Blog [BLOG + CMS] image verification permissions problem in blog and CMS (hvcheck_post??)
 

Howdy. First, I should note that I am new to the vBulletin codebase so go easy. I am currently experiencing an issue which I believe is being caused by a permissions scope problem related to a user being in multiple groups.

The problem is that a superadmin user cannot comment on CMS articles or blog postings because they are also a member of a custom usergroup which requires image verification for posting and the image verification code is not displaying. My hunch is that the permissions check that decides whether that template should display the CAPTCHA is not the same as the one that checks whether the data sent by the user is sane and meets all requirements. I can live if the admin has to enter a CAPTCHA but in the current situation, they cannot do so because it is never shown.

In blogpost.php at line 1457 we have this code segment which checks for image verification if fetch_require_hvcheck() returns true and if so, forces a CAPTCHA verification and returns an error if it fails (this is not the display code, just the verification code):

Code:
if (fetch_require_hvcheck('post'))
{
require_once(DIR . '/includes/class_humanverify.php');
$verify =& vB_HumanVerify::fetch_library($vbulletin);
if (!$verify->verify_token($vbulletin->GPC['humanverify']))
{
$blogman->errors[] = fetch_error($verify->fetch_error());
}
}
There are two spots where "fetch_require_hvcheck" is defined, once in "includes/functions.php" and once on line 3704 of "includes/blog_functions.php". I am not sure which one is getting used as blog_post.php does not explicitly include either. The function definitions are quite different.

From "includes/blog_functions.php":

Code:
if (!function_exists('fetch_require_hvcheck'))
{
function fetch_require_hvcheck($action)
{
global $vbulletin;

return (!$vbulletin->userinfo['userid'] AND $vbulletin->options["hvcheck_{$action}"]);
}
}
This checks whether the user is logged in and whether the have a flag set for the action.

From line 5017 of "includes/functions.php"

Code:
function fetch_require_hvcheck($action)
{
global $vbulletin;

if (!$vbulletin->options['hv_type']
OR !($vbulletin->options['hvcheck'] & $vbulletin->bf_misc_hvcheck[$action]))
{
return false;
}

switch ($action)
{
case 'register':
{
$guestuser = array(
'userid' => 0,
'usergroupid' => 0,
);
cache_permissions($guestuser);

return ($guestuser['permissions']['genericoptions'] & $vbulletin->bf_ugp_genericoptions['requirehvcheck']);
}

case 'lostpw':
{
if ($vbulletin->userinfo['permissions']['adminpermissions'] & $vbulletin->bf_ugp_adminpermissions['cancontrolpanel'])
{
return false;
}
break;
}
}

return ($vbulletin->userinfo['permissions']['genericoptions'] & $vbulletin->bf_ugp_genericoptions['requirehvcheck']);
}
This function checks whether human verification is enabled and then a bunch of specific cases, all of which look different than the blog specific check.

My main questions at this point are:

Which function gets used for the editor display and which ones gets used for the sanity check after the article POST occurs? Where does the one that controls whether to display the CAPTCHA in the editing window occur?

Next, where do the various "$vbulletin->options['hvcheck']" type options actually get set?

Bonus points if you can explain how to correct the problem entirely.

=)

Any and all help appreciated.

Cheers