The Arcive of Official vBulletin Modifications Site.It is not a VB3 engine, just a parsed copy! |
|
Implementing CSRF Protection in modifications
With the new version released today for vBulletin 3.6.10 and 3.7.0 RC4, a new protection against Cross Site Request Forgery (CSRF) has been introduced. This new protection might influence the coding in modifications. Scott MacVicar took the time to compile a short explanation on this new protection for the coders on vBulletin.org: Changes for CSRF protection with third party modifications Cross Site Request Forgery (CSRF) involves taking advantage of the stateless nature of HTTP, there are no ways to ensure the exact origin of a request, its also not possible to detect what was actually initiated by a user and what was forced by a third party script. A token was added to the latest version of each of the vBulletin products, with the release of 3.6.10 and 3.7.0 RC4 it is no longer possible to submit a POST request directly without passing in the known token. The addition of a security token for each POST request removes the ability for a remote page to force a user to submit an action. At the moment this protection will only apply to vBulletin files and third party files will need to opt into this protection and add the appropriate hidden field. This was done to preserve backwards compatibility. Adding Protection to your own files To opt your entire file into CSRF protection the following should be added to the top of the file under the define for THIS_SCRIPT. PHP Code:
If this value is set to false then all CSRF protection is removed for the file, this is appropriate for something that intentionally accepts remote POST requests. You should always add this to your file, even if you don't think the script is ever going to receive POST requests. An absence of this defined constant within your files will result in the old style referrer checking being performed. Template Changes The following should be added to all of the forms which POST back to vBulletin or a vBulletin script. This will automatically be filled out with a 40 character hash that is unique to the user. Code:
<input type="hidden" name="securitytoken" value="$bbuserinfo[securitytoken]" /> Exempting Certain Actions It may be appropriate to exempt a particular action from the CSRF protection, in this case you can add the following to the file. PHP Code:
If the skip list needs to be changed at runtime is it available within the registry object, using the init_startup hook the following code would be used to exempt 'example.php?do=action_three'. PHP Code:
|
#122
|
|||
|
|||
do i need to do this i just ugraded to 3.7.2 pl2 it should be fixed in that right..as i am still having the problem but only with the thanks hack any help will be appreciated
|
#123
|
||||
|
||||
i m having probs to
does it fixed in 3.7.3?? |
#124
|
||||
|
||||
I am getting a token error when editing a Blog comment. I use the latest VB Blog. How can I fix the token error here? Also I get a error when I am inside the admin CP and I try and email a user their password?
I had a mod installed called "force useres to read a thread" when I uninstalled that mod I began to see the token errors. I need these two erros fixed ASAP! HELP PLEASE! |
#125
|
|||
|
|||
This is stupid. What the hell is this all about?
--------------- Added [DATE]1220819847[/DATE] at [TIME]1220819847[/TIME] --------------- Nope. --------------- Added [DATE]1220820450[/DATE] at [TIME]1220820450[/TIME] --------------- Quote:
|
#126
|
|||
|
|||
I just installed the latest version of vBulletin, have no mods installed, made a test thread, and I cant delete it. I get this security token error. Contact admin it says. Why does this happen on a newly installed forum with no hacks installed. Could it be the template I am using which is ambience.
|
#127
|
|||
|
|||
i have the problem with thank you hack..any time someone clicks on thanks they get a security token warning....
i looked throudh the plugin this is where i saw the word securitytoken...what changes do i need to make <template name="post_thanks_button" templatetype="template" date="1217138974" username="Abe" version="7.7"><![CDATA[<a href="post_thanks.php?$session[sessionurl]do=post_thanks_add&p=$post[postid]&&securitytoken=$bbuserinfo[securitytoken]" id="post_thanks_button_$post[postid]"<if condition="$vboptions[disable_ajax] != 2"> onclick="return post_thanks_give($post[postid], <if condition="$vboptions[post_groan_integrate]">true<else />false</if>);"</if> <if condition="$display_thanks_image == 'none'">style="display:none"</if> rel="nofollow"><img src="$stylevar[imgdir_button]/post_thanks.gif" alt="$vbphrase[post_thanks_thanks]" border="0" /></a>]]></template> <template name="post_thanks_javascript" templatetype="template" date="1198126814" username="Abe" version="7.0"><![CDATA[<script type="text/javascript" src="clientscript/post_thanks.js"></script>]]></template> |
#128
|
|||
|
|||
I have certain users getting this error when updating their albums.
Rest of the forum seems okay. Can anyone fix this? |
#129
|
|||
|
|||
ok so for my template to work without getthing the token error WHAT do i edit/fix
|
#130
|
||||
|
||||
Hi, I have this function, how can I add CSRF for this:
Code:
function tab(URL) { http.open("GET", "tabs.php?f="+URL+"&s="+Math.random(), true); http.onreadystatechange=function() { if(http.readyState == 4) { document.getElementById('forumbits').innerHTML = http.responseText; } } http.send(null); } |
#131
|
|||
|
|||
Below is a code for a product, there is no value="$session[sessionhash]" so I am not sure where to add <input type="hidden" name="securitytoken" value="$bbuserinfo[securitytoken]" />. Anyone have an idea??
Code:
$stylevar[htmldoctype] <html dir="$stylevar[textdirection]" lang="$stylevar[languagecode]"> <head> $headinclude <title>$vboptions[bbtitle] - $vbphrase[onetouchspamban_title]</title> </head> $header $navbar <table class="tborder" cellpadding="$stylevar[cellpadding]" cellspacing="$stylevar[cellspacing]" border="0" width="70%" align="center"> <tr> <td class="tcat">$vbphrase[onetouchspamban_title]</td> </tr> <tr> <td class="panelsurround" align="center"> <div class="panel"> <div align="$stylevar[left]"> <div style="margin: 10px"> <if condition="$_REQUEST['do'] == 'spamcleanconfirm'"> <form action="misc.php" method="post" name="spamconfirm" id="spamconfirm"> $message <input type="hidden" name="do" value="dospamclean" /> <input type="hidden" name="userid" value="$banuserid" /> <center><input type="submit" class="button" value="$vbphrase[onetouchspamban_confirm_button]" /></center> </form> </if> <if condition="$_POST['do'] == 'dospamclean'"> $message </if> </div> </div> </div> </td> </tr> </table> $footer </body> </html> |
|
|
X vBulletin 3.8.12 by vBS Debug Information | |
---|---|
|
|
More Information | |
Template Usage:
Phrase Groups Available:
|
Included Files:
Hooks Called:
|