From ae967d16f1ad584d7e03b4466e6cc3d1d067dea6 Mon Sep 17 00:00:00 2001 From: Josh Woody Date: Mon, 5 Jul 2010 22:22:25 -0500 Subject: [PATCH] [ticket/9650] Do not allow banning the anonymous user by username Banning anonymous can result in bad things, like not being able to log in. However, it was possible until now. PHPBB3-9650 --- phpBB/includes/acp/acp_users.php | 5 +++++ phpBB/includes/functions_user.php | 7 ++++--- phpBB/language/en/acp/users.php | 1 + 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/phpBB/includes/acp/acp_users.php b/phpBB/includes/acp/acp_users.php index 7914edd056..2843480c04 100644 --- a/phpBB/includes/acp/acp_users.php +++ b/phpBB/includes/acp/acp_users.php @@ -231,6 +231,11 @@ class acp_users trigger_error($user->lang['CANNOT_BAN_YOURSELF'] . adm_back_link($this->u_action . '&u=' . $user_id), E_USER_WARNING); } + if ($user_id == ANONYMOUS) + { + trigger_error($user->lang['CANNOT_BAN_ANONYMOUS'] . adm_back_link($this->u_action . '&u=' . $user_id), E_USER_WARNING); + } + if ($user_row['user_type'] == USER_FOUNDER) { trigger_error($user->lang['CANNOT_BAN_FOUNDER'] . adm_back_link($this->u_action . '&u=' . $user_id), E_USER_WARNING); diff --git a/phpBB/includes/functions_user.php b/phpBB/includes/functions_user.php index 271542efdd..8d2fa14a4b 100644 --- a/phpBB/includes/functions_user.php +++ b/phpBB/includes/functions_user.php @@ -837,14 +837,15 @@ function user_ban($mode, $ban, $ban_len, $ban_len_other, $ban_exclude, $ban_reas FROM ' . USERS_TABLE . ' WHERE ' . $db->sql_in_set('username_clean', $sql_usernames); - // Do not allow banning yourself + // Do not allow banning yourself, the guest account, or founders. + $non_bannable = array($user->data['user_id'], ANONYMOUS); if (sizeof($founder)) { - $sql .= ' AND ' . $db->sql_in_set('user_id', array_merge(array_keys($founder), array($user->data['user_id'])), true); + $sql .= ' AND ' . $db->sql_in_set('user_id', array_merge(array_keys($founder), $non_bannable), true); } else { - $sql .= ' AND user_id <> ' . $user->data['user_id']; + $sql .= ' AND ' . $db->sql_in_set('user_id', $non_bannable, true); } $result = $db->sql_query($sql); diff --git a/phpBB/language/en/acp/users.php b/phpBB/language/en/acp/users.php index 8d9bf0d486..eda9659795 100644 --- a/phpBB/language/en/acp/users.php +++ b/phpBB/language/en/acp/users.php @@ -42,6 +42,7 @@ $lang = array_merge($lang, array( 'BAN_ALREADY_ENTERED' => 'The ban had been previously entered successfully. The ban list has not been updated.', 'BAN_SUCCESSFUL' => 'Ban entered successfully.', + 'CANNOT_BAN_ANONYMOUS' => 'You are not allowed to ban the anonymous account. Permissions for anonymous users can be set under the Permissions tab.', 'CANNOT_BAN_FOUNDER' => 'You are not allowed to ban founder accounts.', 'CANNOT_BAN_YOURSELF' => 'You are not allowed to ban yourself.', 'CANNOT_DEACTIVATE_BOT' => 'You are not allowed to deactivate bot accounts. Please deactivate the bot within the bots page instead.',