UBB.Developers Forums UBB.threads 7 Development How Do I? Boot a user....

How can I boot a user while the user is logged in - essentially requiring me to expire their 'session' I guess?

Thanks,
Tom

I don't think you can - what you can do is to ban them - then they wouldn't be able to post any new messages - but I am not sure if this is what you want to achieve.

Thinking about this - I suppose you could database dive if you were really desperate - but a quick ban might be easier - it all depends upon what you are trying to achieve.

Well, currently, I have open registration but I require prerequisites to become a member and I also require specific information to be filled in when a user registers to make sure that they have those prerequisites. Yesterday, I had someone 'fake' the required prerequisite field and was logged on to the board. Cruising where they shouldn't have been.

What I did was ~
1. Changed their group
2. I banned their IP.
3. Closed the board.
4. Deleted their account.

What happened was ~ they were still able to cruise the board since their session cookie had all the right permissions. What I wanted to do was to terminate access at that point - instantly. Basically expiring their session cookie immediately by manually logging them out via admin CP.

Is there a way to do this ~ a hack maybe?

Thanks,

Tom

The permissions aren't stored in a cookie - the permissions are stored in the database - if you ban/change their group - they remain logged in (but you want that). But their permissions etc.... update instantly.

If you ban them that way they can't logout - it slows them down from registering another username to cause trouble. (An IP ban doesn't work like that, so a name ban is best).

Interesting you say the permissions are instant.

If the user is in a permission 'X' area and you change their permissions to exclude 'X', they are not kicked out of 'X' area. I watched 'Who's Online' and the user remained in 'X' area even after I changed permissions to exclude them from 'X' area???

What I ended up discovering was by removing permissions and using the 'Become this user' feature in the advanced admin hack to become the user and clicking the 'log out' link I acutally forced a new 'login' with restrictions in place. I also found that once I logged them out then immediately banned the account creates a very strange cached/cookie effect with the banned users browser. Kind of funny really.

But ~ thanks for all the replies.

Tom

Who's online is based off what script they are looking at.

If they already had it on their screen, then they aren't kicked out until they refresh or click somewhere.

But the authenticate() function takes care of this at the top of every script. There is absolutely no profile information stored in a cookie in any way, shape or form. The cookies have thier user number, their language, etc...

If they have a link to something that they aren't supposed to see - Who's online will report the real location - but what the user will actually be seeing a not_right() message stating that they aren't authorized blah blah.

A banned user will often keep clicking everything to see what they can see. The who's online will show them looking at stuff. But if it was a username ban they will be met with a "you are banned - Reason:" message on every page, and won't even be able to logout.

If it's an IP ban - well, in this day and age banning by IP address is pretty worthless. It's too easy to use a different IP address. But IP bans can still view and do everything - they simply cannot post.

A group change is instant (or as soon as they click somewhere/hit refresh to view something else).... hence why the myPaymentPal addon can add a user and give them instant access to hidden forums instantly after payment is made.

But the who's online page isn't really a good indication of this type of stuff - that only get's updated when the user refreshes/loads a page - and the location that YOU see is only based off the script they are viewing (the URL) and not what they actually can see.

Great explanation Josh - Thanks for the clarification.

Tom