Restrict Modification of Main Options to Head Administrator 1.01

-------------------------------------------------------------------------
Only head admin can modify main options in the adminCP hack
by N9ne, on Feb 17 2003, Copyright 2003.
-------------------------------------------------------------------------

-------------------------------------------------------------------------
For: 2.2.x and 2.3.x
-------------------------------------------------------------------------

I believe the hack's name is quite descriptive and self explanatory.

Just a simple hack, requested by TheMayhem.

Just thought i'd post it here incase anyone else is worried what other admins might do while editing the options page (can do a lot of damage there!).

Open attached file in a text editor for instructions.

Hack updated [March 17th 2003]
- Now with cleaner coding. Should work for all.

[Zelda-King]

Yes, that works on vB 2.2.9 also. I'm reluctant to keep the hack activated because I want the other admins to be able to IP ban but if they go screwing with my settings, BAM!

[N9ne]

Ok I've updated this hack with cleaner code now, I'm using !$bbuserinfo['userid']=="1" instead of !$userinfo[userid]==1

This should work in 2.x.x

[Dean C]

n9ne this is not the best way of doing it. You should add a query to run which adds an option to the admin options where you can set who can edit the main options. Then after that it will create a global variable in which you can specify the userid instead of assuming that the userid of the main admin is always 1

- miSt

[N9ne]

Actually, while the hacker is hacking his board, he can just change the userid to his userid. It's easier that way Mist.

Since when am I assuming that the userid of the main admin is 1? It's there to be edited.

Adding an option is risky, as other admins may view that page, and change it, before the head admin has time to get to the page while hacking.

Also, admins who have phpMyAdmin access or access to the database can easily change this to reflect a different userid, so they gain access again, and they will then most likely use it maliciously.

The best way is to keep it in the file.

[jusunlee]

the restriction does not seem to work at all, all userids will still be able to access admin options. heres the edited one that works:

PHP Code:

if ($bbuserinfo['userid']!="1") {
    echo "You cannot access this page.";
    exit;
} 


[N9ne]

jusunlee, works fine for me...

[csidlernet]

on jusunlee
last post.. doesn't that code mean it stops the person with user id 1, accessing it?

[SemperFidelis]

Not a bad idea
Would it also be a good idea to add something to /admin/setting.php as well ?
Plenty of damage can be done there too.

[-Sidekick-]

I'm sure N9ne's phrasing works though Jun's is correct and is the way I've always phrased something to this effect.