• This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn more.

Hidden Users

Rich

Active member
#1
Can someone please help me, I want to remove the ability to hide yourself on my boards when your signed in.

Thx
 

James

Well-known member
#2
I just looked through permissions and apparently it's not a permission (or am I just blind?). You'll just have to write an add-on to prevent it or remove all links to it in templates.
 
R

ragtek

Guest
#10
Remove the code from navigation_visitor_tab and from the account settings menu, if it exists.
That's not enough!

For avarage joe it's fine, but "smart users" will still be able to send a post request and set them invisible..

The admin could see that they're invisible, but he wouldn't know why and then the really expensive part starts => checking how they where able to do this..:D

That's why you SHOULD ALWAYS prevent this on server side too!
Never remove / comment out the form fields and think "it's done" ;)
 

James

Well-known member
#11
That's not enough!

For avarage joe it's fine, but "smart users" will still be able to send a post request and set them invisible..

The admin could see that they're invisible, but he wouldn't know why and then the really expensive part starts => checking how they where able to do this..:D

That's why you SHOULD ALWAYS prevent this on server side too!
Never remove / comment out the form fields and think "it's done" ;)
Yes, I know. Removing the links is enough generally, as most people won't know the URL to send the post request to.
 

Saeed

Well-known member
#12
That's not enough!

For avarage joe it's fine, but "smart users" will still be able to send a post request and set them invisible..

The admin could see that they're invisible, but he wouldn't know why and then the really expensive part starts => checking how they where able to do this..:D

That's why you SHOULD ALWAYS prevent this on server side too!
Never remove / comment out the form fields and think "it's done" ;)
That is sort of what happened. I used the code changes Jake has suggested above, along with conditionals that would allow only Mods and Admins to view the control, but a member has managed to bypass it somehow. Is there any way to disable this from the server side or this would need to be developed as an addon? :)