3.7 Disable SecuirtyToken on MemberList Search
 

I have a program that checks our forum member list to verify members.

Since I upgraded, the program is worthless because I noticed this:

<form action="search.php?do=process" method="post">
<input type="hidden" name="do" value="process" />
<input type="hidden" name="quicksearch" value="1" />
<input type="hidden" name="childforums" value="1" />
<input type="hidden" name="exactname" value="1" />
<input type="hidden" name="s" value="" />
<input type="hidden" name="securitytoken" value="9001802c10a506b0a3042368911720efdf58da70" />

My program cannot support a "securitytoken"....

and the query for the search would be 'do=getall"&chr(3&"ausername="&Username&"securityt oken="&token
with the token value from the intal frm page

in order for script to work now, you need to:
either get the token value from the search form page, this means you have to parse one more html document, or disable the check in the forum php code

Any people that can help?

thanks

There is an article here that shows how to exempt certain actions from CSRF protection, if that is the route you want to take.