restricting unregistered users

[hoonz]

how do you restrict unregistered users from posting reviews or uploading new reviews?

I did not see an option for this in the admin cp... i have setup all the proper user groups and permissions, however unregistered users can still post reviews and upload new reviews.

[Michael P]

It's in the Usergroup options in the admin panel.

[hoonz]

i have already setup the user groups...

the script seems a little buggy when restricting groups, etc.

also logins are a bit strange when utilizing ib2's user database, they are not always in sync, sometimes when logging on or off, you will have to do it twice, in both the forums and review post.

[Michael P]

That sounds like a cookie issue - are your cookie settings the same between the two applications?

[Chuck S]

I would have to say you also do not have category permissions set correctly then if usergroups are set.

If you logins are not in sync it is because you have not set them up correctly. As I say the same to people who use VB3 all the time.

I have IB2 and Reviewpost install here and the logins are always integrated

http://www.omegatron.net/reviews/

http://www.omegatron.net/ib/

You can login with photopost and alphabeta

[hoonz]

well i think i got the login issue fixed, however there's still problems with the permission masks.

for instance, in the review post permissions masks, i allow a usergroup mod access (but no admin access), however they can still access the admin panel.

i made sure all user group permissions masks are correct, also i made sure the category permissions were all correct.

[Chuck S]

of course they can access the admin panel. Mod access means they can access the admin panel they just dont see all the stuff

[hoonz]

ahhhhhhh lol... thanks for clearing that up!

stupid me

[hoonz]

actually... it still allows unregistered people to upload and post new products... all the permission masks are set 100% correctly!

[hoonz]

i've tried everything with the cookies but still they do not seem to be insync...

currently i have the cookie access set to .domain.com on rp and ipb. the cookie path to "/" on review post, but disabled on ipb (this is the only way i can login), and prefixes disabled.

even when i change the prefixes on both rp and ipb it doesn't work. i tried setting the cookie path to /forums on both, but then you can't even login to rp. i've tried pretty much every single possibility but the login's are not insync with eachother.

for instance... i will login to the reviews section, this will log me into both rp and ipb... however after i visit ipb, and when i go back to rp without logging out of ipb, it says welcome to "site" reviews, yet the admin link, upload link and login links are displayed. when i click the admin link it tells me to login, however, when i click the upload link i am able to upload as unregistered (i checked the usergroup permissions many times and everything is setup correctly). First of all both the admin and upload links shouldn't be displayed if i am not logged in... as they dissapear when i logout thru rp, rather than when going from the forums and back to rp without a logout...

i'm not sure if this is exactly clear, however rp seems to be half logged in, it displays all links which shouldn't be displayed and allows you to upload new products (when permissions are denied), but asks you to login when clicking on the admin link, when it really shouldn't be displayed in the first place if i am not logged in.

Any ideas on how to fix this half logged in problem?

[Chuck S]

In your ib2.php file try this

if ( ($sessionid) && ($sessionid == $session_id) ) {
$checkpass = 1;
}
elseif ($converge_hash) {
if ($converge_hash == $finalpass) {
$checkpass = 1;
}


change it to this

if ( ($sessionid) && ($sessionid == $session_id) ) {
$checkpass = 1;
}
elseif ($converge_hash) {
if ($converge_hash == $finalpass) {
$checkpass = 1;
}
elseif ( $member_id && !$session_id ) {

setcookie("{$Globals['cookieprefix']}session_id","$session_id","0","{$Globals['cookie_path']}", $Globals['domain_path'] );

$ipaddr = findenv("REMOTE_ADDR");
$agent = findenv("HTTP_USER_AGENT");
$browser = addslashes( substr($agent, 0, 30) ) ;
$sesstime = time();

if ( !empty($Globals['dprefix']) ) {
$stable = "{$Globals['dprefix']}sessions";
}
else {
$stable = "ibf_sessions";
}

$query = "DELETE FROM $stable WHERE member_id='$userid'";
$result = ppmysql_query($query,$db_link);
ppmysql_free_result($result);

$query = "INSERT INTO $stable (id, member_name, member_id, running_time, member_group, ip_address, browser, login_type)
VALUES ('$session_id','$username',$userid,$sesstime,'$usergroup','$ipaddr','$browser',0)";
$result = ppmysql_query($query,$db_link);
ppmysql_free_result($result);

$checkpass = 1;
}

[hoonz]

i think that did the trick! everything seems to be working fine now... but i'll test it out a little more just to make sure it's good.

thank you very much.

[Chuck S]

Yep well basically what I see if that the session_id cookie is not there after you close your browser and come back directly to the browser. What it means is the sessions never match so checkpass never equals 1. The only other way cpaccess equals 1 is on login matching passwords so it is vital that the sessions match. What is funny is except for the altered queries and password structure the file is almost identical to ib.php. I found if you go to the forums the session_id is rewritten and your logged into Photopost fine.

So what I did is this

elseif ( $member_id && !$session_id ) {

Basically what that is saying is if member_id cookie exists and session_id does not delete their session and rewrite the session and create a session cookie.

THUS CHECKPASS EQUALS 1

[digitalSite]

Hi, I have installed ReviewPost, but if I'm not logged in, I can access the reviewpost/index.php page, I can also click on a category, post, etc.

In my admincp Usergroup section, the permissions are exactly how they were before I installed ReviewPost and I don't see anything in there that tells it to block out guests.

Can someone please help me? I don't want unregistered users to access any part of ReviewPost. Thanks!

[Chuck S]

Hello we would need some information like what forum your integrated with a url etc to assist here.

[digitalSite]

Ok,

I am using vBulletin 3.5. My ReviewPost is located here:

http://www.naturalbeautycafe.net/reviewpost/

Please let me know what else you need, thanks!

[Chuck S]

Okay well your integration seems just fine with no issues that I see. I registered a forum account and posted a dummy product in reviewpost just fine

http://www.naturalbeautycafe.net/rev....php?product=1

Guests have the ability to view your forum just fine it seems. If you do not want guests to view your reviewpost categories then in Admin => Edit Categories for your category permissions uncheck viewing permissions for the groups you do not want to access reviewpost content. Make sure to check the box apply to children to copy to your children cats of reviewpost as well.

[digitalSite]

Thanks Would it be possible for me to have the vB login box show up if an unregisterd user tries to access the ReviewPost home?

Do you think this can work if I place ReviewPost inside the forums folder?

Thanks!

[Chuck S]

To my knowledge for the Vbulletin login box to appear the minute you access the reviewpost home the only way to do this would be to also lock down guests from accessing your vbulletin content without being registered.

[digitalSite]

Originally Posted by Chuck S

To my knowledge for the Vbulletin login box to appear the minute you access the reviewpost home the only way to do this would be to also lock down guests from accessing your vbulletin content without being registered.

Thank you, that helped I just made it so that unregistered users CAN VIEW REVIEWS, but cannot post or upload. So when they click on a product, ReviewPost's message tells them they much be registered first. Perfect!

Thanks!