vb.org Archive

vb.org Archive (https://vborg.vbsupport.ru/index.php)
-   vB4 Programming Discussions (https://vborg.vbsupport.ru/forumdisplay.php?f=252)
-   -   CSRF protection error when security token is being submit. (https://vborg.vbsupport.ru/showthread.php?t=281171)

Kyojii 04-06-2012 01:05 AM

CSRF protection error when security token is being submit.
 
My form below is giving me a CSRF protection error but the security key is being submit with the form, so it shouldn't. I've checked the DOM and the security key is being put in the value field correctly.

Code:

<form action="newindex.php?do=submit" method="post">
                        Subject:<br>
                        <input type="text" id="subject" name="subject"><br>
                        <textarea id="article" id="article" name="article"><?php echo $_POST['article'] ?></textarea><br>
                        <div class="sliderimage"><h2 class="blockhead">Slider Image:</h2>
                        <table><tr><td><b>Image:</b><br>Dimensions should be 640x360.</td><td>
                        <input type="file" id="image" name="image"></td></tr>
                        <tr><td><b>Transition:</b></td><td>
                        <select id="transition" name="transition">
                            <option value="">Random</option>
                            <option value="sliceDown">slideDown</option>
                            <option value="sliceDownLeft">sliceDownLeft</option>
                            <option value="sliceUp">sliceUp</option>
                            <option value="sliceUpLeft">sliceUpLeft</option>
                            <option value="fold">fold</option>
                            <option value="fade">fade</option>
                            <option value="slideInRight">slideInRight</option>
                            <option value="slideInLeft">slideInLeft</option>
                            <option value="boxRandom">boxRandom</option>
                            <option value="boxRain">boxRain</option>
                            <option value="boxRainReverse">boxRainReverse</option>
                            <option value="boxRainGrow">boxRainGrow</option>
                            <option value="boxRainGrowReverse">boxRainGrowReverse</option>
                        </select></td></tr>
                        <tr><td><b>Caption:</b></td><td>
                        <input type="text" id="caption" name="caption"></table><br></div>
                        <input type="hidden" name="securitytoken" value="<?php echo $bbuserinfo[securitytoken] ?>" />
                        <div class="center"><input type="button" value="Preview" class="preview"><input type="submit" name="submit"></div>
                    </form>


Zachery 04-06-2012 02:03 AM

CSRF is not directly related to the security token. It sounds like you're submitting data from a domain that isn't the same as the domain vbulletin is on.

Kyojii 04-06-2012 02:38 AM

This page is submitting to itself...

Zachery 04-06-2012 03:04 AM

Is your page, within the same domain as vBulletin though?

Pandemikk 04-06-2012 03:08 AM

Quote:

Originally Posted by Zachery (Post 2317202)
Is your page, within the same domain as vBulletin though?

Come on Zach...

He's missing the security token hidden field.

nvm no he's not :D

Kyojii 04-06-2012 03:15 AM

Quote:

Originally Posted by Zachery (Post 2317202)
Is your page, within the same domain as vBulletin though?

Yes.

Fixed it, thanks anyway. ^^


All times are GMT. The time now is 05:06 PM.

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.

X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.00956 seconds
  • Memory Usage 1,729KB
  • Queries Executed 10 (?)
More Information
Template Usage:
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)bbcode_code_printable
  • (2)bbcode_quote_printable
  • (1)footer
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (6)option
  • (1)post_thanks_navbar_search
  • (1)printthread
  • (6)printthreadbit
  • (1)spacer_close
  • (1)spacer_open 

Phrase Groups Available:
  • global
  • postbit
  • showthread
Included Files:
  • ./printthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/class_bbcode_alt.php
  • ./includes/class_bbcode.php
  • ./includes/functions_bigthree.php 

Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • printthread_start
  • bbcode_fetch_tags
  • bbcode_create
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • printthread_post
  • printthread_complete