Userlist Access 1.0

cool

This is something I've been doing for a while, a manual hack to the functions.php and userlist.php which stops the user list menu item being shown or the userlist.php page being opened when manualy entered in the address bar.

The code looks like this.....

in functions.php to prevent the menu item apearing....

//
// Generate the "navigator" that appears at the top of every page
//
function generate_navlinks()
{
    global $pun_config, $lang_common, $pun_user;

    // Index and Userlist should always be displayed
    $links[] = '<li id="navindex"><a href="index.php">'.$lang_common['Index'].'</a>';
   
    // Confirm the User has authenticated defore displaying menu option.
    if ($pun_user['is_guest'] == '0')
    $links[] = '<li id="navuserlist"><a href="userlist.php">'.$lang_common['User list'].'</a>';

    if ($pun_config['o_rules'] == '1')
        $links[] = '<li id="navrules"><a href="misc.php?action=rules">'.$lang_common['Rules'].'</a>';
.
.
.
etc.

And then in the userlist.php....to prevent a typed url being used....

define('PUN_ROOT', './');
require PUN_ROOT.'include/common.php';

if ($pun_user['g_read_board'] == '0')
    message($lang_common['No view']);

// Verify the user has authenticated and display Permission Error if not.
if ($pun_user['is_guest'] == '1')
    message($lang_common['No permission']);
else
{
// Load the userlist.php language file
require PUN_ROOT.'lang/'.$pun_user['language'].'/userlist.php';

// Load the search.php language file
require PUN_ROOT.'lang/'.$pun_user['language'].'/search.php';
.
.
.
etc.

<?php
}
require PUN_ROOT.'footer.php'

If you want to enter the code i'd suggest searching for some of the surrounding text to get you to the right place first.
It works for me and if anyone has the time to make it into a full blown mod then got for it....

As long as the result is "True" (the user is a guest) then you can do it anyway you like. There's more than one way to skin a cat...

Forgive the long winded way of doing it, I am a complete PHP novice, I found a way to do what I wanted and stuck with it.
It all came about from a forum I visit where I wasn't to keen on the ability for all and sundry to see the registered users (it was a security forum after all). So I had a poke around and came up with this fix, I tested running on my PC, informed the forum admin that it works and he's still yet to implement. Perhaps he doesn't think it matters that much...he's hoping it'll apear in a future release so that he doesn't have to keep patching after an update.

There's always a better way and if I keep reading and posting on here, you never know I may learn something...

Thanks for the input.

SWF

I have applied this mod for our forum and it appears to be working fine, except for two things...
Now, we are using build 1.2.12, which technically this does not support.  I went ahead and edited install_mod.php to include the version and then updated the dtabase, no prob.

Then I went ahead and began editing the files per the read me.

This was okay up until in steps 19, 20, and 21 where it askes you to edit line 36 in profile.php, because in this version of punbb the lines have already been edited to something else (and I am unsure how to figure out what to do without sitting down and studying it, ...something not for tonite!)

Sooo...  so I went ahead and tested it without that last edit, and everything seems to work great..., excepting that if the guest goes into a post they do see the Poster's ident as a clickable link ...which just so happens to let them into to view that individual's profile  ;^(     
Bummer. 

So I am wondering if I need to figure out that last code edit in "profile.php", ..if that is the 'trick' to the last access point?  Seems it would be.  Maybe I can figure it out tomorrow.  If someone here sees this and figures out the correct edit for that sooner (and I am not guaranteeing I can do it tomorrow, if ever LOL...) sure would apreciate it. 

Really Nice Mod otherwise, atis.  ty
Cheers,
TwoHawks

Edited Later:  Just to let you kow, I did edit the entry by adding the line
       if ($pun_user['g_read_board'] != '0') $permitted = 1;
else if ($pun_user['g_view_users'] != '0') $permitted = 1;              <<<this one added here
else if ($action == 'change_pass' && isset($_GET['key'])) $permitted = 1;
else if ($action == 'activate_account' && isset($_GET['key'])) $permitted = 1;
else $permitted = 0;

...and I really think this ought to work... don't understand why it doesn't??  Guest user still accesses the user's profile instead of the 'alternate message'.  What am I missing?

THANK YOU!   This works.
Sorry to have to ask you to "teach me" to pay attention to "the logic of self"... but that's where I think I lost it!  I had changed the AND / OR logic when I was working it somehow and failed to notice, and then when it failed,  I erroneously started trimming it out (as opposed to witnessing my first error!).. I did not understand the (obvious) use of $pun_user['id'], so I did not procedurally troubleshoot my work correctly.
- newby anti-logic! ---

Here is the current change to the read me for the proper mod-edit:
###############################################
#---------[ 19. OPEN ]--------------------------------------------------------
#

profile.php

#
#---------[ 20. FIND (line: 36) ]---------------------------------------------
#

    if ($pun_user['g_read_board'] != '0') $permitted = 1;
else if ($action == 'change_pass' && isset($_GET['key'])) $permitted = 1;
else if ($action == 'activate_account' && isset($_GET['key'])) $permitted = 1;
else $permitted = 0;

#---------[ 21. REPLACE WITH ]------------------------------------------------

    if ($pun_user['g_read_board'] != '0' && ($pun_user['g_view_users'] != '0' || $pun_user['id'] == $id)) $permitted = 1;
else if ($action == 'change_pass' && isset($_GET['key'])) $permitted = 1;
else if ($action == 'activate_account' && isset($_GET['key'])) $permitted = 1;
else $permitted = 0;

#####################################################

THank you for this much-needed mod.  We are all cozy and safe now ! ;^)

Hello,

I installed this mod easely and found it awsome, since it was just what I was looking for... Except on one point : it's probably linked to twohawks' message, but on the other way round :

1) I don't want members to access to the whole alphabetical userlist, so I checked the "no" choice to the "viewuserlist" plugin in the admin panel : success.

2) I want members to access to writer's profile who post messages : this is blocked by this mod, and I would like to know what to change no unlock this possibility without unlocking access to the whole userlist.

Should I do exactly the reverse operation that suggested by twohawks 2 messages above ?

Thanks for answering Twohawks, though I would have appreciated a more optimistic statement :\

This the "logic" of my demand.

I created a "secured" forum for a non-profit organisation : only members of the organisation are allowed to read and post. Since it would have been rather complicate to check every suscription, I personaly suscribed every member with a very usefull mod called "batch user register".

The trouble is that amoung the hundreds of suscribed members, some probably woudn't fancy beeing on a list visible by so many. That is why I looked for a mod hiding the whole list.

On the  other hand, those who post on the forum know that there names are clearly visible (usernames are real names) and probably don't mind to show what they personaly wrote in there "profile" for everyone to see. This is why I'm asking how to do the trick, and saught that the troubles you described up above could be my solution

Thanks for trying to figure out my needs, Twohawks, but I'm not so sure I've been clear enough or that I precisely get your point : I don't want posting users to access the "mega" list including all the users, nore a list including all the users that did post (but that option would be allwright, since they allready appear somewhere in the forum) : I just want them to access to "profile" section where personnal data can be shown or hidden according to the user's preferences, and this profile section would only be possible to access if the link is somewhere, i e on the left side on this users'message.

Does that make sense to distinguish between the users' "profile" sections and the general "userlist" section ? It seems that the first one matches with "profile.php" and the second one with "userlist.php", and I don't see the point in the present "userlist_access" mod in restricting access to profile.php... Is it inherent to PunBB's structure ?

Well, it's not that I want to customize anything that isn't allready possible on PunBB : it's just that I was desappointed to realise that this mod blocks access to other members profiles, usually accessible from there posts OR the list... For instant, if you click on "new morning" on the left handside of this post, you will access to my profile, through profile.php, and I don't see why this is related to the access of the userlist, commanded through userlist.php

But I experienced it on my own forum, when I'm logged as a "member" instead of "admin" or "moderator", I can't access to the list (which is the purpose of this mod) NORE other members' profile (which I did not intend to block) to see, for exemple, how many post they made, real name, ICQ, etc.).

When I installed this mod, I only meant to block access to the userlist, not to other members profile : did I make any mistake, probably related to the change of code you mentionned above that occured in PunBB 1.2.17 ? otherwise I don't see the logic in blocking both userlist AND profile in the same mod.

Ok, thanks for the news Twohawks, I'm not sure I'll be the first to rush upon the 1.3 version, unless all the mods I installed feet allwright...

I will probably seem insistant, but this part of your first message seemed to explain how to do what I was looking for:

I suppose I could try this when I get some free time.