Win a copy of Node.js Design Patterns: Design and implement production-grade Node.js applications using proven patterns and techniques this week in the Server-Side JavaScript and NodeJS forum!
  • Post Reply Bookmark Topic Watch Topic
  • New Topic
programming forums Java Mobile Certification Databases Caching Books Engineering Micro Controllers OS Languages Paradigms IDEs Build Tools Frameworks Application Servers Open Source This Site Careers Other Pie Elite all forums
this forum made possible by our volunteer staff, including ...
Marshals:
  • Campbell Ritchie
  • Ron McLeod
  • Rob Spoor
  • Tim Cooke
  • Junilu Lacar
Sheriffs:
  • Henry Wong
  • Liutauras Vilda
  • Jeanne Boyarsky
Saloon Keepers:
  • Jesse Silverman
  • Tim Holloway
  • Stephan van Hulst
  • Tim Moores
  • Carey Brown
Bartenders:
  • Al Hobbs
  • Mikalai Zaikin
  • Piet Souris

Question on authorization

 
Ranch Hand
Posts: 17424
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
I have a desperate need to modify JForum so that users who are locked can no longer access things like posting new messages or access PMs or any other non-public features. Ideally they would also not be able to log in or show up on the "logged in users" list. But that's less important than just not letting them post or PM.

What part of the JForum system would I start working on to make this possible? Where is the most logical place to put in a check: "if user is deleted / locked, do not allow user to post messages, send or read PMs?"

I would be happy to commit these patches back if anyone is interested. This is a super-urgent bug fix for me because my forum is in serious trouble if I can't exclude certain users.

[originally posted on jforum.net by CaliforniaCCW]
 
Migrated From Jforum.net
Ranch Hand
Posts: 17424
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
I've never used or looked at the banning stuff. But all the authentication and user set up is done in the Jforum.service method.

A quick scan thru the code indicates that the Jforum.shouldBan method is used to set up a call to the BanlistRepository.shouldBan. This walks thru a set of Banlist objects and compares ip, userid, and e-mail and seems to ban people if any of the three match.

That's my 5 minutes first look at the banning section of code.

Oh, I did notice a banlist.send.403forbidden config option. You might try setting this to true in the jforum-custom.conf to see if the problem is in the default "banned" action of the forums module.
[originally posted on jforum.net by monroe]
reply
    Bookmark Topic Watch Topic
  • New Topic