"POST requests from foreign hosts are not allowed."

[Rancher]

or Does it? I may have loopholed it or whatever, but:
Yesterday I didn't add in the real forums subdomain as $http_host, making it only being the domain I added; and all my members couldn't post.
Here's what I did: My main site is v3.hmotaku.net; and the forums are located at forums.hmotaku.net.
I just declared v3.hmotaku.net as $http_host; ($http_host = 'v3.hmotaku.net' and in result all requests from forums.hmotaku.net (the real forums domain) was blocked by "POST requests from foreign hosts are not allowed." What happened was that all requests were blocked; EXCEPT from v3.hmotaku.net; which was declared at $http_host. So I declared forums.hmotaku.net $http_host as well, and all was fine again. -_-;;

I'm not sure how the whole referer checking thing works in vB; but how exactly did I loophole it? And NO, any other site can't submit; as proved above. =__=;

[AN-net]

Originally Posted by Rancher

or Does it? I may have loopholed it or whatever, but:
Yesterday I didn't add in the real forums subdomain as $http_host, making it only being the domain I added; and all my members couldn't post.
Here's what I did: My main site is v3.hmotaku.net; and the forums are located at forums.hmotaku.net.
I just declared v3.hmotaku.net as $http_host; ($http_host = 'v3.hmotaku.net' and in result all requests from forums.hmotaku.net (the real forums domain) was blocked by "POST requests from foreign hosts are not allowed." What happened was that all requests were blocked; EXCEPT from v3.hmotaku.net; which was declared at $http_host. So I declared forums.hmotaku.net $http_host as well, and all was fine again. -_-;;

I'm not sure how the whole referer checking thing works in vB; but how exactly did I loophole it? And NO, any other site can't submit; as proved above. =__=;

you loopholed it by over writting what ever hot is really submitting... the reason urs did not work is because the subdomain of main site used in $http_host did not match your forums domain. so basically by setting doing the edits you did, you over write who/what site is really submitting making your site vulnerable. What you should be doing is checking the $http_host first to make it its your main site submitting then change $http_host if it is your main site. Do not under estimate the checking because this helps keep your site secure from malicious hackers and websites.

[TwinsForMe]

Originally Posted by KirbyDE

You can disable the check by putting

PHP Code:

define('SKIP_REFERER_CHECK', 1); 


at the top of init.php.
You could also modify your POST-script to submit the correct referer.

I did this and the member is still getting the foreign host error. Any suggestions?