How do I fix this error?

[mholtum]

I have tried many times to duplicate this and can't. Sorry. Try upgrading from 3.7.3 to 3.7.5, you never know. It may fix it.

[lazydesis]

I removed the following code

PHP Code:

else if ($_POST['do'] AND ADMINHASH != $vbulletin->GPC['adminhash'])
{
    print_cp_login(true);
} 


from the file admincp/global.php

Now I do not get the error. I am sure that code is there for something important. Can someone explain to me the implications of removing that bit of code from the admincp/global.php ?

Thanks.

--------------- Added [DATE]1231461540[/DATE] at [TIME]1231461540[/TIME] ---------------

by the way I updated to 3.8 gold today and still got the problem, after which i removed that code.

[Bellardia]

Fixed in post below.

[lazydesis]

It still asks me to login when I try to go to the admincp. Only members of the administrator group are able to login even after removing the code.

Bellardia could you please explain what you mean by "forging as an admin"

Thanks.

[Bellardia]

Let me try to rephrase that.
When you submit a post form to admincp it will verify that it was generated from inside the admincp by sending along ADMINHASH as well. Now it won't check to see if the adminhash was sent along as well, so using php or javascript someone could possibly abuse this fact to make you query the admin cp by directing you to a certain page such as http://www.yourforum.com/forum/admin...DeleteAllUsers (although this isn't a real function, its an example) without you knowing, pretty much using your access to the admincp to do whatever they want through you.

[lazydesis]

oh I see .. thanks for explaining.

I hope some one could come up with a better solution to the problem

[Bellardia]

In the mean time I'd advise you put that back in...although logging in can be a pain, by doing something as simple as posting an image to your forum I could make myself an admin..

[Lynne]

Have you tried to see if you have this problem with a default skin? Or with plugins disabled?

Create a new style with no parent - Styles & Templates > Style Manager > Add New Style > no parent - then browse the site using that totally default vbulletin style - do you still have the same problem?

If it is still happening, then try disabling your plugins and see if you still have this problem.
Note: To temporarily disable the plugin system, edit config.php and add this line right under <?php

PHP Code:

define('DISABLE_HOOKS', true); 


[lazydesis]

Originally Posted by Lynne

Have you tried to see if you have this problem with a default skin? Or with plugins disabled?

Create a new style with no parent - Styles & Templates > Style Manager > Add New Style > no parent - then browse the site using that totally default vbulletin style - do you still have the same problem?

If it is still happening, then try disabling your plugins and see if you still have this problem.
Note: To temporarily disable the plugin system, edit config.php and add this line right under <?php

PHP Code:

define('DISABLE_HOOKS', true); 


Just to let you know, it does not happen while browsing the site. Its only when hitting submit buttons in the admincp ... and its very random as to when it appears or what buttons need to be hit.

[Bellardia]

It would appear that something is compromising your ADMINHASH variable, or that it isn't being parsed correctly (although it is defined so it seems odd).