Development

And fixed in 7c4b93b.

I will have to remember to do this in #168, too.

To reproduce, click the Ban button without entering an username.

File: C:\xampp\htdocs\fluxbb145master\admin_bans.php
Line: 62

FluxBB reported: Unable to fetch group info

Database reported: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1 (Errno: 1064)

Failed query: SELECT g_moderator FROM groups WHERE g_id=

This should fix that, cheers.

Ah, sorry. So that's why the isset() check was there in the code above...

Ah, I think I forgot to hide the ban button for moderators on moderators' profiles. I will look into it.

There are 2 other ways to do this on the Bans page.
1) Edit an existing ban entry
2) Add a ban entry but don't enter the moderator's username on the 1st page, but do it on the 2nd page.

Ok, after Quy's recommendation I now prohibited banning moderators altogether in 8e3c445.

This could theoretically still be circumvented by banning the IP of a moderator (or administrator, for that matter). If you don't mind, I won't add this before 1.4.6, though.

In check_bans function, a partial/immediate solution is to add the default moderator group (PUN_MOD) to the check which would cover most installs.

    // Admins aren't affected
    if ($pun_user['g_id'] == PUN_ADMIN || !$pun_bans)
        return;

Still wondering whether this would be good. Banning administrators won't work anyway, so in some (rare, weird) cases you might actually want to ban their old IP.

For moderators, things get complicated. We'd also need to decide which IP address to use (the newest, I suppose) and whether that would cause any damage.

To be honest I wouldn't bother with worrying about banning IP addresses of moderators/admins, since due to dynamic IPs and so on it's basically impossible to make it work 100%.

Yes, because it does not make sense to ban an administrator/moderator and not move the banned user to a non administrator/moderator group.

Well, Quy, the problem would be that "evil" moderators could try to ban another moderator via their IP even though it shouldn't be possible at all.

That is why I suggested adding the default moderator group to be excluded in the check_bans function.

Gotcha, makes sense. Especially as I now prohibited banning moderators. I misunderstood your point earlier, sorry.

And thanks, I'll do that in a few minutes.

Ok, I've committed b4937b4, which does this in a slightly simpler way and for all moderators.
So we should really be done with this now.

One more, only slightly related thing: expired bans are not deleted when admins or mods browse the board, due to the way the check_bans() function is constructed. Should we change this?

Nah, they will be deleted when any non-admin/mod browses so that's good enough.