Login Problem

Hello Halil! The problem with phpBB bans is about that it can be issued by

username, email, IP.

The plugin code use just a simple function done years ago to check, when an user login into WordPress, if one of the above is on the ban list

On file class.wp.w3all-phpbb.php

The function about it is

public static function w3_phpbb_ban($phpbb_uid = '', $uname = '', $uemail = ''){

and it do the check about all the possibilities only when an user login in WP or the WP login flow fire.

It normally DO NOT run when an user is already logged in, because in this case, the ban check is done in

private static function verify_phpbb_credentials(){

within the query that check for user’s session. In this case the check is done each time the WP load but the ban check, is done only in this way as explained

 // Banned Deactivated trick // +- the same is done into w3_check_phpbb_profile_wpnu()
 // Check for ban_id: if not empty $phpbb_user_session[0]->ban_id then almost a ban by IP or EMAIL or USERNAME exists
 // Do not know if there is some other ban row that can exists into 'banlist', because only the first found retrieved into the query above

 // The complete ban check is done when user login in wordpress, because on the above main query this has been removed
 // REMOVED
      //OR ". $w3all_config["table_prefix"] ."banlist.ban_email = ". $w3all_config["table_prefix"] ."users.user_email AND ban_exclude = 0
      //OR ". $w3all_config["table_prefix"] ."banlist.ban_ip = ". $w3all_config["table_prefix"] ."sessions.session_ip AND ban_exclude = 0
 // THESE ARE ONLY EXECUTED, WHEN USER LOGIN (ON WP)
 // LIKE PHPBB DO: to cause an immediate user logout, the user in phpBB NEED to be banned by username! (so it is stored as ban_userid value)

 if( !empty($phpbb_user_session[0]->ban_id) && !defined("W3BANCKEXEC") ){

  if( $current_user->ID > 1 )
  {

  if( $phpbb_user_session[0]->ban_end == 0 OR $phpbb_user_session[0]->ban_end > time() ){ // no further check necessary, the only one ban value retrieved here, is a ban that never expire or that is still active
     setcookie ("w3all_set_cmsg", "phpbb_ban", 0, "/", $w3cookie_domain, false);
     //$wpdb->query("UPDATE $wpu_db_utab SET meta_value = 'a:0:{}' WHERE user_id = '$wp_user_data->ID' AND meta_key = 'wp_capabilities'");
     self::w3all_wp_logout('wp_login_url');
  }

    # NOTE TODO: could be set the bruteforce record for this user (also) here, so at next time, the code flow will stop more above without wasting resources until here
    # If a ban exist, even if expired, check by the way this user for bans
    # w3_phpbb_ban() function will remove expired bans: so the next time we'll be here up and running, in case

   if( self::w3_phpbb_ban($phpbb_u, $phpbb_user_session[0]->username, $phpbb_user_session[0]->user_email) === true && $phpbb_user_session[0]->group_name != 'ADMINISTRATORS' OR $phpbb_user_session[0]->ban_userid > 2 && $phpbb_user_session[0]->group_name != 'ADMINISTRATORS' )
   {
    setcookie ("w3all_set_cmsg", "phpbb_ban", 0, "/", $w3cookie_domain, false);
     self::w3all_wp_logout('wp_login_url');
   }

  }
 } // end ban

Said that i have in mind many improvements so if you note some problem just report please!

On October i will be (though) ready to publish some code about how to make phpBB so to looks like Discourse.

The Posts Reply code, to me require to be changed in favor of something that display all posts within the topic, also into the normal flow, and not removing them until not added as replies into the post due to a click into Show replies button. I am not sure but seem that DIscourse works like this.

To do this, i should change the code so to assign a different post ID to those that appears as posts replies when Show Replies button is clicked.

This because, the idea is to let it work all together:

Vertical Views, Posts Slider, Posts Replies.

To make it work Posts Replies with the other two, the code require to be changed and it can be changed in several way so to accomplish with any result. Let see what i can do with the time i have or finally i will GIthub all so to check if some smart guy can help on improve!

• This reply was modified 6 months, 3 weeks ago by axew3.

But as said, it should not interfere with the redirects flow when it fire.

Thinking on what could be… the solution?

if( isset($_SERVER['REQUEST_URI']) && strpos($_SERVER['REQUEST_URI'], 'wp-login.php') OR isset($_SERVER['SCRIPT_NAME']) && strpos($_SERVER['SCRIPT_NAME'], 'wp-login.php') OR isset($_SERVER['PHP_SELF']) && strpos($_SERVER['PHP_SELF'], 'wp-login.php') OR isset($_SERVER['SCRIPT_FILENAME']) && strpos($_SERVER['SCRIPT_FILENAME'], 'wp-login.php') )
    	{ wp_redirect( admin_url() ); exit();
    		}

    # if all the above failed on redirect
    if ( empty( $_REQUEST['redirect_to'] ) OR empty($redirect_to) ) {
     # WILL BE REMOVED
     # wp_redirect( admin_url() ); exit();
    }

This remove the problem and redirect the user to the profile just in case the page the user is on after the session have been set and the user logged in (based on the presented session phpBB cookie) is wp-login.php (because WP default do not redirect if a logged in user visit the wp-login.php page).

But ok it is just a plus. On next version will be so fixed/removed. Just remove it in the while.

w3_phpbb_ban() only run when strictly necessary and do not impact the site performance so why you removed the function w3_phpbb_ban ?

And how? Just placing a return false; in it, or removing the call to it?

• This reply was modified 6 months, 1 week ago by axew3.