UBB.Developers Forums UBB.threads 7 Development How Do I? I have a user

That swears he can read ip addresses even though I have them turned off. To prove it he can actually tell me the correct ip address of anyone on my board. He also told one of my moderators that he can do whatever he wants to do in the forums. He said that he can become an admin, edit profiles, whatever he wants to do. He even said he can take admin priviledges away from an admin if he wanted. I know that he wouldn't do anything malicious and he is also a computer genius. He knows more than anyone I have ever met. Do you all think he is being truthful? Also I have html and ubbcode turned on in all the forums. Is that a security risk? I have checked the groups he is in and he is not in any moderator or admin group. Like I said, I'm not worried too much about him but if he can do what he says, someone else might be able to. Thanks in advance. I have version 6.2 if it matters.

Make sure he doesn't know how to login using an admin's user name or have control panel or phpMyAdmin access into the database. That's the only way you could do soemthing.

Looks like you are using 6.2 - there is a bug in 6.2 that the print thread/print post screen will show you the poster's IP address in the title of the window.

I think there's a fix for it posted over at infopop community if you want to tighten it up so he can't see the IP addresses.

If you can't find it let me know and I'll search for the fix.

[]I have html and ubbcode turned on in all the forums. Is that a security risk?[/]

Yes. HTML should not be allowed. There are security checks, but considering the number of problems with this in the past, it's likely there are additional holes that haven't been found yet.

OK I'll turn off html. He has pm'd with me while he was telling me the ip addresses. He didn't log in as someone else. I know that for a fact. I have talked to a couple of the mods here in private about this very issue and they checked the print thread thing and said it was fine.

When I visit your site - if I do the print post/print thread thing - I can see IP addresses.

LOL I'm glad you can cuz I can't when I'm signed in as a regular user. A couple of the mods here checked it out and they said they couldn't see them. Well, let me go look for the mod for that then. Thanks!


Actually since you told me where to look, I can see them now. Thanks, that puts my mind at ease alot.

OK - I think this is it.

In printthread.php

Find this:

list($current,$posted,$counter,$tsubject) = $dbh -> fetch_array($sth);


Change to this:

list($current,$posted,$counter,$ip,$tsubject) = $dbh -> fetch_array($sth);



That should fix it.

Done. Again, you are the man. That took care of it. Thanks alot

I put in the original printthread.php to check it out and I can see the ip number of the original poster only. He did tell me the correct ip address of an anonymous poster that was about halfway down the thread. Any ideas or am I doing it wrong?

If you do print post rather than print thread then you'll see just that post (and thus it'll be the IP address you can see).

The print thread link is at the bottom and the print post is the printer icon part of each post.

That fix should fix both.

LOL How dumb am I? That is probably exactly what's happening. I knew there was a print post icon there somewhere but I hadn't found it after searching for it for a few hours. Thanks again!