Products

Solutions

Resources

Partners

Community

Blog

About

QA

Ideas Test

New Community Website

Ordinarily, you'd be at the right spot, but we've recently launched a brand new community website... For the community, by the community.

Yay... Take Me to the Community!

Welcome to the DNN Community Forums, your preferred source of online community support for all things related to DNN.
In order to participate you must be a registered DNNizen

HomeHomeDNN Open Source...DNN Open Source...Module ForumsModule ForumsForumForumWorkaround for anonymous posting problem – comments are welcomeWorkaround for anonymous posting problem – comments are welcome
Previous
 
Next
New Post
10/21/2009 5:00 PM
 


I devised a crude workaround to the Forum Module anonymous posting problem.

  1. I created user Guest and published its password.
  2. I made some programatic minor changes to prevent this user from changing its own parameters, including password.

There are several drawbacks to this method:

  1. Anyone logged in as Guest can edit any post by any other Guest.
  2. The user will still have to login as Guest though it there is no logical reason for doing so.
  3. The Guest will not receive notifications (but this is an inherent problem).

Code changes marked yellow:

File \admin\Users\ManageUsers.ascx.vb:

Private Sub Page_Init(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Init

If UserInfo.Username = "Guest" Then UserId = -1


'Set the Membership Control Properties
ctlMembership.ID = "Membership"
ctlMembership.UserId = UserId

'Set the User Control Properties
ctlUser.ID = "User"
ctlUser.UserId = UserId

'Set the Roles Control Properties
ctlRoles.ID = "SecurityRoles"
ctlRoles.ParentModule = Me

'Set the Password Control Properties
ctlPassword.ID = "Password"
ctlPassword.UserId = UserId

'Set the Profile Control Properties
ctlProfile.ID = "Profile"
ctlProfile.UserId = UserId

'Set the Services Control Properties
ctlServices.ID = "MemberServices"
ctlServices.UserId = UserId

'Customise the Control Title
If AddUser Then
If Not Request.IsAuthenticated Then
'Register
Me.ModuleConfiguration.ModuleTitle = Services.Localization.Localization.GetString("Register", Me.LocalResourceFile)
Else
'Add User
Me.ModuleConfiguration.ModuleTitle = Services.Localization.Localization.GetString("AddUser", Me.LocalResourceFile)
End If
End If

End Sub


 

File \admin\Skins\User.ascx.vb:

Private Sub Page_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
Try
' public attributes
If CssClass <> "" Then
cmdRegister.CssClass = CssClass
End If

If Request.IsAuthenticated = False Then
If PortalSettings.UserRegistration <> PortalRegistrationType.NoRegistration Then
If Text <> "" Then
If Text.IndexOf("src=") <> -1 Then
Text = Replace(Text, "src=""", "src=""" & PortalSettings.ActiveTab.SkinPath)
End If
cmdRegister.Text = Text
Else
cmdRegister.Text = Localization.GetString("Register", Localization.GetResourceFile(Me, MyFileName))
End If
If PortalSettings.Users < PortalSettings.UserQuota Or PortalSettings.UserQuota = 0 Then
cmdRegister.Visible = True
Else
cmdRegister.Visible = False
End If
Else
cmdRegister.Visible = False
End If
Else
Dim objUserInfo As UserInfo = UserController.GetCurrentUserInfo
'If (objUserInfo.UserID <> -1) And (objUserInfo.UserID <> 3) Then
If objUserInfo.UserID <> -1 Then
cmdRegister.Text = objUserInfo.DisplayName
cmdRegister.ToolTip = Localization.GetString("ToolTip", Localization.GetResourceFile(Me, MyFileName))
End If

If objUserInfo.Username = "Guest" Then
cmdRegister.ToolTip = "You cannot edit your Account Profile"
cmdRegister.ForeColor = Color.LightGray
End If

End If

Catch exc As Exception 'Module failed to load
ProcessModuleLoadException(Me, exc)
End Try
End Sub

 

 

 
New Post
10/21/2009 5:56 PM
 

I fear, your modifications might open security issues. I would feel safer using a forums product, which supports anonymous posts out of the box. 


Cheers from Germany,
Sebastian Leupold

dnnWerk - The DotNetNuke Experts   German Spoken DotNetNuke User Group

Speed up your DNN Websites with TurboDNN
 
New Post
10/21/2009 8:24 PM
 

I agree with Sebastian on this one. I also don't think the way you are going about this will result in a good thing. However, the module itself is already setup for a move to allow anonymous posting. First, the UserID of -1 will be properly handled by the system, it will display Anonymous on the front end anywhere UserID = -1 (this is to handle deleted users too). Second, the data store itself is already full prepared for this (meaning, no foreign key rules will be broken).

The only modifications you should need to make would involve the posts display (components\UI\Posts.vb, ModuleSearch.vb), the new thread buttons (Posts.vb, Threads.vb, ModuleSearch.vb) and Forum_PostEdit.ascx.vb. In all of the files, you need to remove any checks for Request.IsAuthenticated unless otherwise specified (or it doesn't make sense. ie. Showing edit post to an an unauthenticated user should never happen). In fact, throughout the code I even have comments about where and where not to do this for anonymous posting (although I am not sure it is 100% complete, it is in most areas). The only other codeI think you may need to review is within components\security. If you are separating start post permissions and reply permissions (basically, if your forum has posting restrictions) you will really need to review the ModuleSecurity.vb file in full (A forum without posting restirctions should never check for the IsAllowedToStartRestrictedThread or IsAllowedToPostRestrictedReply properties) .

The one thing I must note about this, there will be no on/off switch for this unless you change the permissions grid in the module (or add your own) so this will open the door for anonymous posting in all forums where an anonymous user can view the forum. Also, this is all off the top of my head so there may be something I am forgetting about.


Chris Paterra

Get direct answers to your questions in the Community Exchange.
 
New Post
10/23/2009 8:09 AM
 

Thank you both of you for your replies. I did mention the security problems I'm aware of. I wander if there are additional ones I over look. As for the solution suggested here - I wish it was offered as a compiled branch. I do not have the means (VB2008) to build it.

 
Previous
 
Next
HomeHomeDNN Open Source...DNN Open Source...Module ForumsModule ForumsForumForumWorkaround for anonymous posting problem – comments are welcomeWorkaround for anonymous posting problem – comments are welcome


These Forums are dedicated to discussion of DNN Platform and Evoq Solutions.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

  1. No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DNN.
  2. No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
  3. Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
  4. No Flaming or Trolling.
  5. No Profanity, Racism, or Prejudice.
  6. Site Moderators have the final word on approving / removing a thread or post or comment.
  7. English language posting only, please.
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out