Post using fake usernames?

[Cip]

I found a hack that allows users to manipulate the userid behind the post (Post by Proxy mod), but I couldn't find one that allows you to manipulate the username so that it would show up as a user that does not exist.

This is how my custom posting code looks, but it doesn't seem to matter if I manually set the $newpost['username'] to "Fake Username";

PHP Code:

            $poststarttime = $vbulletin->input->clean_gpc('p', 'poststarttime', TYPE_UINT);
            $poststarttime = time();
            $posthash = md5($poststarttime . $vbulletin->userinfo['userid'] . $vbulletin->userinfo['salt']);
            $forumid = 17;
               $foruminfo = verify_id('forum', $forumid, 0, 1);
               $threadid = 493;
               $threadinfo = verify_id('thread', $threadid, 0, 1);
            $newpost['username'] =& $vbulletin->userinfo['username'];
            $newpost['message'] = $_POST['custompagetext'];
            $newpost['title'] = $_POST['custompagetitle'];
            $newpost['parseurl'] = '1';
            $newpost['poststarttime'] = $poststarttime;
            $newpost['posthash'] = $posthash;

            if ($vbulletin->userinfo['autosubscribe'] != -1){$newpost['emailupdate'] = $vbulletin->userinfo['autosubscribe'];}
            else{$newpost['emailupdate'] = 9999;}
            if ($vbulletin->userinfo['signature'] != ''){$newpost['signature'] = '1';}
            else{$newpost['signature'] = '0';}
            $post = array();
            $post['visible'] = 1;
            $newpost['visible'] = 1;
            $threadinfo['visible'] = 1;

            build_new_post('reply', $foruminfo, $threadinfo, $post, $newpost, $errors);
        $currcont_query = $db->query_read('SELECT username, pagetext, title, dateline, postid FROM ' . TABLE_PREFIX . 'post WHERE threadid = 493 ORDER BY postid DESC LIMIT 1');
        $current = mysql_fetch_row($currcont_query);
         approve_post  ($current[4],  0, true, NULL, NULL, true); 


[Lynne]

I don't see anywhere in there that you have changed the username. You have this line in there:

PHP Code:

$newpost['username'] =& $vbulletin->userinfo['username']; 


and yet I thought you wanted it to be something different?

[Cip]

That's the thing, it seems like it reverts to "Cip" even though I enter:

PHP Code:

$newpost['username'] = "Fake Username"; 


[Lynne]

Perhaps this code is not the code being run on your special page. Maybe you have some conditions set incorrectly so the code isn't being used and instead the default code is being used.

[Cip]

The code in the first post works excellent and it was the way I read I was supposed to do in order to post replies from a custom page (although some of the lines regarding visibility are redundant, I was unsure how I was supposed to make it skip moderation, but later on I use approve_post()). I looked at the documentation for the API and I couldn't find anything that seemed out of place.

I'm starting to think along the lines that $newpost['username'] should contain an array of information about the username, but that seems dumb.

All in all, I'm confused :-P
Thanks for taking your time though, it's greatly appreciated :-)

[Lynne]

Hmmm, I really don't know. It's hard to say why it doesn't work cuz it looks like it should. Maybe someone else will wander into this thread with some help.