Banned SCAMMER sending email through ads.

oldengine · February 13th, 2007, 10:57 PM

Please see this thread:

NEED EMAIL FLOOD CONTROL - Scammers

I had a scammer come on yesterday and send 126 scam emails out to my users through the classifieds.

I banned him on my vBulletin forum registration system and firewalled his ISP.

He came back again today, I suspect with the same user name, which although banned in vB, if he was still logged in with a cookie from yesterday, he was able to carry on as though NOT banned and sent out 22 more emails.

Ideas?

oldengine · February 13th, 2007, 11:11 PM

I just ran a test on this.

Logged in on the calssifieds as user ggg

Banned user ggg on the vBulletin admin panel.

Closed the classifieds window and opened it again.

Sent email to ad users just as easy as a breeze!

BANNING doesn't do anything unless user ggg logs out.

In fact, I logged out and back in again as a BANNED user and email still works.

My user group editor in classifieds admin has NO in ALL sections of the BANNED user line.

EDIT: Temporary workaround - when you ban a user, change their password.

Simply put, when using classifieds in a separate database, but with vBulletin as password control, banned users can log in and send email.

Chuck S · February 14th, 2007, 07:35 AM

Banning a user through your forum does nothing in classifieds. You need to move him into a special usergroup you setup and then set that usergroup to no permission to view anything so we can not see the ads and contact user link.

oldengine · February 14th, 2007, 07:51 AM

There is a BANNED USER category in my classifieds admin user group editor which was picked up from vBulletin by "Refresh usergroups from your forum software?"

In my admin edit usergroups editor in PhotoPost classifieds, I have NO set in the entire line of options for that BANNED user group. (There is no option to prevent sending email.)

Do I need to create another user group in vBuletin and import that one? In this configuration, user groups have been turned over to vBulletin and I cannot create a user group in the PhotoPost classifieds.

Quote:

You need to move him into a special usergroup you setup and then set that usergroup to no permission to view anything so we can not see the ads and contact user link.

You are referring to a "new" vBulletin user group here? What would be its difference from the banned user group?

EDIT: Further testing - BANNED USER does not ger a "Post AN AD" link on any page, but BANNED USER does get an "Email Seller" link on the showproduct page.

oldengine · February 14th, 2007, 08:55 AM

This appears to do the trick...

In contact.php

Code:

Content visible to verified customers only.

We could change "noperm" to a more specific message. "You are not allowed to send Email."

Chuck S · February 14th, 2007, 09:42 AM

First off if a user does not have permissions to view an ad they can never see an ad to see the contact script so I dont see where this is an issue if you have under edit categories the user has no viewing permissions. The point I was making above is banning someone in your forum has no affect in classifieds. You need to set permissions accordingly. Now if you want a safety check in contact.php this is what I would suggest and is valid

Code:

Content visible to verified customers only.

oldengine · February 14th, 2007, 09:48 AM

Quote:

Originally Posted by Chuck S

First off if a user does not have permissions to view an ad they can never see an ad to see the contact script

Where do you flag a user not to "view" an ad? See attachment.

Chuck S · February 14th, 2007, 09:59 AM

Admin => Edit Categories

For each category you can set viewing uploading and commenting permissions for each respective cat. This is standard in all our programs and are an added level of security over the global settings.

oldengine · February 14th, 2007, 10:16 AM

Well there, see, I'm a neophyte!

I never implemented anything in the "Usergroup Access Permissions" of the categories.

I'll get to work on that, but the "safety check" in any script is still important.

I don't know if you have ever had your classifieds attacked by Nigerian scammers, but I can tell you that they are very resourceful.

Thanks!

Code:

Content visible to verified customers only.

Chuck S · February 14th, 2007, 11:06 AM

well if you set category permissions which is a normal action they cant view the ads so they can not see the contact link so all is well

oldengine · February 15th, 2007, 01:11 AM

May I ask another question on this issue? Maybe this should be in the "How do I" category rather than as a "Bug Report" - up to you...

I have resolved the BANNED USER issue with the check boxes in the category editor. Of course, if they are BANNED, I couldn't care less if they cannot view any of my ads. Therefore, they cannot get to the "Email Seller" button.

However, I want UNREGISTERED users to see all the ads. This is how we gain new users. They see the "Email Seller" button, click it and get the message: "Only registered users can contact sellers. Please · register so that you can safely contact other users." Excellent!

Now the problem: A user registers, but they and their email address are not yet confirmed. Therefore, they are "Users Awaiting Email Confirmation." But these unconfirmed users are able to not only "see" the Email Seller link, they can click on it AND send email to the other users!

It would be preferable that "Users Awaiting Email Confirmation" not be able to Email Seller until they are confirmed and/or approved. If I turn that group off in the category "view ads" section, they won't see the link to Email Seller, but THEY WON'T SEE THE AD AT ALL! What a turn-off to that user and they will most likely run off in disgust.

SO: How to prevent "Users Awaiting Email Confirmation" from using the Email Seller (contact.php) system while still being able to VIEW the ads? The same way that "Unregistered Users" cannot use the contact.php script?

Chuck S · February 15th, 2007, 08:43 AM

That would require you to alter your scripts. If your users are non confirmed they should know pretty much to do anything on the forum they need to confirm themselves.