I just set a new cookie... is this OK?

[LanciaStratos]

I just created this quick one-line plugin to store a user's group ID in a cookie, using the global_setup_complete hook. It works just like I wanted. Is there any inherent security risk in doing this, or any other issue I may have overlooked?

PHP Code:

vbsetcookie('usergroupid', $vbulletin->userinfo['usergroupid']); 


A quick reply is all I'm looking for. If it looks good to you, no need to elaborate.

[Dismounted]

Why do you need to do that?

[LanciaStratos]

I wanted an easy way to check the usergroupid of my visitors outside of forum pages, without bothering to include global.php and the overhead that incurs. I use the usergroupid to determine whether or not I need to display ads around my site.

[Dismounted]

Anyone can change that cookie and "fool" your system.

[LanciaStratos]

True, of course, but I'm going to bet that the number of users who figure that out will be too small to have any type of impact on ad impressions. Also, I'm still using vB's template conditionals in the forums, so the technique won't work there (of course, won't visiting vB pages also reset the cookie?). This is primarily designed to hide ads on my WordPress installation, which contains pages and posts that can get hit hard with traffic. If I can save a trip to my vB DB on all those page loads (most of which will come from unregistered, new visitors), it has to be a good thing.

[Dismounted]

If you are only using it for displaying ads - it will be OK. Last thing, make sure you clear the cookie when logging out.

[LanciaStratos]

Great point, I hadn't considered clearing the cookie! Would logout_process be the best hook to use for that?

[Dismounted]

Originally Posted by LanciaStratos

Would logout_process be the best hook to use for that?

Yes