc1]

Thanks Bill - this is a great mod. Worked perfect

It would be great it it would also grab the total member count, and users online (members and guests). That would be even more perfect

[jdk10]

Would love to see a screen shot of it in action

[stuartc1]

Originally Posted by jdk10

Would love to see a screen shot of it in action

I know how you feel - I would have like some screenshots beforehand.... here is how it looks on my site (I've removed some stats from the second screen!)

[delive]

Quick question -

I'm using

PHP Code:

if ($vbulletin->userinfo['usergroupid'] == '5' 
 or $vbulletin->userinfo['usergroupid'] == '7' 
)  { 


right now to allow someone access to one area. What is the code that evaluates the users additional usergroups. Is it possible to check and see if they are part of an additional usergroup?

[Billspaintball]

Originally Posted by Mysticales

I would assume all one needs to use is the command in a php page for.

<?php
mysql_connect('sql server', 'user', 'password');
?>

Would that be all thats needed? Then remove the chdir line from the codes calling it?

No.
The user passwords for vB are encrypted when they are stored in the database so you cant authenticate just like that.