Mod for posting as alternate users?

[Max Taxable]

Originally Posted by kh99

Oh, I see, so anyone with access could become superadmin. That is kind of a problem.

Yes, kind of. They could literally jump into the super's account without leaving any trace of having been there - no IP, nothing. Unless of course they were dumb enough to post with the account.

This includes reading the super's PMs, access to SA-only functions, you get the picture.

Then all they have to do is UN-link themselves from the account, and no one's the wiser!

[Boofo]

Originally Posted by Max Taxable

That one puts a BIG security hole in, if you don't add the code to it I posted in that thread.

So, exactly where would you add it in Kevin's mod?

[Max Taxable]

Originally Posted by Boofo

So, exactly where would you add it in Kevin's mod?

I didn't examine it at all. Not sure if it's even the same thing.

[BirdOPrey5]

I don't think this would be an issue in kh99's mod.

[kh99]

Originally Posted by BirdOPrey5

I don't think this would be an issue in kh99's mod.

I think you're right. Mine only lets you post, and so you'll have the ip address. But it might be useful to be able to set up users or groups that you can't post as.

[talktofrank]

ok have installed it and it works fine, the only thing that this doesnt have that the smf did have (and it was a great feature) was then when you started typing it listed the users starting with that letter

its very helpful when you control lots of usernames and cant remember how to spell them all correctly.

not sure what kind of work is needed to include that

update

Ah cool, i just realised that it does show the names after you type the first 3 characters, its a little slow and would be better if it should up after typing the first character

[kh99]

Originally Posted by talktofrank

Ah cool, i just realised that it does show the names after you type the first 3 characters, its a little slow and would be better if it should up after typing the first character

I copied the existing username lookup (used in registration and sending pms) so I'm not sure. I can't do anything about the speed, but I'll look and see if I could change it to work after one character (I think probably it doesn't do that because a lot of forums have too many users for that to work).

What I was thinking about adding is a list of users that you previously posted as so you can choose from a drop-down.

[Max Taxable]

Originally Posted by kh99

I copied the existing username lookup (used in registration and sending pms) so I'm not sure. I can't do anything about the speed, but I'll look and see if I could change it to work after one character (I think probably it doesn't do that because a lot of forums have too many users for that to work).

What I was thinking about adding is a list of users that you previously posted as so you can choose from a drop-down.

That's what the other one has, a drop-down menu by your username in navbar where it says, "Welcome, kh99."

[talktofrank]

so in kh99's mod you need to set the userid that you want to use this mod. I have set it to only my account id.

Is there still a security hole in it if you only set it to your id?

[kh99]

I welcome other people's responses, but I'd say no. It doesn't really have the same problem because this mod only lets you post. The other mod mentioned above actually logged you in as the other user, and any mod or admin could become a superadmin. However, my mod does allow anyone with access to the settings in the admincp to change who's allowed to use it, so if you have other admins they can probably add themselves to the list of allowed users. I'm not sure how to get around that - I guess if I made it it's own option menu instead of adding to the existing options then I could restrict it to superadmins. Or I could just put settings in the config.php.