vb.org Archive - View Single Post - Implementing CSRF Protection in modifications

pooffck1 · #**104** 05-30-2008, 05:28 PM

i had made my own custom style and the only problem on my board was that when i put a search engine on my header template, it gave my members a message saying something about security token

Code:

             <td class="alt1" valign="top">
<form action="$vboptions[bburl]/search.php" method="post">
                <input type="hidden" name="do" value="process" />
                <input type="hidden" name="showposts" value="0" />
                <input type="hidden" name="quicksearch" value="1" />
                <input type="hidden" name="s" value="" />
                <input type="text" name="query" size="15" onfocus="this.value=''" value="Search..." />
                <input  type="image" valign="middle" src="$vboptions[bburl]/images/misc/go.gif" style="vertical-align: middle;"/>
              </form>&nbsp;<a href="$vboptions[bburl]/search.php" accesskey="4" rel="nofollow">Options</a><br>

and this is how it looked
but when i looked at other templates i saw that they had the security token line in the search.

Code:

            <td class="alt1" valign="top">
<form action="$vboptions[bburl]/search.php" method="post">
                <input type="hidden" name="do" value="process" />
                <input type="hidden" name="showposts" value="0" />
                <input type="hidden" name="quicksearch" value="1" />
                <input type="hidden" name="s" value="" />
<input type="hidden" name="securitytoken" value="$bbuserinfo[securitytoken]" />
                <input type="text" name="query" size="15" onfocus="this.value=''" value="Search..." />
                <input  type="image" valign="middle" src="$vboptions[bburl]/images/misc/go.gif" style="vertical-align: middle;"/>
              </form>&nbsp;<a href="$vboptions[bburl]/search.php" accesskey="4" rel="nofollow">Options</a><br>

the bolded line is the extra line i put and it started to work

I hope this helps

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.02175 seconds Memory Usage 1,768KB Queries Executed 11 (?)
More Information
Template Usage: (1)SHOWTHREAD_SHOWPOST (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (2)bbcode_code (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_box (1)post_thanks_button (1)post_thanks_javascript (1)post_thanks_navbar_search (1)post_thanks_postbit_info (1)postbit (1)postbit_onlinestatus (1)postbit_wrapper (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit reputationlevel showthread	Included Files: ./showpost.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/functions_bigthree.php ./includes/class_postbit.php ./includes/class_bbcode.php ./includes/functions_reputation.php ./includes/functions_post_thanks.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_postinfo_query fetch_postinfo fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete showpost_start bbcode_fetch_tags bbcode_create postbit_factory showpost_post postbit_display_start post_thanks_function_post_thanks_off_start post_thanks_function_post_thanks_off_end post_thanks_function_fetch_thanks_start post_thanks_function_fetch_thanks_end post_thanks_function_thanked_already_start post_thanks_function_thanked_already_end fetch_musername postbit_imicons bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete postbit_display_complete post_thanks_function_can_thank_this_post_start showpost_complete
Messages: