Implementing CSRF Protection in modifications

[powerful_rogue]

Originally Posted by Boofo

The bad part is that not all forms have value="$session[sessionhash]" in them in some of the hacks out there. I basically look for <form and then add the line anywhere underneath that where there is a <input type="hidden" line.

Thats the problem I was having with vbpager. I looked for every <form.... and every method=post and put the security token code underneath.

Thats why I think its now an ajax issue. Ive tried to figure it out but to no avail. The odd thing is, it works fine in 3.6.10, but not in 3.7 RC4

--------------- Added [DATE]1209242134[/DATE] at [TIME]1209242134[/TIME] ---------------

problem solved! I had a search around and tried the fix that was being used for a shoutbox.

I changed all 3 instances of "securitytoken=" to "&securitytoken=" in vbulletin_global.js and it did the trick!

[rinkrat]

I can't save my vbulletin settings without this error.

What do I change to fix this? In a template?


I also can not import any hacks without an error.

Where do I fix this? In a template?

--------------- Added [DATE]1209251058[/DATE] at [TIME]1209251058[/TIME] ---------------

Originally Posted by Wayne Luke

Forms are not equal to templates but some templates have forms in them.

A form is anywhere your users can submit data. If you have modifications that submit data and cannot update their templates then you need to post for support in the modification thread.

It isn't hard to find out where this needs to go.

In your Admin CP under Styles & Template select Search In Templates...

Search for: value="$session[sessionhash]"


In every template this occurs in add this line directly after the line containing the above, if it doesn't exist already:
<input type="hidden" name="securitytoken" value="$bbuserinfo[securitytoken]" />

Save the template.

I am getting the error when I try to edit a template and save it so this will not work.

[Lynne]

Originally Posted by rinkrat

I am getting the error when I try to edit a template and save it so this will not work.

Note that what you quoted says to "add this line directly after the line containing the above", not directly after that code.

[rinkrat]

I cannot do anything, including editing templates, turning the board on or loading templates without the security error.

[Lynne]

You may want to run the upgrade script again so it makes the necessary changes or run the query listed back on the first page.

[cmedic101]

I added this line to all my custom templates and followed the instructions as listed.

No errors
No problems with any mods
casino is still working

thank you:up:

cmedic

[King Kovifor]

Originally Posted by rinkrat

I cannot do anything, including editing templates, turning the board on or loading templates without the security error.

You should be able to work in the ACP as it is not affected. Maybe posting at vB.com or disabling your plugins by using this code in your config.php may solve your problem:

define('DISABLE_HOOKS', true);

[Terrie]

Originally Posted by Dismounted

Also, you need to add the security token to AJAX requests using POST. This can be simply added using the variable "SECURITYTOKEN". An example is below.

YAHOO.util.Connect.asyncRequest('POST', scriptpath + '?do=ajax', {
	success: this.handle_ajax_response,
	failure: this.handle_ajax_error,
	timeout: vB_Default_Timeout,
	scope: this
}, SESSIONURL + 'securitytoken=' + SECURITYTOKEN + '&foo=' + foo);

what file do i need to place this into?
I've already added the 3 &'s before "securitytoken" in my clienscript/vbulletin_global.js
I have also updated ALL my templates per the security token instructions given and still
im having problems with every mod that uses java and ajax
I am running 3.7 RC4

[Dismounted]

Originally Posted by shahryar_neo

sorry for my low information . can yoy simplified this instruction for using ajax requests using POST ?

It is the simplest it can be. Add the security token into the request.

Originally Posted by sv1cec

Could some one PLEASE tell me how to close this vulnerability in vB 3.0.xx?

I would certainly appreciate it.

You can't unless you edit files directly as the fix is actually a very large one.

Originally Posted by Terrie

what file do i need to place this into?
I've already added the 3 &'s before "securitytoken" in my clienscript/vbulletin_global.js
I have also updated ALL my templates per the security token instructions given and still
im having problems with every mod that uses java and ajax
I am running 3.7 RC4

You do not need to mess with any default vBulletin JS file.

[Opserty]

Originally Posted by Dismounted

You do not need to mess with any default vBulletin JS file.

There have been a few errors in RC4 that have caused problems for a couple of ajax modifications, hence why some have edited vbulletin_global.js. http://www.vbulletin.com/forum/proje...?issueid=25287