Password Protected Forums (vB3 Style)

-/\-/\-/\-/\-/\-/\-/\-/\-/\-/\-/\-
Password Protected Forums (vB3)
By Shaolyen
email: John@eovie.com
msn: John@eovie.com

TESTED ON A FRESH vB 2.3.0
-\/-\/-\/-\/-\/-\/-\/-\/-\/-\/-\/-

Introduction
-----------------------------------------------------------
This hack is fairly simple in what it does.

If a user tries to access a password protected forum, they will be
prompted for the password. Once entered correctly they'll be able
to browse the forum as normal. It's as simple as that!

There are a few extras in this. When a user enters a password and
it's verified as being correct, a cookie is sent to their PC
containing the password. This will ensure that they don't need to
log in every time they access the protected area, until the cookie
expires.

The cookie timeout time for each protected forum can be set in the
AdminCP. (You can choose anything from 1 minute to 1 year.)

Password protected forums are denoted by the text
"[Password Protected]" tagged on the end of the forum description.
If you don't have a forum description for your password protected
area, "[Password Protected]" will take its place.

Please bear in mind:
? Threads will appear in searches, but the title, author, etc. are
all set to "Restricted". A password is needed to access these threads.
? The password in the cookie IS NOT ENCRYPTED. This is for a
reason, so the password can be viewable in the AdminCP. If
anyone would prefer MD5 encryption in their cookies, let me know.
? In the very near future I will be adding on options to enable
MD5 encryption.
? When you specify "Regular Forum Security" in the AdminCP and
a password has been entered, that password will not be recorded.

Security level, password, and timeout times can be specified when
creating or editing a forum.
(AdminCP > Forums & Moderators > Add | Modify)


Warning
-----------------------------------------------------------
BACKUP YOUR DATABASE AND FORUM FILES BEFORE YOU EVEN THINK ABOUT APPLYING THIS HACK!
-----------------------------------------------------------

Shameless Plug
-----------------------------------------------------------
This hack was written for the fine people at xAviaHosting -
www.xaviahosting.com. Pay them a visit (Or I'm a dead man!)
-----------------------------------------------------------

Shameful Plea
-----------------------------------------------------------
I'm poor as always, I'd be seriously grateful for any donations..!
If you have a few spare pennies in that Paypal account, my address
is "John@eovie.com" - share the wealth!
-----------------------------------------------------------

Screenshots:
-----------------------------------------------------------
Password protected indicator
Password prompt
AdminCP Settings
Search results 1
Search results 2
-----------------------------------------------------------

Update 1.0 > 1.1
-----------------------------------------------------------
? Search blocking enabled.
Screenshots:
Search results 1
Search results 2

Available here
-----------------------------------------------------------

[blackice912]

Indeed sounds like a nice hack, but no way if they can bypass it.

[csidlernet]

Thanks very much.
/me hits install

[Sn00peh]

if i click on the "go to last post" link next to the username who last posted, i get into the forum without a password.... my fault?

[Sn00peh]

anyone having the same problem? please, this is kinda urgent :\

[Frozen Dreams]

03-12-03 at 03:09 PM Shaolyen said this in Post #14
The glitch I left in was this line of code (in two places) which gives access to the forum on the second incorrect attempt.

PHP Code:

setcookie('cookpass['.$forumid.']', $seccheck[forumpass], 0); 


I've deleted it and updated the instructions.

those lines are actually still in the changes the txt file asks for ... once in showthread and once in forumdisplay ... I removed them and whatever I tried (backbutton etc) I couldnt get in at all without the proper password

and I dont know if those changes did it - but I get the password prompt when clicking last post button on forum index as well

[high]* Frozen Dreams clicks install[/high]

[LordJMann]

I applied this hack and updated it after I heard people were getting in without a password, and it still has the same problem...

One of the guys who is getting in says it hows it setting his cookies... Any ideas?

[Sn00peh]

well, i wouldn't recommend this hack, due to it's major security holes... i've uninstalled it.

[-HipNoTiK-]

Well, this sure doesnt work in 2.3.2 :disappointed: Does anyone know of something clse to this that will work with 2.3.2?

[Toky0]

I think it will work with 2.3.0 some what. I'm not switching over to 2.3.2 =/ Only to 3.0.0 and up.

[nefarious]

I am sticking with it, only a couple of users have worked out the bypass and the password is given out to members who ask for it (it is a slightly lame adultish forum) and it is really there to stop casual lurkers.

Hopefully 3 will be out soon enough and then it shouldn't be a problem anymore...