User emails

[Pardis]

Hi

As I have many problems im mass emailing in phpBB 3,I found this php-script that alows me to get my forum user emails from database.

But anyone can run this script in my forum and rubbing users emails too if know filename ! So I want make changes on it so only ADMIN that logged in ACP can run this script,what changes should be make in this script to do it ?

Code: Select all

<?php
//Downloaded from www.Maghsad.com
// Do not change this part

if (!defined('IN_PHPBB'))
{
	exit;
}

$phpbb_root_path = './';
$phpEx = substr(strrchr(__FILE__, '.'), 1);
include($phpbb_root_path . 'common.' . $phpEx);
include($phpbb_root_path . 'includes/functions_display.' . $phpEx);

if ($_GET['fid']) { $fid = $_GET['fid']; }
	
    $sql = 'SELECT user_email FROM phpbb_users';
    $result = $db->sql_query($sql);
    while ($data = $db->sql_fetchrow($result)) {
		echo ','.$data['user_email'].',';
		echo '<br>';
    }

?>

[david63]

But anyone can run this script in my forum

Only if they know about it and where it is. Do not tell them then you do not have a problem.

[Pardis]

Yes,I dont twll anyone but I want not let anyone to steal emails

[Technocrat]

Code: Select all

    <?php
    //Downloaded from www.Maghsad.com
    // Do not change this part

    if (!defined('IN_PHPBB'))
    {
       exit;
    }

    $phpbb_root_path = './';
    $phpEx = substr(strrchr(__FILE__, '.'), 1);
    include($phpbb_root_path . 'common.' . $phpEx);
    include($phpbb_root_path . 'includes/functions_display.' . $phpEx);

    $user->session_begin();
    $auth->acl($user->data);
    $user->setup('acp/common');
    $user->setup('acp/cms');

    // Have they authenticated (again) as an admin for this session?
    if (!isset($user->data['session_admin']) || !$user->data['session_admin'])
    {
	//Change to redirect or what ever you want it to do if they are not admin.
	die();
    }

    if ($_GET['fid']) { $fid = $_GET['fid']; }
       
        $sql = 'SELECT user_email FROM phpbb_users';
        $result = $db->sql_query($sql);
        while ($data = $db->sql_fetchrow($result)) {
          echo ','.$data['user_email'].',';
          echo '<br>';
        }

?>

[Pardis]

Thanks alot,dear Technocrat,But have you tested this ? And how can I use it ?

I was saved your codes in a file and try to run,but when I try to run nothing happened !


What should I do If I want to add this script such as a module in ACP ?

[raybeam]

I tried the script but it doesn't seem to do anything...

[Nelsaidi]

It doesnt work because of

Code: Select all

    if (!defined('IN_PHPBB'))
    {
       exit;
    }

Thats means if the script is not running from WITHIN phpbb, it will not run.

What he meant to do was

Code: Select all

define('IN_PHPBB', true);

So try this script here

Code: Select all

    <?php

define('IN_PHPBB', true);
    $phpbb_root_path = './';
    $phpEx = substr(strrchr(__FILE__, '.'), 1);
    include($phpbb_root_path . 'common.' . $phpEx);
    include($phpbb_root_path . 'includes/functions_display.' . $phpEx);

    if ($_GET['fid']) { $fid = $_GET['fid']; }
       
        $sql = 'SELECT user_email FROM phpbb_users';
        $result = $db->sql_query($sql);
        while ($data = $db->sql_fetchrow($result)) {
          echo ','.$data['user_email'].',';
          echo '<br>';
        }

    ?>

[Pardis]

This code runs too even I never logged in phpBB !

I want ONLY ADMIN of forum can run it

[Nelsaidi]

Code: Select all

<?php
define('IN_PHPBB', true);
$phpbb_root_path = (defined('PHPBB_ROOT_PATH')) ? PHPBB_ROOT_PATH : './';
$phpEx = substr(strrchr(__FILE__, '.'), 1);
include($phpbb_root_path . 'common.' . $phpEx);

// Start session management
$user->session_begin();
$auth->acl($user->data);
$user->setup();

// Enter your username below, ie $username = 'Nelsaidi'
$username = '<username>';

if($user->data['username'] == $username){   
    $sql = 'SELECT user_email FROM phpbb_users';
    $result = $db->sql_query($sql);
    while ($data = $db->sql_fetchrow($result)) {
      echo ','.$data['user_email'].',';
      echo '<br>';
    }
}else{
    header("HTTP/1.0 404 Not Found");
    exit;
}
?>

Using that, you can have it only YOU can run it, NO ONE ELSE, this is based on phpbb3 login.

[farrington]

I think that a better solution is to use the permission system. You can let all users with administration permission use the script or limit it down to the FOUNDER.

FOUNDERS ONLY

Code: Select all

<?php
define('IN_PHPBB', true);
$phpbb_root_path = (defined('PHPBB_ROOT_PATH')) ? PHPBB_ROOT_PATH : './';
$phpEx = substr(strrchr(__FILE__, '.'), 1);
include($phpbb_root_path . 'common.' . $phpEx);

// Start session management
$user->session_begin();
$auth->acl($user->data);
$user->setup();

if (!$user->data['is_registered'])
{
   if ($user->data['is_bot'])
   {
      redirect(append_sid("{$phpbb_root_path}index.$phpEx"));
   }
   login_box('', 'LOGIN');
}
else if ($user->data['user_type'] != USER_FOUNDER)
{
   trigger_error('NOT_AUTHORISED');
}

$sql = 'SELECT user_email FROM phpbb_users';
$result = $db->sql_query($sql);
while ($data = $db->sql_fetchrow($result))
{
   echo $data['user_email'].'<br />';
}
?>

To grant access for administrators, change the line:

Code: Select all

else if ($user->data['user_type'] != USER_FOUNDER)

For all administators to this:

Code: Select all

else if (!$auth->acl_get('a_'))

For user administrators to this:

Code: Select all

(!$auth->acl_get('a_user'))

/marcus

[Pardis]

Dear nelsaidi and farrington thanks alot of your great helps.

I think how can use this script as a Module in ACP ?