Allow moderators to ban users

[Ryan Kent]

Also, some of us are more careful than the rest and have their admincp htpasswd protected and nobody should go near that, ever.

What benefit does this offer? If a person doesn't have admin rights, even if they know the ACP page URL they wont be able to access anything, correct? I am asking because if I am missing anything then I would want to take precautions.

 

[Rigel Kentaurus]

What benefit does this offer? If a person doesn't have admin rights, even if they know the ACP page URL they wont be able to access anything, correct? I am asking because if I am missing anything then I would want to take precautions.

Two examples:

1) Say, there is a bug with the forum software (hey, it's software). There is now a vulnerability that allows a remote attacker to gain control of your instance by exploiting something and getting login privileges. An obscure one, but still. If you had .htpasswd protection then you are protected in one more layer, they cannot make use of the vulnerability in the forum software to gain access to the ACP, they would also need to get the http basic auth password

2) Say, there is an issue that was overlooked by the developers. One particular file in the ACP was not protected (with the frontcontroller approach this is unlikely). Ops, an attacker can now just call this file directly since it bypassed the login mechanism. With .htpasswd, this is not possible as you are protecting the whole directory.

This has happened before ...
http://www.securityfocus.com/bid/32353/info
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2007-02/msg00081.html
(and more, I won't link to them)

So, short story. Do protect your admin.php file Highly recommended
and the /install directory

 

[Ryan Kent]

thank you for the explanation Rigel. I don't want to take this topic off track but can you share how I can protect the admin.php file and install directory? I have seen the .htaccess file but what change needs to be made so I am protected?

 

[Paul B]

I don't want to take this topic off track but can you share how I can protect the admin.php file and install directory?

I posted those changes elsewhere, let me see if I can find the post.

Edit: Rather than link to a post which is buried on a thread somewhere, I've posted a new thread here: http://xenforo.com/community/thread...d-the-install-directory-using-htaccess.13768/

 

[nrep]

Adding options for the length of the ban would be a good idea, as a 24h ban isn't often long enough (sometimes it's permenant).

I strongly agree that moderators should be able to ban users, as they can often spot problems before admins can.

 

[Ryan Kent]

If this is added, I would like to see a post auto-created in a thread each time a ban happens. I do realize that admins can check in the ACP to see a list of banned users. The issues are: the ACP isn't available to mods, and it is quite inconvenient to go check any particular section of the ACP to see if someone was banned. A simple thread post would be perfect. You can have alerts for the thread, see who was banned, when, by whom, for how long and the reason.

 

[Rigel Kentaurus]

If this is added, I would like to see a post auto-created in a thread each time a ban happens. I do realize that admins can check in the ACP to see a list of banned users. The issues are: the ACP isn't available to mods, and it is quite inconvenient to go check any particular section of the ACP to see if someone was banned. A simple thread post would be perfect. You can have alerts for the thread, see who was banned, when, by whom, for how long and the reason.

Couldn't this just be done by a standard alert sent to the admins?

 

[Ryan Kent]

Couldn't this just be done by a standard alert sent to the admins?

I am still learning here Rigel. Can you please tell me how a mod can send an alert to the admin/mod group?

Even so, alerts seem like a sloppy way to do things. Having a single forum thread in the moderator forums titled "Banned Users" is something that every mod can view for the life of the forums. If you use alerts, then anytime a new mod joins they wont know about past bans.

 

[Rigel Kentaurus]

I am still learning here Rigel. Can you please tell me how a mod can send an alert to the admin/mod group?

Even so, alerts seem like a sloppy way to do things. Having a single forum thread in the moderator forums titled "Banned Users" is something that every mod can view for the life of the forums. If you use alerts, then anytime a new mod joins they wont know about past bans.

I meant the hack could have done that, and sent the alert I'll explore adding that option. A thread would be better long term, though. Those might be complementary options.

 

[Rigel Kentaurus]

I updated the hack (version 1.0.1)

I added the ability to specify a time limit, so moderators can not only ban the users for one day, but for any amount as they choose, similar to what one can use in the admincp.

 

[Anthony Parsons]

Nice... now we just need the discouraged & undiscouraged ability brought forward for mods, and mod access will be quite completed at the frontend.

Nice work Rigel.

 

[feldon30]

If you trust your moderators enough to let them ban or edit users, make them administrators and allow them to manage users.

vBulletin mentality.

Banning is definitely more a moderation task than administration task. Very frustrating design decision that I'm glad is being fixed by this mod.

Exactly. Administrator vs. Moderator in vBulletin was a very rigid setup. XenForo makes it (or should make it) a continuum of control completely up to the site operator to decide. Every forum is different.

 

[Paul B]

vBulletin mentality.

Hardly.
I'm not even a member of the vBulletin website.

 

[fattony69]

This doesn't show up for my moderators. I believe it is because my custom skin. Is there a way to manually insert this?

 

[Paul B]

What doesn't show up?

 

[fattony69]

What doesn't show up?

The option to ban. I have the usergroup setting setup and everything, but it doesn't show up.

 

[electrogypsy]

im getting this weird error... one of my moderators banned someone, but the person getting banned did not get moved to the banned usergroup, and now has "easyban_user_already_banned_days" in place of the "ban user" link (see screenshot).

also, in the edit user page of the admin cp, i get the option to lift the ban on the user, but they are not in the banned usergroup.

 

[Rigel Kentaurus]

im getting this weird error... one of my moderators banned someone, but the person getting banned did not get moved to the banned usergroup, and now has "easyban_user_already_banned_days" in place of the "ban user" link (see screenshot).

also, in the edit user page of the admin cp, i get the option to lift the ban on the user, but they are not in the banned usergroup.

If you see that, it means that the phrase "easyban_user_already_banned_day" was for some reason not created during the installation of the addon. That phrase must exist, open the xml with a text editor if you want to see it's content

...

in XenForo, there is no such thing as a banned usergroup (you may have one if you imported by vBulletin, but banned users are not really moved to that), instead, users are set as banned.

 

[Anthony Parsons]

Is this going to be upgraded to use the member card hover feature over avatars to show mod functions the same as admins will see, instead of having to specifically go to the profile?

 

[Rigel Kentaurus]

Is this going to be upgraded to use the member card hover feature over avatars to show mod functions the same as admins will see, instead of having to specifically go to the profile?

I don't have plans for doing that It pretty much works, so I have no need for an enhancement. Somebody else might want to do it, though.