What benefit does this offer? If a person doesn't have admin rights, even if they know the ACP page URL they wont be able to access anything, correct? I am asking because if I am missing anything then I would want to take precautions.
-
This forum has been archived. New threads and replies may not be made. All add-ons/resources that are active should be migrated to the Resource Manager. See this thread for more information.
Allow moderators to ban users
- Thread starter Rigel Kentaurus
- Start date
- Status
What benefit does this offer? If a person doesn't have admin rights, even if they know the ACP page URL they wont be able to access anything, correct? I am asking because if I am missing anything then I would want to take precautions.
Two examples:
1) Say, there is a bug with the forum software (hey, it's software). There is now a vulnerability that allows a remote attacker to gain control of your instance by exploiting something and getting login privileges. An obscure one, but still. If you had .htpasswd protection then you are protected in one more layer, they cannot make use of the vulnerability in the forum software to gain access to the ACP, they would also need to get the http basic auth password
2) Say, there is an issue that was overlooked by the developers. One particular file in the ACP was not protected (with the frontcontroller approach this is unlikely). Ops, an attacker can now just call this file directly since it bypassed the login mechanism. With .htpasswd, this is not possible as you are protecting the whole directory.
This has happened before ...
http://www.securityfocus.com/bid/32353/info
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2007-02/msg00081.html
(and more, I won't link to them)
So, short story. Do protect your admin.php file
Highly recommendedand the /install directory
I posted those changes elsewhere, let me see if I can find the post.
Edit: Rather than link to a post which is buried on a thread somewhere, I've posted a new thread here: http://xenforo.com/community/thread...d-the-install-directory-using-htaccess.13768/
If this is added, I would like to see a post auto-created in a thread each time a ban happens. I do realize that admins can check in the ACP to see a list of banned users. The issues are: the ACP isn't available to mods, and it is quite inconvenient to go check any particular section of the ACP to see if someone was banned. A simple thread post would be perfect. You can have alerts for the thread, see who was banned, when, by whom, for how long and the reason.
Couldn't this just be done by a standard alert sent to the admins?
Couldn't this just be done by a standard alert sent to the admins?
I am still learning here Rigel. Can you please tell me how a mod can send an alert to the admin/mod group?
Even so, alerts seem like a sloppy way to do things. Having a single forum thread in the moderator forums titled "Banned Users" is something that every mod can view for the life of the forums. If you use alerts, then anytime a new mod joins they wont know about past bans.
I meant the hack could have done that, and sent the alert
I'll explore adding that option. A thread would be better long term, though. Those might be complementary options.
I updated the hack (version 1.0.1)
I added the ability to specify a time limit, so moderators can not only ban the users for one day, but for any amount as they choose, similar to what one can use in the admincp.
I added the ability to specify a time limit, so moderators can not only ban the users for one day, but for any amount as they choose, similar to what one can use in the admincp.
Nice... now we just need the discouraged & undiscouraged ability brought forward for mods, and mod access will be quite completed at the frontend.
Nice work Rigel.
Nice work Rigel.
vBulletin mentality.
Exactly. Administrator vs. Moderator in vBulletin was a very rigid setup. XenForo makes it (or should make it) a continuum of control completely up to the site operator to decide. Every forum is different.
Hardly.vBulletin mentality.
I'm not even a member of the vBulletin website.
The option to ban. I have the usergroup setting setup and everything, but it doesn't show up.
im getting this weird error... one of my moderators banned someone, but the person getting banned did not get moved to the banned usergroup, and now has "easyban_user_already_banned_days" in place of the "ban user" link (see screenshot).
also, in the edit user page of the admin cp, i get the option to lift the ban on the user, but they are not in the banned usergroup.
also, in the edit user page of the admin cp, i get the option to lift the ban on the user, but they are not in the banned usergroup.
Attachments
If you see that, it means that the phrase "easyban_user_already_banned_day" was for some reason not created during the installation of the addon. That phrase must exist, open the xml with a text editor if you want to see it's content
...
in XenForo, there is no such thing as a banned usergroup (you may have one if you imported by vBulletin, but banned users are not really moved to that), instead, users are set as banned.
Is this going to be upgraded to use the member card hover feature over avatars to show mod functions the same as admins will see, instead of having to specifically go to the profile?
I don't have plans for doing that
It pretty much works, so I have no need for an enhancement. Somebody else might want to do it, though.- Status
Similar threads
- Suggestion
- Question
- Question
