http://bbpress.org/forums/ bbPress Support Forums Tag: blocked en Fri, 09 Jan 2009 02:42:39 +0000 http://bbpress.org/forums/topic/blocking-a-user-does-nothing#post-17545 Wed, 23 Jul 2008 00:58:11 +0000 Nightgunner5 17545@http://bbpress.org/forums/ <blockquote><p><code>I don&#39;t see how a user could both be logged in AND have a broken password. If their password is broken, they can&#39;t login.</code></p></blockquote> <p>Maybe they were still logged in while they got blocked. </p> http://bbpress.org/forums/topic/blocking-a-user-does-nothing#post-17542 Wed, 23 Jul 2008 00:21:06 +0000 _ck_ 17542@http://bbpress.org/forums/ <p>Oh wait, here's the broken part in <code>bb-settings.php</code><br /> <pre><code>do_action(&#39;bb_init&#39;, &#39;&#39;); if ( bb_is_user_logged_in() &#38;&#38; bb_has_broken_pass() ) bb_block_current_user();</code></pre> <p>I don't see how a user could both be logged in AND have a broken password. If their password is broken, they can't login.</p> <p>This might have broken during the radical password/cookie changes in &gt;0.8</p> <p>I opened a TRAC ticket<br /> <a href="http://trac.bbpress.org/ticket/899" rel="nofollow">http://trac.bbpress.org/ticket/899</a> </p> http://bbpress.org/forums/topic/blocking-a-user-does-nothing#post-17541 Wed, 23 Jul 2008 00:08:47 +0000 _ck_ 17541@http://bbpress.org/forums/ <p>Block may never have worked like one would think.<br /> I think it just treats them like "bozo" status.<br /> It gives them the capability of "not_play_nice" = true</p> <p>hmm actually...<br /> <pre><code>function bb_block_current_user() { global $bbdb; if ( $id = bb_get_current_user_info( &#39;id&#39; ) ) bb_update_usermeta( $id, $bbdb-&gt;prefix . &#39;been_blocked&#39;, 1 ); // Just for logging. bb_die(__(&quot;You&#39;ve been blocked. If you think a mistake has been made, contact this site&#39;s administrator.&quot;)); }</code></pre> <pre><code>function bb_reset_password( $key ) { global $bbdb; $key = sanitize_user( $key ); if ( empty( $key ) ) bb_die(__(&#39;Key not found.&#39;)); if ( !$user_id = $bbdb-&gt;get_var( $bbdb-&gt;prepare( &quot;SELECT user_id FROM $bbdb-&gt;usermeta WHERE meta_key = &#39;newpwdkey&#39; AND meta_value = %s&quot;, $key ) ) ) bb_die(__(&#39;Key not found.&#39;)); if ( $user = new BB_User( $user_id ) ) : if ( bb_has_broken_pass( $user-&gt;ID ) ) bb_block_current_user(); if ( !$user-&gt;has_cap( &#39;change_user_password&#39;, $user-&gt;ID ) ) bb_die( __(&#39;You are not allowed to change your password.&#39;) );</code></pre> <p>.<br /> According to all that, their password should be scrambled and they should be unable to reset it - so they can't log in.</p> <p>But you can't stop them from seeing the website.<br /> There's no IP based blocking (yet) in bbPress.</p> <p>To really block an IP, you'd have to go into htaccess and add a "deny from" - at least for now.</p> <p>I guess someone could write a plugin to block the IP of blocked users, perhaps for 48 hours or so. Since bbPress doesn't store the last login IP for users by default, this makes it difficult, the plugin would have to start storing IPs on every login. </p> http://bbpress.org/forums/topic/blocking-a-user-does-nothing#post-17537 Tue, 22 Jul 2008 20:36:37 +0000 chrishajer 17537@http://bbpress.org/forums/ <p>I confirmed this as well. I created a new member, logged out, logged in as admin, marked new member blocked, logged out, logged in as new member, everything appears fine. In the admin panel, the user is marked as blocked.</p> <p>So, what *is* supposed to happen when a blocked member tries to log in?</p> <p>I noticed that the blocked member cannot edit their profile: there's just one tab there: Profile. </p> http://bbpress.org/forums/topic/blocking-a-user-does-nothing#post-17535 Tue, 22 Jul 2008 20:02:34 +0000 Nightgunner5 17535@http://bbpress.org/forums/ <p>Right under the place roles are changed is the text:</p> <p><code>Inactive users can login and look around but not do anything. Blocked users just see a simple error message when they visit the site.</code></p> <p>However, when I made a test account and marked it as blocked, I could still log in with the account and there was no error message.</p> <p>Why is this a problem and how can I fix this?</p> <p>P.S. I tried this on a test install of trunk and a test install of 0.9.0.2, both gave the same result.</p> <p>Edit: I just found out that blocking breaks passwords reversably, and only gives an error message if the user is already logged in. </p> http://bbpress.org/forums/topic/blocking-user-is-not-working#post-10242 Fri, 17 Aug 2007 10:03:05 +0000 zapata 10242@http://bbpress.org/forums/ <p>any help please? </p> http://bbpress.org/forums/topic/blocking-user-is-not-working#post-10234 Fri, 17 Aug 2007 01:52:47 +0000 zapata 10234@http://bbpress.org/forums/ <p>I usually set the status to "Blocked" in bbPress whenever one of the group blog authors leaves or retires, so as to block the author of my WordPress blog from accessing the bbPress too. </p> <p>But today I retired an author and changed the status to Blocked in bbPress but find that the author can still log in... </p> <p>I simply want the author blocked and not deleted, as the authors' posts will still be active on the Wordpress blog. </p> <p>I may be mistaken but I thought Blocked had worked for me in the past. Could a new version of "Role Manager" plugin in my wordpress be messing this up...</p> <p>or is there anyway to make "Blocked" work again? would appreciate any help on this. </p> http://bbpress.org/forums/topic/registration-spam-038-akismet#post-6388 Thu, 05 Apr 2007 04:59:29 +0000 rimian 6388@http://bbpress.org/forums/ <p>Hey Trent that sounds like a clever solution.</p> <p>I've just written a workaround for my site by renaming a few of the form fields with str_replace on the /register.php page and then modifying the $_POST array on the mytemplate/register.php page to listen for these renamed fields. </p> http://bbpress.org/forums/topic/registration-spam-038-akismet#post-6274 Sun, 01 Apr 2007 14:20:25 +0000 Trent 6274@http://bbpress.org/forums/ <p>There is a plugin to <a href="http://bbpress.org/plugins/topic/44?replies=1">limit registration</a> on your bbPress and I use the Custom Profile plugin myself for helping in spam registration. I just create a couple of 'required fields' followed by a couple 'non required fields' and then end with 'another required field' for registration. No bot has figured it out yet.....!</p> <p>Trent </p> http://bbpress.org/forums/topic/registration-spam-038-akismet#post-6270 Sun, 01 Apr 2007 11:50:48 +0000 rimian 6270@http://bbpress.org/forums/ <p>Only one a day? I bet you get more now. I get one every 2 hours.</p> <p>I'd like to know how they find my site. I'm going through my logs to see how. </p> http://bbpress.org/forums/topic/registration-spam-038-akismet#post-3171 Sat, 13 Jan 2007 00:27:57 +0000 ear1grey 3171@http://bbpress.org/forums/ <p>I've cranked out a trac <a href="http://trac.bbpress.org/ticket/542">ticket</a> for this, though it's not clear if the Akismet code is part of the core or not. </p> http://bbpress.org/forums/topic/registration-spam-038-akismet#post-3109 Fri, 12 Jan 2007 06:08:54 +0000 Trent 3109@http://bbpress.org/forums/ <p>I use Ardentfrosts plugin even on sites that I don't show the memberlist to the public for this very reason. It works great. It even works now with the integration and using WP users. While this is a short term solution for me, I really hope that registrations can be 'anti spammed' as well. It is annoying because all BOZO's make it over in the WP side with integration....</p> <p>Trent </p> http://bbpress.org/forums/topic/registration-spam-038-akismet#post-3095 Thu, 11 Jan 2007 14:54:05 +0000 ardentfrost 3095@http://bbpress.org/forums/ <p>Install my Member List plugin. It makes it VERY easy to delete users. I spend 30 seconds doing it every few days.</p> <p>If you couple it with the onlinelist by... who did that one, mbyte? Anyhow, if you install that one too, you can see if the user has ever visited your site from their profile menu so you don't delete any REAL users.</p> <p>I know it's not the best solution (the best being one that is automatic) but it's a quick one. </p> http://bbpress.org/forums/topic/registration-spam-038-akismet#post-3094 Thu, 11 Jan 2007 10:34:58 +0000 ear1grey 3094@http://bbpress.org/forums/ <p>My bbpress forum is now averaging one registration spam per day - where a user registers, adds their pills or porn site details to the <code>website</code> field, then never visits again.</p> <p>Check your registrations guys 'n' gals, you may find you have a lot of unwanted members (*cough*) linked from your sites.</p> <p>I'm thinking it's time registration requests went through Akismet - but for this to happen there would have to be a UI for spotting false positives.</p> <p>See also: <a href="http://bbpress.org/forums/topic/494">Links to bozos and blocked users</a>. </p> http://bbpress.org/forums/topic/links-to-bozos-and-blocked-users#post-2780 Mon, 01 Jan 2007 22:14:37 +0000 ear1grey 2780@http://bbpress.org/forums/ <p>Indeed, though I've only seen once instance so far where the spammers have bothered to leave a comment. My guess is that it's too difficult to write a robot that can leave intelligent spam, so they're hedging their bets and hoping not to be spotted lurking in the profile pages - if you can achieve that on several thousand instances you've suddenly got a whole lot of pagerank coming your way.</p> <p>Perhaps another useful tool would be to list the lurkers (similar to how bozos &#38; blocked users can be listed in the <code>Users</code> admin tab) where <code>a lurker</code> is someone who's registered but not commented. </p> http://bbpress.org/forums/topic/links-to-bozos-and-blocked-users#post-2779 Mon, 01 Jan 2007 21:39:06 +0000 thomasklaiber 2779@http://bbpress.org/forums/ <p>The next thing is, every Username links to the Website, too.</p> <p>But as i looked quickly throuh the functions I think this is something for a core change. The users website is passed from <code>get_profile_info_keys()</code> in an array to <code>bb_profile_data()</code>. This function generates the data-List and makes the Link clickable .. but there is no point where you can add a Plugin.</p> <p>The array from <code>get_profile_info_keys()</code> is passed trough a filter, maybe something like a <code>if (in_array(...))</code> in the filter ...?</p> <p>Just a thought... </p> http://bbpress.org/forums/topic/links-to-bozos-and-blocked-users#post-2775 Mon, 01 Jan 2007 19:31:31 +0000 ear1grey 2775@http://bbpress.org/forums/ <p>I'm seeing registrations for users whose "website" URL is very dubious (including adult stuff that would make most people blush). They're obviously only registering for the link because they don't leave any comments. </p> <p>If the admin goes along with the recommended action of marking the user as blocked (rather than deleting), then their link is still visible in the profile page. i.e. They win.</p> <p>So I'm imagining a core enhancement or a plugin that adds a filter so that any user who is marked as bozo/blocked has their details passed through a sanitizer which removes anything that looks like a URL before it's passed to the UI. </p>