Question

I’m currently using a PHPBB2 forum for a section of one of my sites, and I would like to extend this site (add new pages, scripts, etc). I would like to restrict access to these pages to the users already logged in the PHPBB2 Forum.

In fact, if only members of a certain MemberGroup could access these pages, that would be great.

Is there a way to use the same login credentials on the rest of my site, and to check out which groups the members are from?

Thanks

(by the way, these pages are in PHP)

Answer 1

If a user is logged into PHPBB, there’s a good chance, though not always likely, that they will then have a cookie that you can read and help with checking who’s who against the database.

In this case, you’ll want to break the crumbs of the cookie below:

$_COOKIE['phpbb2mysql_data'] 

Let’s use an example and blow it out to find the data we need to query against the database. Below is the chunk found in the above cookie:

a:2:{s:11:'autologinid';s:0:'';s:6:'userid';s:1:'3';} 

For this, you’ll want to go in and extract that ‘3’ which happens to correspond to the logged in PHPBB user.

Unserialize that data to yank that user_id out:

 $goo = unserialize($_COOKIE['phpbb2mysql_data']);  $extracted_id = $goo['userid']; 

(Thanks to epochwolf on pointing out the above serialized form of that cookie)

That number will be good to run against the database to check out which group the member belongs to. And you would run the check against the phpbb_user_group table (if you had phpbb_ as the prefix of your forum tables.)

If you didn’t want to keep track of the group IDs from the database, then you will need to do some kind of join and test against the name. Maybe something like this:

SELECT pug.user_id FROM phpbb_user_group pug   LEFT JOIN phpbb_groups g   ON pug.group_id=g.group_id  WHERE pug.user_id='$extracted_id'  AND g.group_name='Foo'; 

If you can pull a row out of that, then you’ve found yourself a logged in user who belongs to that Foo group.