Administrative and Maintenance Tools - Security Token Notification

This simple mod logs security token erorrs to vBulletin PHP error log and optionally sends an E-Mail to the webmaster.

Example Log Entry

Missing or Invalid Security Token detected.

Script Call Backtrace
=====================
#0 C:\Programme\XAMPP Lite\htdocs\vb310\includes\functions.php line 2420: eval()
#1 C:\Programme\XAMPP Lite\htdocs\vb310\includes\init.php line 417: fetch_error(security_token_missing,ltr,sendmessage.php)
#2 C:\Programme\XAMPP Lite\htdocs\vb310\global.php line 20: require_once(C:\Programme\XAMPP Lite\htdocs\vb310\includes\init.php)
#3 C:\Programme\XAMPP Lite\htdocs\vb310\newthread.php line 49: require_once(C:\Programme\XAMPP Lite\htdocs\vb310\global.php)

POST Variables
===============
Array
(
    [do] => foo
    [f] => 3
    [forumid] => 3
    [securitytoken] => 
)

Request URI
===========
/vb368pl1/newthread.php?do=foo

Datum: 24.04.2008 11:36:08
Benutzername: Kirby
IP-Adresse: 127.0.0.1

If you do not know what this is about, you most likely won't need it

[Andreas]

Works just fine for me

[Barakat]

Originally Posted by Boofo

What did you change in it? </templates> is still there.

in his original xml there were

<templates>
</templates>
</templates>

one of them have no need to be there. i believe he just fix it ,

[mihai11]

Can somebody explain to me in more detail what this hack does ? First of all, what is a "security token" ?

Regards,
Razvan

[Dannyloski]

OMFG! Thank you for this, with 3.6.10 and the fact that some Modifications wont work because of the new Security Token, now I can rest in peace to know which one those are when they are accessed ... :up: on a great Mod ...

[Mike-D]

Originally Posted by mihai11

First of all, what is a "security token" ?

Security Tokens are small Hardware Devices that owners carries to authorize access to a Network Service. That means: Security Tokens provide an extra level of assurance thru a method known as TFA (Two-Factor Authentication). In this case the user has a PIN (Personal Identification Number which authorizes them as the owner of that particular device. So the device then shows a number which uniquely identifies the user to the service and allowing them to log in. The identification number for each user is changed frequently, usually every 3 min's. See also Wikipedia

[Boofo]

Good explanation, Mike, but I think they want to know how it applies to vBulletin now.

[Mike-D]

Originally Posted by mihai11

Can somebody explain to me in more detail what this hack does ?

That what he wrotes...

Originally Posted by Andreas

This simple mod logs security token erorrs to vBulletin PHP error log and optionally sends an E-Mail to the webmaster.

See also the Plugin called "Detect Security Token Failure". The most important is the $backtrace variable and the rest is pretty self explained

[Konstantinos]

so this will tell us which mod file needs to add define('CSRF_PROTECTION', true); immediately below define('THIS_SCRIPT', '... ???

[steven s]

Wouldn't this only be needed for v 3.6.10 and 3.7RC4?

[Trana]

Originally Posted by Boofo

Good explanation, Mike, but I think they want to know how it applies to vBulletin now.

OK, clearly something significant occurred to necessitate 3.6.10. Can you guys not be so cryptic for the rest of us who are not up on what is going on?

How does this affect 3.6.10? How does this affect installed mods?