Michael
Moderator
![[Avatar]](http://av.wservices.co.uk/av.png)
Recoding the future
Posts: 4,043
Status: Offline
Gender: Male
Location: UK
Joined:
Additional Groups:
Coding Team
pmvForum | | Re: Members List Staff Only (13th Jan 10 at 9:57pm UTC) | | Hmm.. What you're wanting is a bit harder actually. You'll have to check if it equals etc.
Group 1 + Group 3 | Group 1 + Group 4 | Group 2 + Group 3 | Group 2 + 4 Group
^^ Is that the grouping that you want?  | |
|
dog199200
Guest | | Re: Members List Staff Only (13th Jan 10 at 11:08pm UTC) | | yes as well as just group 2 and group 2. Group 3 and Group 4 are meant for the non-staff for the most part  | |
|
dog199200
Guest | | Re: Members List Staff Only (15th Jan 10 at 9:59pm UTC) | | anything? cause i seriously have no idea how to do the group check myself  | |
|
Michael
Moderator
Recoding the future
Posts: 4,043
Status: Offline
Gender: Male
Location: UK
Joined:
Additional Groups:
Coding Team
pmvForum | | Re: Members List Staff Only (15th Jan 10 at 10:29pm UTC) | | | Rather much harder to do tbh. to make it match two things when it's in an array, what's the problem with the current? | |
|
dog199200
Guest | | Re: Members List Staff Only (16th Jan 10 at 7:33am UTC) | | cause each staff account has two groups assigned, and I can't add those groups to the check because then the non-staff version of the groups can see then and thats what i'm trying to prevent.
Its rather complicated to explain, but the best i can say is that there is no posting groups, just the members groups (Free Member | Paid Member) and those are the groups i'm trying to prevent from seeing the members list. The thing is that the staff have to have those groups as well, but still need to see the user list where, i feel if it was public the list could be considered a privacy problem for members. Its bad enough that the URL in the suer profile contains the users username, which is a major security risk don't know why ross just don't change it from the username to the account-id, its more secure that way anyways despite the rambling i'm sure you understand why i need the code
Edit: I figured it just be easier to see if ross will integrate a feature like this. There is so many uses a a person can come up with when having the ability of being able to set who can view the members list. If it goes through i wont need this code, so i hope it does, but i will need something to that effect. I seriously wonder if ross would code custom features for a forum if he was paid good money to do so
| |
|
Michael
Moderator
Recoding the future
Posts: 4,043
Status: Offline
Gender: Male
Location: UK
Joined:
Additional Groups:
Coding Team
pmvForum | | Re: Members List Staff Only (16th Jan 10 at 11:49pm UTC) | | | I don't see why it's a security risk to know someone's username... Or for that matter, to see them on the member list! | |
|
dog199200
Guest | | Re: Members List Staff Only (17th Jan 10 at 12:13am UTC) | | the members list is a privacy problem cause not everyone like the idea of other people knowing what they are doing. I know i don't like the idea of people being able to find out if i play a game just by looking at a list of things.
as for the username, when knowing the username it just makes it that much easier to hack the users account. Especially with the admin account knowing the username of an account becomes a major security risk, cause i'm sorry, no place is unhackable, not even vforums, hell not even a vbulletin, but there are steps that can and should be taken to make it harder to do so its no secret, i'm running my game forum off of vforums because its easy for users to navigate and use, as well as its easy to integrate into everything else, but when its going to be a forum where hopefully thousands of people join and take part in, things like usernames and stuff shouldn't be shown at any point because there are people out there that are out to destroy others. | |
|
Michael
Moderator
Recoding the future
Posts: 4,043
Status: Offline
Gender: Male
Location: UK
Joined:
Additional Groups:
Coding Team
pmvForum | | Re: Members List Staff Only (17th Jan 10 at 12:18am UTC) | | | Knowing username, or userID is no different to anything. I honestly think you're being over cautious here..... | |
|
dog199200
Guest | | Re: Members List Staff Only (17th Jan 10 at 12:26am UTC) | | I'd being logical, i know there is going to be people complaining because of it. There is reasons why you never see video game websites displaying their members list, its because it is an invasion of privacy to the user, and so is displaying the username. At list if the username was changed to the userid that is assigned to each account anyways, it would knock out the risk of people getting upset thinking displaying the username they used is an invasion or privacy, as well as it would remove the possible security risk and help protect the members
All i'm doing is thinking from the point of view as if I was a member of the site. I can see perfectly how they can complain, because there is privacy issues with it displaying their info to the public and stuff like that. I'm sure there is people here on the forum that can understand what i'm saying and agree with why I am saying it. | |
|
Michael
Moderator
Recoding the future
Posts: 4,043
Status: Offline
Gender: Male
Location: UK
Joined:
Additional Groups:
Coding Team
pmvForum | | Re: Members List Staff Only (17th Jan 10 at 12:28am UTC) | | | Thing is though, by signing up people know what they're getting into. That will mean that you're not going to display names next to posts, in the info center, in the last post column. For that matter, remove profiles completely, remove the PM system.....? | |
|
dog199200
Guest | | Re: Members List Staff Only (17th Jan 10 at 12:38am UTC) | | I have the registration system setup so that they have to assign a display name upon registering, which they can't change after registering. I also have it so that when they click modify profile it redirects them to the website so they can only edit the information I allow them to edit, which is the basics like password, email, gender, avatar, all set so they can still set just what they want. As for the info center, that would display their assigned display name. The pm system would be the only other problem but that could always be set to check for a users display name.
Though i don't deny that its not perfect, i need to come up with a way to build a check to make sure the display name has not been used before, similar to the username check.
either way ross assigned an ID to every account that is made, i know this because I noticed it when printing out the array from the API, so it wouldn't be hard to chance http://support.virtualforums.co.uk/action/view_profile/user/username to http://support.virtualforums.co.uk/action/view_profile/user/1 but even if taht doesn't change, it still be more secure not allowing people to search through the members, then if they could | |
|
Michael
Moderator
Recoding the future
Posts: 4,043
Status: Offline
Gender: Male
Location: UK
Joined:
Additional Groups:
Coding Team
pmvForum | | Re: Members List Staff Only (17th Jan 10 at 12:45am UTC) | | | You wouldn't be able to change the vF system to use numbers instead of names. There's no way for you to get the username of the person from that etc. So no way that you could get it to still show the right profile. What if someone registers with a number username? | |
|
dog199200
Guest | | Re: Members List Staff Only (17th Jan 10 at 12:55am UTC) | | There's no way for you to get the username of the person from that etc.
Thats not true, you can still call the username query from the database, just find ways not to display it.
So no way that you could get it to still show the right profile. What if someone registers with a number username?
I thought about that too, and what is the odds? Plus its not liked it change anything if they had, no one will ever guess that, not even if the users userid and their username are exactly the same it would be ignored.
| |
|
Michael
Moderator
Recoding the future
Posts: 4,043
Status: Offline
Gender: Male
Location: UK
Joined:
Additional Groups:
Coding Team
pmvForum | | Re: Members List Staff Only (17th Jan 10 at 1:02am UTC) | | | To the first quote... I mean that on vF you can't get it to call the username from the User ID. | |
|
dog199200
Guest | | Re: Members List Staff Only (17th Jan 10 at 1:04am UTC) | | | not without a little bit for recoding, but if a check is done on the userid then check the username field assigned to that ID, i'm sure it can be called. Especially for a great coder like ross. | |
|
