Modification: vBulletin usershare

[juven14]

I moved this thread to the module's thread in the modules forum.

[vissa]

The following posts seem to illustrate the biggest issue that currently exists with the vbulletin integration mod. This applies to people who already have forums.
(please read posts below from top down)
To me this is a logical error (bug) in the design as users can fake accounts. Although forcing all registrations through the forum (as suggested) is one solution, it would be much better to simply have 68classifieds check if the username exists on the forum and not allow it (require a different name). It doesn't seem that hard to do since the mod is pretty much already doing that for logins. Can it be implemented PRETTY PLEASE? Requiring everyone to register at the forum is not ideal for me since it's two separate websites.

Thank You,
-vissa

Originally Posted by vissa

Thanks.
What happens if someone tries to register at the classifieds with the username of someone that ALREADY exists on the forum (that hasn't logged into the classifieds).? I'm worried about someone impersonating a forum member that never used the classifieds system. In your description, it sounds like that could happen.

Originally Posted by suzkaw

I just tested this and if you are registered for vbulletin and have not signed into the classifieds then some one could signup with your username.

However as a workaround you could just disable the userjoin.php file and handle all registrations from vbulletin which would not allow any one to use the same username.

Originally Posted by vissa

Hmm, is there any way to fix this? It would seem easy enough since it checks vbulletin when you try to log-in, couldn't it check vbulletin when someone tries to register with the same account and just reject it? Seems like a bug or a logic error to allow it the way it is. I guess you could funnel everyone through vbulletin, but that might be confusing to people who are only coming for the classifieds. Please let me know what you think .....

[bobsmith]

Still would prefer a full bridge for vb & 68c, with only single login -- will maintain session between vb & 68C. Would be willing to pay $$ for it...

Wondering how many others would be willing to pay for it? If we have enough demand, maybe someone would be willing to develop it.

[vissa]

I have discovered a bug using the vbulletin usershare module

If a user registers at your classifieds site with the same name as an existing user in your forum (but one that has never logged into the classifieds site), the usershare will create a DUPLICATE user in the vbulletin forum. I tested this myself. This will be a second user in your forum with the exact same name as another (which is never allowed). All kinds of problems can result.

The simplest solution (seems easy enough) is to have the module check to see if the username exists in the forum, and if so, reject that username. This would solve so many problems and eliminate this bug.

-vissa

[vissa]

I was looking at the code in Register.php

Couldn't something simple be added here to check the vbulletin database? Returning code 3 means it's a duplicate account/email

PHP Code:

                // First check login and email are unique in user table
                $sql = "SELECT * FROM  
                   ".PREFIX."users
                WHERE
                   username='".$username."'        
                OR
                   email='".$email."'";              
                $result = $this->db->query($sql);  

                if ( $result->size() > 0 )
                {
                        return 3;      
                }


-vissa

[vissa]

I was able to work around the bug above by writing my own code.

However, now I have discovered a second bug (though you may not consider it one depending on your forum setup). I verified this with a clean module install.

Basically, a new user registration at the classifieds is instantly added to the forum usergroup you select. Unfortunately, this happens before the user has validated their email address (by clicking the link back to the classifieds site from their email). This means that non-verified users are able to post on your forum regardless of your forum settings. Not good for a forum like mine that requires email validation. A simple fix would be to have the module add the user to the forum only after they click the validation link -- however this requires some additional changes I don't have the time for yet.

I really think this module should have additional work done to before it is sold as ready for prime-time. This vbulletin module is what made me go with 68classifieds in the first place.

-vissa

[vissa]

Another more important problem -- will request support for this one.
I am likely going to scrap the whole 68c reg system and just let people register on the forum (and login through 68c) using this module.

However, now I notice (with 3.1.7) that when a new 68c user (that exists in the forum) tries to log into 68c, it rejects him with "I am sorry, but your username or password is incorrect." However, in reality it does create the user in 68c. If the user tries to login a second time, it will let them correctly.

Any idea what is causing this behavior which essentially forces a forum user to log in twice the first time (first looking like an error)?

-vissa

[vissa]

Uhg, found another major logical error/bug with this paid 68c/vbulletin module.

If a user registers through your forum, REGARDLESS of their membership status (banned, awaiting confirmation, etc). They will be granted full access to the 68c classifieds site when attempting to log in there. Major problem!

Can someone responsible for this mod PLEASE spend a few hours and work out the kinks? They are not that difficult to correct pragmatically (at least by giving options). It's a great idea and just looks like it needs some finishing touches.

-vissa

[vissa]

I was able to write a dirty fix for several of the above problems. With the state of things now, I would suggest using your forum for all registrations.

-vissa