Implementing CSRF Protection in modifications

[Sworm]

Hi all, for now, i have this error only in the polls voted from VBA homepage..... what is the template that i go to edit?

[PoetJA-1975]

Wow - Thank GAWD for Google LOL - did a search and this is the very 1st thread I found.... After editing over 50 or more templates in the past hour or so - I thank you all who have helped - notably the very informative post here AND the query that made it so very easy here.

It's not very often I see a HELP ME JESUS! thread that actually has the solution on the 1st page

Thanx GUYZ!

Jacquii.

[nhuhuu]

hi dear all.
when i add new styles into my forum. it ok.
then i want to show 3 styles on my forumhome for my member enjoy it. but i can't save display oder. i got note below :

Your submission could not be processed because a security token was missing or mismatched.

If this occurred unexpectedly, please inform the administrator and describe the action you performed before you received this error.

please help me why my Admincp got Error... i want to fix it, but i don't know to fix in Admincp. i had been fixed at templates ok

[CEO254]

Originally Posted by Wayne Luke

Forms are not equal to templates but some templates have forms in them.

A form is anywhere your users can submit data. If you have modifications that submit data and cannot update their templates then you need to post for support in the modification thread.

It isn't hard to find out where this needs to go.

In your Admin CP under Styles & Template select Search In Templates...

Search for: value="$session[sessionhash]"


In every template this occurs in add this line directly after the line containing the above, if it doesn't exist already:
<input type="hidden" name="securitytoken" value="$bbuserinfo[securitytoken]" />

Save the template.

I have done this and I have also Re upped all my files and im still getting an error

[xoutlawz00x]

Originally Posted by Dismounted

Also, you need to add the security token to AJAX requests using POST. This can be simply added using the variable "SECURITYTOKEN". An example is below.

YAHOO.util.Connect.asyncRequest('POST', scriptpath + '?do=ajax', {
	success: this.handle_ajax_response,
	failure: this.handle_ajax_error,
	timeout: vB_Default_Timeout,
	scope: this
}, SESSIONURL + 'securitytoken=' + SECURITYTOKEN + '&foo=' + foo);

would you be kind and help me implement this into my templete.. i dont understand

--------------- Added [DATE]1215989398[/DATE] at [TIME]1215989398[/TIME] ---------------

i upgraded the script and everything is fine now thanksss

[denman75]

Originally Posted by CEO254

I have done this and I have also Re upped all my files and im still getting an error

same here
this is really frustrating
i don't care where its coming from ,i know it has to be fixed
since i am not a coder
if i purchace a board and its running great and after a update its not
than there is not much i cant do a as a total non coder

[gbox master]

hi

can some one explain this to me please
i get the error also on my forum since some fool invented a new way of protection or something

Template Changes

The following should be added to all of the forms which POST back to vBulletin or a vBulletin script. This will automatically be filled out with a 40 character hash that is unique to the user.

Code:
<input type="hidden" name="securitytoken" value="$bbuserinfo[securitytoken]" />
Again it is worthwhile adding this to your templates even if it is currently not using the CSRF protection.

i dont understand this very well
i use a modified template not from vB but from phpbb
on 3.6 all is ok en works fine
now on 3.7 the problems start

ps if someone can help me do this it would be apriciated by paypal

[meissenation]

My users are getting the error when uploading attachments to their album or to a thread. Both templates have the <input type="hidden" name="securitytoken" value="$bbuserinfo[securitytoken]" /> already, so what is the next course of action to fix this?

[mokujin]

Originally Posted by xoutlawz00x

would you be kind and help me implement this into my templete.. i dont understand

--------------- Added [DATE]1215989398[/DATE] at [TIME]1215989398[/TIME] ---------------

i upgraded the script and everything is fine now thanksss

I dont understand too Where are coders now?

[Triky]

I am trying to reproduce my usercp.php file on my site root, I have copyed also my profile.php file and all my /includes/ folder.. and when I'm sending data from it, I got this error:

 Fatal error:  Call to undefined function:  verify_security_token() in c:\programs\server\www\install_test\includes\init.php on line 416

Why? I have this line of code on init.php at line 416:

PHP Code:

            if (!verify_security_token($vbulletin->GPC['securitytoken'], $vbulletin->userinfo['securitytoken_raw'])) 


Can please somebody help me?