Perhaps no one will use this feature ever, but I found a need for the following functionality.
I provide free forums at oxle, and paid 'private' forums.
The forums are created by me, and I then assign the person who requested the forum as moderator for that forum.
All well, but, I want to make sure that no one requests a free forum, and changes it to 'Allowed members list' by themselves.
However, as they're moderator, the base install gives them the right to change the Authentication Type.
So, to prevent that, I changed a small piece of post.asp.
The original code: (post.asp of version 3.4.05, lines 1126 - 1141)
if strPrivateForums <> "0" then
if strRqMethod = "Forum" or _
strRqMethod = "URL" or _
strRqMethod = "EditURL" or _
strRqMethod = "EditForum" then
if strRqMethod = "EditForum" or _
strRqMethod = "EditURL" then
ForumAuthType = rs("F_PRIVATEFORUMS")
else
ForumAuthType = 0
end if
Response.Write " <tr>" & vbNewLine & _
" <td bgColor=""" & strPopUpTableColor & """ noWrap vAlign=""top"" align=""right""><font face=""" & strDefaultFontFace & """ size=""" & strDefaultFontSize & """><b>Auth Type:</b></font></td>" & vbNewLine & _
" <td bgColor=""" & strPopUpTableColor & """>" & vbNewLine & _
" <select readonly name=""AuthType"">" & vbNewLine & _
" <option value=""0"""
The new code (in red)
if strPrivateForums <> "0" then
if strRqMethod = "Forum" or _
strRqMethod = "URL" or _
strRqMethod = "EditURL" or _
strRqMethod = "EditForum" then
if strRqMethod = "EditForum" or _
strRqMethod = "EditURL" then
ForumAuthType = rs("F_PRIVATEFORUMS")
else
ForumAuthType = 0
end if
Response.Write " <tr>" & vbNewLine & _
" <td bgColor=""" & strPopUpTableColor & """ noWrap vAlign=""top"" align=""right""><font face=""" & strDefaultFontFace & """ size=""" & strDefaultFontSize & """><b>Auth Type:</b></font></td>" & vbNewLine & _
" <td bgColor=""" & strPopUpTableColor & """>" & vbNewLine & _
" <select readonly "
if mlev < 4 then
response.write " disabled "
end if
Response.Write "name=""AuthType"">" & vbNewLine & _
" <option value=""0"""
Okay, I guess that with a manual HTTP post moderators can still change the authentication type, but this will keep out 99,999% of them. 
<
<