[Code 1.4.1/1.5.1/1.5.2] Deny guest from viewing member profiles

[Jack.R.Abbit]

As the Subject suggests, this prevents guests from viewing member profiles.

In Profile.php search for

Code Select Expand


function ViewProfile () and add

Code Select Expand

if($username == "Guest")
 fatal_error($txt[223]); after the line "$user=urldecode($user);".

You will get the same error message if a guest tries to view the member list.

-Jack

[Coyote]

This code works on 1.5.1 as well!

Thanks Jack.

Tony.

[Jack.R.Abbit]

Thanks for the info, Tony

-Jack

[oldiesmann]

Uh... I thought this was already a part of YaBB... Last time I tried to view a user profile on YaBB without logging in, it said I had to be a registered member to view that user's profile or something.

[Coyote]

Nope i have always had to add the code.

[CrazyC]

The only thing blocked in the main yabb code is clicking the link to go to the main member list, but if you click on someone's name from a message in the forum (where guests can view messages), they can see that persons profile.  I too have been adding this code myself on the last view releases.

[oldiesmann]

Ah. I see. I'll have to add that code just as a precaution to keep people from being able to swipe email addresses from user profiles...

[Coyote]

Thats another reason I did it, although if they havent selected hide email then it only takes someone to go through the memberlist making notes.

I run this sql code every now and then which sets everybodys email to hide

Code Select Expand


UPDATE members set hideEmail = '1' WHERE ID_MEMBER>'1';


[Jack.R.Abbit]

but guests can't get to the memder list either... By default, aside from the profile, the only way a guest can get an email address is to locate it in the member info of a post if the member has selected to make it visible.

[Coyote]

Yeah, I know that, its just that it only takes someone to sign up and then trawl through the memberlist

[Jack.R.Abbit]

true... i was thinking only of guests.  

[oldiesmann]

I just thought of something that would make this mod a little bit nicer... I get tired of seeing "fatal error" messages in the error log dealing with everything from people not logging in before they try to post to people trying to edit their profiles without being logged in, so instead of the "fatal error" line here, I suggest something like:

Code Select Expand

javascript:alert($txt[223);

[Jack.R.Abbit]

I think that there has been a bit of a move lately to use more js alerts for non-fatal errors like this.    However, there still should be the error checking that is there because if js is switched off, there is not alert... no alrt and the user has no feedback on what the hell just happened.. or didn't happen.

-Jack

[oldiesmann]

There's probably a way to code it so it determines whether or not Javascript is enabled...

[Wiziwig]

Thanks for the heads up on this info guys, added it to Supermod. also added disabled for guests boardindex list of members and search members view.