By ghosty on

Don't know if this works right, but I noticed in user_block_user_action in user.module (running Drupal 6) that the call to sess_destroy_uid($uid) is supposed to destroy the session for that uid. Does this mean that the current user can still roam around the website and look at authenticated content while still logged in? I thought this would automatically kick them out once run through this action.

Also, what is the use of this line:

watchdog('action', 'Blocked user %name.', array('%name' => check_plain($user->name)));

when the user name cannot be retrieved without the user object which is referenced only in the final else condition? I would think that for the first two conditions it would only print 'Blocked user .'

I'm a beginner with module dev. so I may just be missing some noodles here. :)

Thanks!

⋅ Categories: Drupal 6.x

Comments

jaypan’s picture

jaypan
Location Victoria, BC
commented

I think they can't view anything right away.

But, you can check this yourself. Open two browsers. Log in as an admin in one browser, log in as another user in the other. Surf a page to confirm you can see it. Switch to the admin browser, ban the user, switch back and try to reload the page.

Contact me to contract me for D7 -> D10/11 migrations.

ghosty’s picture

ghosty commented

Yeah, I tried surfing and I could still see it. I even closed my browser as the test user, reopened the browser and it was still fine. Finally, I logged out as the test user and only then was I blocked out trying to log back in. Seems very strange.