vb.org Archive - Implementing CSRF Protection in modifications

Page 13 of 18

« First

Last »

Show 40 post(s) from this thread on one page

vb.org Archive (https://vborg.vbsupport.ru/index.php)

- Programming Articles (https://vborg.vbsupport.ru/forumdisplay.php?f=188)

- - Implementing CSRF Protection in modifications (https://vborg.vbsupport.ru/showthread.php?t=177013)

mystic10

08-23-2008 04:35 PM

do i need to do this i just ugraded to 3.7.2 pl2 it should be fixed in that right..as i am still having the problem but only with the thanks hack any help will be appreciated

sunnylikbeckham

09-02-2008 11:31 AM

i m having probs to
does it fixed in 3.7.3??

yotsume

09-04-2008 08:18 AM

I am getting a token error when editing a Blog comment. I use the latest VB Blog. How can I fix the token error here? Also I get a error when I am inside the admin CP and I try and email a user their password?

I had a mod installed called "force useres to read a thread" when I uninstalled that mod I began to see the token errors.

I need these two erros fixed ASAP!

HELP PLEASE!

g00gl3r

09-07-2008 07:35 PM

This is stupid. What the hell is this all about?

--------------- Added [DATE]1220819847[/DATE] at [TIME]1220819847[/TIME] ---------------

Quote:

Originally Posted by sunnylikbeckham (Post 1612722)

i m having probs to
does it fixed in 3.7.3??

Nope.

--------------- Added [DATE]1220820450[/DATE] at [TIME]1220820450[/TIME] ---------------

Quote:

Originally Posted by rinkrat (Post 1500145)

I can't save my vbulletin settings without this error.

What do I change to fix this? In a template?

I also can not import any hacks without an error.

Where do I fix this? In a template?

--------------- Added [DATE]1209251058[/DATE] at [TIME]1209251058[/TIME] ---------------

I am getting the error when I try to edit a template and save it so this will not work.

O.M.F.G. There must be 400 templates showing when I search for that.

dirtyfeast

09-08-2008 05:35 AM

I just installed the latest version of vBulletin, have no mods installed, made a test thread, and I cant delete it. I get this security token error. Contact admin it says. Why does this happen on a newly installed forum with no hacks installed. Could it be the template I am using which is ambience.

mystic10

09-08-2008 10:09 AM

i have the problem with thank you hack..any time someone clicks on thanks they get a security token warning....

i looked throudh the plugin this is where i saw the word securitytoken...what changes do i need to make

<template name="post_thanks_button" templatetype="template" date="1217138974" username="Abe" version="7.7"><![CDATA[<a href="post_thanks.php?$session[sessionurl]do=post_thanks_add&p=$post[postid]&&securitytoken=$bbuserinfo[securitytoken]" id="post_thanks_button_$post[postid]"<if condition="$vboptions[disable_ajax] != 2"> onclick="return post_thanks_give($post[postid], <if condition="$vboptions[post_groan_integrate]">true<else />false</if>);"</if> <if condition="$display_thanks_image == 'none'">style="display:none"</if> rel="nofollow"><img src="$stylevar[imgdir_button]/post_thanks.gif" alt="$vbphrase[post_thanks_thanks]" border="0" /></a>]]></template>
<template name="post_thanks_javascript" templatetype="template" date="1198126814" username="Abe" version="7.0"><![CDATA[<script type="text/javascript" src="clientscript/post_thanks.js"></script>]]></template>

scott_gersforum

09-09-2008 12:41 PM

I have certain users getting this error when updating their albums.
Rest of the forum seems okay.
Can anyone fix this?

redskull

09-14-2008 03:05 AM

ok so for my template to work without getthing the token error WHAT do i edit/fix

mokujin

09-14-2008 07:47 PM

Hi, I have this function, how can I add CSRF for this:

Code:

function tab(URL) {

  http.open("GET", "tabs.php?f="+URL+"&s="+Math.random(), true);

  http.onreadystatechange=function() {

    if(http.readyState == 4) {

      document.getElementById('forumbits').innerHTML = http.responseText;

        }

  }

  http.send(null);

}

Thanks for helping me

SVTCobraLTD

10-02-2008 03:09 PM

Below is a code for a product, there is no value="$session[sessionhash]" so I am not sure where to add <input type="hidden" name="securitytoken" value="$bbuserinfo[securitytoken]" />. Anyone have an idea??

Code:

$stylevar[htmldoctype]

<html dir="$stylevar[textdirection]" lang="$stylevar[languagecode]">

        <head>

                $headinclude

                <title>$vboptions[bbtitle] - $vbphrase[onetouchspamban_title]</title>

        </head>

        $header

        $navbar

<table class="tborder" cellpadding="$stylevar[cellpadding]" cellspacing="$stylevar[cellspacing]" border="0" width="70%" align="center">

<tr>

        <td class="tcat">$vbphrase[onetouchspamban_title]</td>

</tr>

<tr>

        <td class="panelsurround" align="center">

        <div class="panel">

                <div align="$stylevar[left]">

        

                        <div style="margin: 10px">



        <if condition="$_REQUEST['do'] == 'spamcleanconfirm'">

                <form action="misc.php" method="post" name="spamconfirm" id="spamconfirm">

                        $message

                        <input type="hidden" name="do" value="dospamclean" />

                        <input type="hidden" name="userid" value="$banuserid" />

                        <center><input type="submit" class="button" value="$vbphrase[onetouchspamban_confirm_button]" /></center>

                </form>

        </if>



        <if condition="$_POST['do'] == 'dospamclean'">

                $message

        </if>



</div>

                        

        </div>

        </div>



        </td>

</tr>

</table>



        $footer

</body>

</html>

All times are GMT. The time now is 07:26 PM.

Page 13 of 18

« First

Last »

Show 40 post(s) from this thread on one page

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01642 seconds Memory Usage 1,751KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (2)bbcode_code_printable (2)bbcode_quote_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)pagenav (1)pagenav_curpage (4)pagenav_pagelink (1)pagenav_pagelinkrel (1)post_thanks_navbar_search (1)printthread (10)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start pagenav_page pagenav_complete bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: