Web Wiz - Green Windows Web Hosting

  New Posts New Posts RSS Feed - Administering while forum is closed
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

Administering while forum is closed

 Post Reply Post Reply
Author
jckruger View Drop Down
Groupie
Groupie
Avatar

Joined: 18 April 2006
Location: Australia
Status: Offline
Points: 135
Post Options Post Options   Thanks (0) Thanks(0)   Quote jckruger Quote  Post ReplyReply Direct Link To This Post Topic: Administering while forum is closed
    Posted: 17 August 2007 at 2:15am
Removed by me as it is incorrect.


Edited by jckruger - 17 August 2007 at 11:47pm
Back to Top
jckruger View Drop Down
Groupie
Groupie
Avatar

Joined: 18 April 2006
Location: Australia
Status: Offline
Points: 135
Post Options Post Options   Thanks (0) Thanks(0)   Quote jckruger Quote  Post ReplyReply Direct Link To This Post Posted: 17 August 2007 at 7:02am

This seems to have worked: The redirect shown below has been removed from common.asp and moved to default.asp. I don't know if will make any other pages fail yet as it is just being tested.
UPDATED: Changes in RED


<% @ Language=VBScript %>
<% Option Explicit %>

<!--#include file="common.asp" -->
<%
' ############ New addition for Admins when the forum is closed ##########
If Request.QueryString("adminmode") = 1 then
  blnForumClosed = False
 End If
' ############ New addition for Admins when the forum is closed ##########

' ##################### Moved from common.asp ##############
'******************************************
'***       Redirect if forum is closed   ****
'******************************************

'If the forums are closed redirect to the forums closed page
If blnForumClosed AND blnDisplayForumClosed = False AND blnAdmin = False Then
   
    'Reset server objects
    Call closeDatabase()
   
    'Redirect to the forum closed page
    Response.Redirect("forum_closed.asp" & strQsSID1)
End If
' ##################### Moved from common.asp ##############
%>


<!--#include file="functions/functions_date_time_format.asp" -->


and in includes/status_bar_header_inc.asp


'Don't display normal status bar if forum is locked as it will course a loop with the AJAX
If blnForumClosed Then
   
%>
<table cellspacing="1" cellpadding="3" align="center" class="tableBorder">
 <tr class="tableStatusBar">
  <td>
   <div style="float:left;"><% = strBreadCrumbTrail %></div>
   <div style="float:right;"><%
 
'If the user is admin display a link to the admin menu
If intGroupID = 1 Then Response.Write("&nbsp;&nbsp;<img src=""" & strImagePath & "error.png"" style=""vertical-align: text-bottom"" />### FORUM IS CLOSED TO INTERNET USERS ###<img src=""" & strImagePath & "error.png""</a>&nbsp;&nbsp;&nbsp;&nbsp;")
If intGroupID = 1 Then Response.Write("&nbsp;&nbsp;<img src=""" & strImagePath & "admin_control_panel.png"" title=""" & strTxtAdminControlPanel & """ alt=""" & strTxtAdminControlPanel & """ style=""vertical-align: text-bottom"" />&nbsp;<a href=""admin.asp" & strQsSID1 & """>" & strTxtAdmin & "</a>")
If intGroupID = 1 Then Response.Write ("&nbsp;&nbsp;<img src=""" & strImagePath & "logout.png"" alt=""" & strTxtLogOff & """ title=""" & strTxtLogOff & """ style=""vertical-align: text-bottom"" /> <a href=""log_off_user.asp" & strQsSID1 & """>" & strTxtLogOff & " [" & strLoggedInUsername & "]</a>")
If intGroupID <> 1 AND intGroupID <> 2 Then Response.Write ("&nbsp;&nbsp;<img src=""" & strImagePath & "logout.png"" alt=""" & strTxtLogOff & """ title=""" & strTxtLogOff & """ style=""vertical-align: text-bottom"" /> <a href=""log_off_user.asp" & strQsSID1 & """>" & strTxtLogOff & " [" & strLoggedInUsername & "]</a>")


%></div>
  </td>
 </tr>
</table><%

'Else display the normal status bar


So if the forum is closed typing http://www.whatever.com/forum/default.asp?adminmode=1 lets you in.

Normal users when they go to default.asp see the forum is closed message and don't get a chance to log on at all.

If someone could check that this is still secure please post feedback.

If you wish to use this then you do at your own risk.

EDIT 18/08/07: Removed a not required variable


Edited by jckruger - 17 August 2007 at 11:54pm
Back to Top
Scotty32 View Drop Down
Moderator Group
Moderator Group


Joined: 30 November 2002
Location: Manchester, UK
Status: Offline
Points: 1682
Post Options Post Options   Thanks (0) Thanks(0)   Quote Scotty32 Quote  Post ReplyReply Direct Link To This Post Posted: 17 August 2007 at 2:10pm
looks very insecure

wouldnt it be better to have

if blnClosed = True and blnAdmin <> true then
   send to closed page
end if

you can login by going to www.yoursite.com/forum/admin.asp

looking at your code it appears you give anyone admin rights who enters that code - making it very insecure

*edit* by the way, look at the existing "forum closed" section in the common.asp file


Edited by Scotty32 - 17 August 2007 at 2:11pm
S2H.co.uk - WebWiz Mods and Skins

For support on my mods + skins, please use my forum.
Back to Top
jckruger View Drop Down
Groupie
Groupie
Avatar

Joined: 18 April 2006
Location: Australia
Status: Offline
Points: 135
Post Options Post Options   Thanks (0) Thanks(0)   Quote jckruger Quote  Post ReplyReply Direct Link To This Post Posted: 17 August 2007 at 11:47pm
I think you are referring to the first post. I'll remove that. It doesn't give admin access to anything. You still need to log on as usual. It just changes the blnforumclosed variable and only allows admins to view posts. Even if a general member found out what the querystring was when they log in they still get the forum is closed message. Test it out if you like.

Sorry I put a variable in there that I didn't really need so I'll edit it also.

Obviously you could make the query what ever you wanted and also the value what ever you wanted and not tell anyone what it is


Edited by jckruger - 17 August 2007 at 11:57pm
Back to Top
 Post Reply Post Reply

Forum Jump Forum Permissions View Drop Down

Forum Software by Web Wiz Forums® version 12.08
Copyright ©2001-2026 Web Wiz Ltd.


Become a Fan on Facebook Follow us on X Connect with us on LinkedIn Web Wiz Blogs
About Web Wiz | Contact Web Wiz | Terms & Conditions | Cookies | Privacy Notice

Web Wiz is the trading name of Web Wiz Ltd. Company registration No. 05977755. Registered in England and Wales.
Registered office: Web Wiz Ltd, Unit 18, The Glenmore Centre, Fancy Road, Poole, Dorset, BH12 4FB, UK.

Prices exclude VAT at 20% unless otherwise stated. VAT No. GB988999105 - $, € prices shown as a guideline only.

Copyright ©2001-2026 Web Wiz Ltd. All rights reserved.