Password Protected Forums (vB3 Style)

-/\-/\-/\-/\-/\-/\-/\-/\-/\-/\-/\-
Password Protected Forums (vB3)
By Shaolyen
email: John@eovie.com
msn: John@eovie.com

TESTED ON A FRESH vB 2.3.0
-\/-\/-\/-\/-\/-\/-\/-\/-\/-\/-\/-

Introduction
-----------------------------------------------------------
This hack is fairly simple in what it does.

If a user tries to access a password protected forum, they will be
prompted for the password. Once entered correctly they'll be able
to browse the forum as normal. It's as simple as that!

There are a few extras in this. When a user enters a password and
it's verified as being correct, a cookie is sent to their PC
containing the password. This will ensure that they don't need to
log in every time they access the protected area, until the cookie
expires.

The cookie timeout time for each protected forum can be set in the
AdminCP. (You can choose anything from 1 minute to 1 year.)

Password protected forums are denoted by the text
"[Password Protected]" tagged on the end of the forum description.
If you don't have a forum description for your password protected
area, "[Password Protected]" will take its place.

Please bear in mind:
? Threads will appear in searches, but the title, author, etc. are
all set to "Restricted". A password is needed to access these threads.
? The password in the cookie IS NOT ENCRYPTED. This is for a
reason, so the password can be viewable in the AdminCP. If
anyone would prefer MD5 encryption in their cookies, let me know.
? In the very near future I will be adding on options to enable
MD5 encryption.
? When you specify "Regular Forum Security" in the AdminCP and
a password has been entered, that password will not be recorded.

Security level, password, and timeout times can be specified when
creating or editing a forum.
(AdminCP > Forums & Moderators > Add | Modify)


Warning
-----------------------------------------------------------
BACKUP YOUR DATABASE AND FORUM FILES BEFORE YOU EVEN THINK ABOUT APPLYING THIS HACK!
-----------------------------------------------------------

Shameless Plug
-----------------------------------------------------------
This hack was written for the fine people at xAviaHosting -
www.xaviahosting.com. Pay them a visit (Or I'm a dead man!)
-----------------------------------------------------------

Shameful Plea
-----------------------------------------------------------
I'm poor as always, I'd be seriously grateful for any donations..!
If you have a few spare pennies in that Paypal account, my address
is "John@eovie.com" - share the wealth!
-----------------------------------------------------------

Screenshots:
-----------------------------------------------------------
Password protected indicator
Password prompt
AdminCP Settings
Search results 1
Search results 2
-----------------------------------------------------------

Update 1.0 > 1.1
-----------------------------------------------------------
? Search blocking enabled.
Screenshots:
Search results 1
Search results 2

Available here
-----------------------------------------------------------

[Smoothie]

There is a major security flaw in this hack that was just discovered. I can tell you an easy way to get in to a password protected forum.

[GoTTi]

r u gunna tell us how?

[John]

If you've found a flaw, why haven't you contacted me about it?

[TheComputerGuy]

Well I tried to update my forum descriptions and it seems not to update any longer?

Did I miss something?

[LOD-squa]

Hmm, one of my members used another password and he was still able to get into the forum =\

[Zero Complex]

awesome. Finally someone puts a working one up. the other one had so many bugs.

[Bloodfist]

So is this hack stable or what?

What's it's status?

[Crazy Pete]

Edit - Nevermind, I forgot to clear my cookies.

[Crazy Pete]

Actually, there does seem to be a problem with this. Some people are able to click on a link to a post in the password protected thread, and it asks them for the password. So far, so good. But then, if they click back to the main index and reload it, THEN click on the password protected forum, they get right in.

I haven't been able to duplicate this, but some of my members said they got in without a password and that was one of the ways they did it.

[kushtiUK]

Today at 06:25 AM Crazy Pete said this in Post #69
Actually, there does seem to be a problem with this. Some people are able to click on a link to a post in the password protected thread, and it asks them for the password. So far, so good. But then, if they click back to the main index and reload it, THEN click on the password protected forum, they get right in.

I haven't been able to duplicate this, but some of my members said they got in without a password and that was one of the ways they did it.

I have the same problem and I also managed to duplicate it. I am running 2.2.6 though so I don't know if that's the problem - can any else confrim?