The Arcive of Official vBulletin Modifications Site.

Style / Template / Replacement Hack For Moderators · **Released**: 09-20-2002

Alright, I've finally finished working on this darn thing and ready for a beta release!

This hack impliments the Style, Template, and Replacement hack into one hack since it was the best way to work on it and easy to setup.

Please read the readme file before you install it.

For the style part, view this thread for screenshots

For the template part, view this thread for screenshots

For the replacement part, view this thread for screenshots

Also remember: It's a beta. There will probably be bugs I haven't found.

--------------------------
SECURITY FIX IF YOU USE XENON'S "MODS CAN EDIT USERS"
(https://vborg.vbsupport.ru/showthrea...threadid=42096)
Security fix by me, thanks to Xenon for pointing out where to edit the code
--------------------------
1. Open user.php in your forums/mod/ folder

2. Find the following:
--------------------------

Code:

  if($canedit[profilefields]) {
    maketableheader("Custom Profile Fields");
    $userfield=$DB_site->query_first("SELECT * FROM userfield WHERE userid=$userid");

    $profilefields=$DB_site->query("SELECT profilefieldid,title FROM profilefield");
    while ($profilefield=$DB_site->fetch_array($profilefields)) {
      $varname="field$profilefield[profilefieldid]";
      makeinputcode($profilefield[title],"field".$profilefield[profilefieldid],$userfield[$varname]);
    }
  }

---------------------------

Replace it with:
---------------------------

Code:

 if($canedit[profilefields]) { 
   maketableheader("Custom Profile Fields"); 
   $userfield=$DB_site->query_first("SELECT * FROM userfield WHERE userid=$userid"); 
  
   $profilefields=$DB_site->query("SELECT profilefieldid,title FROM profilefield"); 
   while ($profilefield=$DB_site->fetch_array($profilefields)) { 
    $varname="field$profilefield[profilefieldid]";
   if ($varname != "field999")
   if ($varname != "field998") 
   if ($varname != "field997") 
     makeinputcode($profilefield[title],"field".$profilefield[profilefieldid],$userfield[$varname]); 
   } 
 }

-----------------------------

Find:
---------------------------

Code:

  if($canedit[profilefields]) {
    $profilefields=$DB_site->query("SELECT profilefieldid,title FROM profilefield");
    while ($profilefield=$DB_site->fetch_array($profilefields)) {
      $varname="field$profilefield[profilefieldid]";
      $sql.=",field$profilefield[profilefieldid]='".addslashes($$varname)."'";
    }
    $DB_site->query("UPDATE userfield SET userid=$userid$sql WHERE userid=$userid");
  }

---------------------------
Replace it with:

Code:

  if($canedit[profilefields]) {
    $profilefields=$DB_site->query("SELECT profilefieldid,title FROM profilefield");
    while ($profilefield=$DB_site->fetch_array($profilefields)) {
      $varname="field$profilefield[profilefieldid]";
if ($varname != "field999")
if ($varname != "field998")
if ($varname != "field997")
      $sql.=",field$profilefield[profilefieldid]='".addslashes($$varname)."'";
    }
    $DB_site->query("UPDATE userfield SET userid=$userid$sql WHERE userid=$userid");
  }

Save and upload.

That's it, your forums are now secure from moderators breaking your security!
-----------------------------

Now...onto the download...

Oh, and if you use it, please click install!

blackice912 · #12 09-22-2002, 08:38 PM

Ok if you already have it installed, open up style.php in your mod folder and find:

Code:

location.replace(\"http://www.stardust-one.net/forums/mod/style.php?s=$session[sessionhash]&action=styles&dostyleid=$bbuserinfo[field998]\");

And replace it with:

Code:

location.replace(\"style.php?s=$session[sessionhash]&action=styles&dostyleid=$bbuserinfo[field998]\");

Still in that file, find:

Code:

alert(\"You are not authorized to view this area\")
location.replace(\"http://www.stardust-one.net/forums/mod/\");

And replace it with:

Code:

alert(\"You are not authorized to view this area\")
location.replace(\"index.php?s=&action=home\");

And still in that file, find:

Code:

alert(\"You are not authorized to view this area\")
location.replace(\"http://www.stardust-one.net/forums/mod/index.php?s=&action=home\");

Replace it with:

Code:

alert(\"You are not authorized to view this area\")
location.replace(\"index.php?s=&action=home\");

heh, I totally forgot to fix those. Going to update zip file now.

blackice912 · #13 09-22-2002, 08:42 PM

Zip file updated. Removed vbHacker file because that takes a little longer to update

blackice912 · #14 09-22-2002, 11:06 PM

I found another flaw. If you use Xenon's "Mods Can Edit Users" hack and then use my fix above, when a Mod edits his or her profile through the system, it erases the information in the fields that were hidden. I guess Xenon was correct about the fix and I think he posted his ideas in another thread so I'll go look and see what I can do.

If you don't use that hack, then no changes for you.

blackice912 · #15 09-22-2002, 11:18 PM

Flaw fixed, main post updated. Thanks Xenon for pointing out what code should be edited.

FleaBag · #16 09-23-2002, 10:34 AM

Good work dude, I can't see any other problems in the hack so far!

blackice912 · #17 09-23-2002, 03:47 PM

Well I found a security flaw, so I need to go in and fix it. It's a really really small flaw but might as well fix it.

SZ|TalonKarrde · #18 09-23-2002, 11:14 PM

Of course you need to fix it =P

blackice912 · #19 09-24-2002, 08:43 PM

Go away little man

litte Tyro Hacker

FleaBag · #20 09-26-2002, 10:22 AM

Have you fixed the flaw? I'd like to update my install.

SZ|TalonKarrde · #21 09-26-2002, 06:53 PM

That's it. I'm going to release a hack just to spite you.

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.05336 seconds Memory Usage 2,313KB Queries Executed 25 (?)
More Information
Template Usage: (1)SHOWTHREAD (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (1)ad_showthread_beforeqr (10)bbcode_code (1)footer (1)forumjump (1)forumrules (1)gobutton (1)header (1)headinclude (1)modsystem_post (1)navbar (6)navbar_link (120)option (1)pagenav (1)pagenav_curpage (3)pagenav_pagelink (11)post_thanks_box (11)post_thanks_button (1)post_thanks_javascript (1)post_thanks_navbar_search (11)post_thanks_postbit_info (10)postbit (11)postbit_onlinestatus (11)postbit_wrapper (1)spacer_close (1)spacer_open (1)tagbit_wrapper Phrase Groups Available: global inlinemod postbit posting reputationlevel showthread	Included Files: ./showthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/functions_bigthree.php ./includes/class_postbit.php ./includes/class_bbcode.php ./includes/functions_reputation.php ./includes/functions_post_thanks.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete showthread_start showthread_getinfo forumjump showthread_post_start showthread_query_postids showthread_query bbcode_fetch_tags bbcode_create showthread_postbit_create postbit_factory postbit_display_start post_thanks_function_post_thanks_off_start post_thanks_function_post_thanks_off_end post_thanks_function_fetch_thanks_start post_thanks_function_fetch_thanks_end post_thanks_function_thanked_already_start post_thanks_function_thanked_already_end fetch_musername postbit_imicons bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete postbit_display_complete post_thanks_function_can_thank_this_post_start pagenav_page pagenav_complete tag_fetchbit_complete forumrules navbits navbits_complete showthread_complete
Messages:

The Arcive of Official vBulletin Modifications Site.

It is not a VB3 engine, just a parsed copy!