Security token with external search field.

[Coume]

Hello,

I copied my original board code to create a search box on my site root and my 404.php page (http://www.mythtvtalk.com and http://www.mythtvtalk.com/404.php).
It worked fine for few hours but now, each time I try to use it, I get the following error:

Your submission could not be processed because the token has expired.

Please push the back button and reload the previous window.

After doing some research, it looks like that vb 3.7+ came with a CSRF protection. It is good to know that even searches are protected by vb but how I can overcome that for my own board? I simply need/want a search box on the 2 above pages.

Do you know how this can be tweaked?

Thanks in advance.
Ludo

[Coume]

Dismounted,

Is there a way to generate a security token outside of the forum to use in a search box?
I.e. Generate a token on www.domain.com when the forum is at www.domain.com/forum ?

Thanks in advance.
Ludo

[Dismounted]

See the function fetch_userinfo() in functions.php for the algorithm of the security token.

PS. I have moved your post from your other thread into this one.

[Voltar]

You can have access to a users' security token outside of standard forum pages if you include global.php.

PHP Code:

require_once('./global.php');
print($vbulletin->userinfo['securitytoken']); 


Would print out the hash. To use it in a search box, you would need to create a new hidden field in your form

PHP Code:

<input type="hidden" name="securitytoken" value="<?php echo($vbulletin->userinfo['securitytoken']); ?>" />

[Dismounted]

Yes, but doing that may be a bit excessive when you can generate your own token.

[Dismounted]

Originally Posted by Dismounted

See the function fetch_userinfo() in functions.php for the algorithm of the security token.

Did you read this post?

[Coume]

Originally Posted by Dismounted

Did you read this post?

Yep and I managed to re-create a security token.

I can perform searches externaly IF I was not logged in before. If I was already logged in, it looks like my generated security token (using a random user) does not match mine and therefore I hit the error page.

Is there a way to check/test if a security token already exists?
Because if one already use it, I should use this one instead of generate a new one.
I checked the cookie and I can't seem to find the security token in them :/

Any idea?

Thanks
Ludo

[Dismounted]

Security tokens are generated on every page load. You must use the user ID that the user has logged in as (find this in cookies).

[Coume]

Erm, so is there a way to know/check if a user is already logged in and if so, to get his userid? (outside of the forum obviously)

And for guest/not-logged in user, which userid and user_Salt should be used? Because there is no guest member defined in the user table

Thanks for your help

[Dismounted]

Originally Posted by Coume

Erm, so is there a way to know/check if a user is already logged in and if so, to get his userid? (outside of the forum obviously)

Just use the user ID from their cookie. If the user happen to mess with their cookies, they will just get an error saying the token is incorrect.

Originally Posted by Coume

And for guest/not-logged in user, which userid and user_Salt should be used? Because there is no guest member defined in the user table

The token is "guest" for not-logged in users.