Multiple account login detector (AE Detector)

If you are like me and migrated from .threads, a common modification was an "AE detector", a simple mod that saved a cookie of a history of ids logged into on your site. If someone logged into more than one account, you got a PM letting you know that your site was being accessed from multiple accounts.

Over the years this was very helpful in identifying users who were posting under multiple accounts (alter-egos!) and users who would return after being banned.

You might be wondering why I don't use the vbcookie call - well, thats because on logout all vB cookies are cleared, so we need to store a cookie that is not effected by the login/logout process.

New Installation
1. Add New Product with attached XML
2. Go to vBulletin Options -> AE Multiple Login Detection Settings and set your specific settings.

Time to install: Easy - 2 minutes.

Upgrade
If you installed this as a Plug-in manually, you can delete that plugin and install this Product, just make sure to go into the Options and set them accordingly.

I hope you find this useful and will click INSTALL if you use it; should it prove useful to enough people I can look at making this installation more automated without the need for edits and an Admin Options page.

To upgrade you will want to reimport this XML file and edit your options accordingly.

1.0.3
-----
. Added a check to ensure that users weren't deleted when reporting violations
. added htmlspecialchars_uni call to username

Note: I am unable to get the call to construct_phrase with $vbphrase['multiplelogin_alert'] to work reliably, as such the $message variable is still set manually inside the plug-in and not via the phrase. If anyone has an idea of why this might not always work, I'm all ears.

1.0.2
-----
. Updated to include exclusion groups, users
. Changed so PM is sent by ae sender id

1.0.1
-----
. Released as a Product (thank you PHPGeek2k3 for your help)
. Added option to post to a forum versus send a PM (or both)
. All settings moved into Admin Option

1.0.0
-----
Initial release.

[cavyspirit]

I see this has been requested several times, but I'm throwing my hat in the ring, so to speak.

I REALLY need the ability for violators to be AUTOMATICALLY put in a moderated (specified) user group, IF the original or other userid is NOT banned.

IF any of the other userids are BANNED, then I definitely want the violator automatically BANNED as well.

THAT would save me a TON of grief from a few flaming idiots who just won't give up.

Thanks so much for this great hack which works great on my 3.6 forum.

[almqdad]

IF any of the other userids are BANNED, then I definitely want the violator automatically BANNED as well.

you can say that again

i realy need that

[cavyspirit]

Okay. I'm about ready to PAY someone to do this enhancement. How much would it take? Seriously.

[Thomas P]

Do you really have that much duplicate accounts?

[ryansmith]

I have vB 3.6. I uninstalled the product and re-uploaded it, then customized the settings in the AdminCP. None of the options work... it doesn't PM me, it doesn't create a post, nothing. Yes, I have filled out all the forums right. I've triple-checked them. I have my username as the reporting username, and also have my username as the one to notify. I have the right forum ID for posting... still nothing.

Maybe it conflicts with something else that I have installed.

Ryan

[MPDev]

And with it installed you are testing by logging into multiple accounts ensuring that you are not in the exception list?

[cavyspirit]

Originally Posted by Thomas P

Do you really have that much duplicate accounts?

I have one guy who continuously reregisters under new names--different IPs of course. The AE is tripped, but it takes us sometimes an hour or two before myself or one of my mods gets around to banning the twit.

It's become a game to him. This happens everyone once in a while. It's a total and complete waste of time dealing with them.

[ryansmith]

Originally Posted by MPDev

And with it installed you are testing by logging into multiple accounts ensuring that you are not in the exception list?

Yes, the fields for exempt usergroups and userids are blank. I have a test account that I log in with, then I log out and back into my admin account. No post is created and no IM is sent.

On my 3.5.4 board I immediately get a PM and a new post in a designated forum.

[YabbaDabba]

If a board has re-assigned its users to new userids, then this plugin tracks both the old ID and the new ID (assuming it was installed on the board with the old ID's)? In this case, a false positive can be generated because the original ID is no longer the same person as the new userID? And if so, is there a way to flush the old tracking cookies from the server, (...as opposed to telling all users to wipe their own cookies)? Which I guess means losing all tracking data up to that point, right?

[YabbaDabba]

Can I ask what precisely is stored in the cookie?

And how does the cookie change if another account is detected?

How does AED parse the cookie?

What is stored in variable {1}, the first account or the next detected account?

p.s., I think this is a GREAT plug-in. We have several problem accounts that are serial offenders.