Only original admin can modify users in administrator usergroup.

I find that if you have more that 1 admin, it is kinda a uncomfortable feeling to know that they have the power to modify your user information as well as other admins. They can change your status from administrator to just a registered user, as well as others, and take over the board. This can prevent it.

Security is a touchy area, and this is not proven to be 100% secure, so I will not take responsibility for any problems this hack may cause.

In /admin/user.php you need to do the following:

Step 1.
Look for:

PHP Code:

error_reporting(7); 


Below that add:

PHP Code:

unset($canmodifyadmins); 


Step 2.
look for:

PHP Code:

// ###################### Start edit #######################
if ($action=="edit") {
  $user=$DB_site->query_first("SELECT *,FROM_UNIXTIME(joindate) AS joindate,FROM_UNIXTIME(lastvisit) AS lastvisit,FROM_UNIXTIME(lastactivity) AS lastactivity,FROM_UNIXTIME(lastpost) AS lastpost,
                               avatar.avatarpath,NOT ISNULL(customavatar.avatardata) AS hascustomavatar
                               FROM user
                               LEFT JOIN avatar ON avatar.avatarid=user.avatarid
                               LEFT JOIN customavatar ON customavatar.userid=user.userid
                               WHERE user.userid=$userid"); 


Below that add the following:

PHP Code:

if ($user[usergroupid]!=6 or $bbuserinfo[userid]==$user[userid] or checklogperms($canmodifyadmins,1,"<p>Admins are not allowed to edit other admins.</p>")) { 


Step 3.
Look For:

PHP Code:

// ###################### Start do update ####################### 


Above that add the following:

PHP Code:

} 


Save that file and open /admin/config.php

Look for:

PHP Code:

?> 


Above that add the following:

PHP Code:

$canmodifyadmins = "192"; 


you can allow others as well by seperating their user id with a comma.
ex.

PHP Code:

$canmodifyadmins = "192,23,22"; 


That should do it. Lemme know if you have any problems.

[SIZE=3]This is now updated, should be fully operational!

[TELEK]

hmm... looks good. I want to try it. But I don't want to be the first. if anybody else tries this, tell me if it works.

I already had one admin delete another admin because he was teasing him. That wasn't good.

[nafae]

Behind the forums: true stories of ADMIN WAREFARE!~

[Mark Hensler]

lol@nafae

Sounds like you need to screen your admins better, TELEK.

[GeorgeofCS]

I tried to install it and it doesn't appear to work.

Just gives me a blank page

[pHaez]

hrm, it should work fine, i would try again. If you still can't get it, we need to work out a way to contact each other. It works perfect here.

[StarBuG]

I installed it too on my webserver and have the same Problem!

I get a blank page if I try to edit any user!
I also set: $canmodifyadmins = "1"; cause?my user id is 1

Any suggestions??

Maybe you forgott to parse a peace of code here???

Greetings

StarBuG

[pHaez]

its a possibility, lemme look it over again. I know it works here on mine, so it must have something missing.

[pHaez]

The first step should look like:

PHP Code:

<?php
error_reporting(7);
// admin hack
unset($canmodifyadmins);
// end admin hack
require("./global.php");

adminlog(iif($userid!=0,"user id = $userid",""));

The Second step should look like:

PHP Code:

if ($action=="edit") {
  $user=$DB_site->query_first("SELECT *,FROM_UNIXTIME(joindate) AS joindate,FROM_UNIXTIME(lastvisit) AS lastvisit,FROM_UNIXTIME(lastactivity) AS lastactivity,FROM_UNIXTIME(lastpost) AS lastpost,
                               avatar.avatarpath,NOT ISNULL(customavatar.avatardata) AS hascustomavatar
                               FROM user
                               LEFT JOIN avatar ON avatar.avatarid=user.avatarid
                               LEFT JOIN customavatar ON customavatar.userid=user.userid
                               WHERE user.userid=$userid");
// admin hack
if ($user[usergroupid]==6 && checklogperms($canmodifyadmins,0,"<p>You are not allowed to edit other admins.</p>")) {
// end admin hack
  if ($user[coppauser]==1) { 


Third Step should look like:

PHP Code:

  doformfooter("Save Changes");

  }
// admin hack
}
// end admin hack
// ###################### Start do update ####################### 


The config.php change should look like:

PHP Code:

// admin hack
$canmodifyadmins = "192";
// end admin hack
?> 


Maybe that will help you better understand the changes?

[StarBuG]

I have made the changes and I?m not a newbie!

I think 3 steps are not heavy to implement!

But it doesn?t work!

I use 2.2.1g!

Maybe this is the Problem!?

AND: The error occours not only if I try to edit an admin also normal users are not displayed!
ONLY blank Page

So the error must be in:

PHP Code:

// admin hack
  if ($user[usergroupid]==6 && checklogperms($canmodifyadmins,0,"<p>You are not allowed to edit other admins.</p>")) {
 // end admin hack 


Greetings

StarBuG