The Arcive of vBulletin Modifications Site.

MrBeastlymfe · #1 07-19-2012, 11:59 PM

On my site I am making a pastebin page so users can store text files on there if needed. And when trying to submit a paste, I get an error saying a security token is missing. I would like if someone could post the coding into mine, I wouldn't know where to put it in. I don't have a XML I'm just adding a custom page. Here is the code.

Code:

<?php

// ####################### SET PHP ENVIRONMENT ###########################
error_reporting(E_ALL & ~E_NOTICE);


// #################### DEFINE IMPORTANT CONSTANTS #######################


define('THIS_SCRIPT', 'Paste');
define('CSRF_PROTECTION', true);  
// change this depending on your filename


// ################### PRE-CACHE TEMPLATES AND DATA ######################
// get special phrase groups
$phrasegroups = array();


// get special data templates from the datastore
$specialtemplates = array();


// pre-cache templates used by all actions
$globaltemplates = array('Paste',
);


// pre-cache templates used by specific actions
$actiontemplates = array();


// ######################### REQUIRE BACK-END ############################
// if your page is outside of your normal vb forums directory, you should change directories by uncommenting the next line
// chdir ('/path/to/your/forums');
require_once('./global.php');


// #######################################################################
// ######################## START MAIN SCRIPT ############################
// #######################################################################


$navbits = construct_navbits(array('' => 'Paste Bin'));
$navbar = render_navbar_template($navbits);


// ###### YOUR CUSTOM CODE GOES HERE #####
$pagetitle = 'Pastebin Script';








$paste = htmlentities($_POST['paste']);
$vbulletin->input->clean_array_gpc('p', array(
     'sub' => TYPE_NOHTML)
    );

$name = md5($_POST['name']);
$title = $_POST['name'];
$dir = getcwd();
$rand = rand(1,200);
$save = "$name$rand.html";
$all = "<center>Name of paste:<h3>$title</h3><hr /><br /></center><pre> $paste </pre>";


if(isset($sub)){
    if(!empty($title) && !empty($paste)){
        file_put_contents("$dir/$save", $all , FILE_APPEND);
        echo "<footer>View your paste: <a href=" . $save . ">$title</a></footer>";
        }
    else{
        echo "<script>alert('Please fill in all the fields.');</script>";
        }
}






// ###### NOW YOUR TEMPLATE IS BEING RENDERED ######


$templater = vB_Template::create('Paste');
$templater->register_page_templates();
$templater->register('navbar', $navbar);
$templater->register('pagetitle', $pagetitle);
print_output($templater->render());


?>

Sarteck · #2 07-20-2012, 12:05 AM

What's your "Paste" template got in it? Chances are that you forgot to add the needed security token.

In whatever <form> you have, be sure to add the tag
<input type="hidden" name="securitytoken" value="{vb:raw bbuserinfo.securitytoken}" />

Some advice, though. Don't access $_POST, $_GET, or $_REQUEST directly. Instead of:

PHP Code:


			
$title = $_POST['name'];

use

PHP Code:


			
$title = $vbulletin->input->clean_gpc('p', 'name', TYPE_STR);

And stuff like that. vBulletin's cleaning functions make it so that you don't have to worry about data being "bad" or of a type you don't want.

MrBeastlymfe · #3 07-20-2012, 02:18 AM

Quote:

Originally Posted by Sarteck

What's your "Paste" template got in it? Chances are that you forgot to add the needed security token.

In whatever <form> you have, be sure to add the tag
<input type="hidden" name="securitytoken" value="{vb:raw bbuserinfo.securitytoken}" />

Some advice, though. Don't access $_POST, $_GET, or $_REQUEST directly. Instead of:

PHP Code:


			
$title = $_POST['name'];

use

PHP Code:


			
$title = $vbulletin->input->clean_gpc('p', 'name', TYPE_STR);

And stuff like that. vBulletin's cleaning functions make it so that you don't have to worry about data being "bad" or of a type you don't want.

Here's the template, so where would I put the security token? Sorry for the trouble.

Code:

$stylevar[htmldoctype]
<html dir="$stylevar[textdirection]" lang="$stylevar[languagecode]">
<head>
$headinclude
<title>$vboptions[bbtitle]</title>
</head>
<body>

$header
$navbar
<!-- Custom Code Start Here -->
<?php
$paste = htmlentities($_POST['paste']);
$sub = $_POST['sub'];
$name = md5($_POST['name']);
$title = $vbulletin->input->clean_gpc('p', 'name', TYPE_STR);
$dir = getcwd();
$rand = rand(1,200);
$save = "$name$rand.html";
$all = "<center>Name of paste:<h3>$title</h3><hr /><br /></center><pre> $paste </pre>";

if(isset($sub)){
	if(!empty($title) && !empty($paste)){
		file_put_contents("$dir/$save", $all , FILE_APPEND);
		echo "<footer>View your paste: <a href=" . $save . ">$title</a></footer>";
		}
	else{
		echo "<script>alert('Please fill in all the fields.');</script>";
		}
}
?>
<html>
<head>
<style type="text/css">
.inputForm
{
-moz-border-radius:5px; 
-webkit-border-radius: 5px; 
-khtml-border-radius: 5px; 
border-radius: 5px;
}
textarea
{
-moz-border-radius:5px; 
-webkit-border-radius: 5px;
-khtml-border-radius: 5px; 
border-radius: 5px; 
}
</style>
</head>
<body>
<body bgcolor="#F5F5F5">
<center>
<form action="" method="post" align="center">
Title of Paste:<input type="text" class="inputForm" name="name">
<br />
<textarea id=text name="paste" rows=30 cols=68 onload="fade()"></textarea>
<br />
<input type="submit" name="sub">
</center>
</form>
<!-- / Custom Code Ends here -->
$footer
</body>
</html>

Sarteck · #4 07-20-2012, 02:46 AM

Anywhere after <form action="" method="post" align="center"> and before </form> would do fine. Or at least would get rid of the error for the security token. :3

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.04737 seconds Memory Usage 4,685KB Queries Executed 11 (?)
More Information
Template Usage: (1)SHOWTHREAD (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (1)ad_showthread_beforeqr (1)ad_showthread_firstpost (1)ad_showthread_firstpost_sig (1)ad_showthread_firstpost_start (2)bbcode_code (4)bbcode_php (1)bbcode_quote (1)footer (1)forumjump (1)forumrules (1)gobutton (1)header (1)headinclude (1)navbar (3)navbar_link (120)option (4)post_thanks_box (4)post_thanks_button (1)post_thanks_javascript (1)post_thanks_navbar_search (4)post_thanks_postbit_info (4)postbit (4)postbit_onlinestatus (4)postbit_wrapper (1)spacer_close (1)spacer_open (1)tagbit_wrapper Phrase Groups Available: global inlinemod postbit posting reputationlevel showthread	Included Files: ./showthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/functions_amr.php ./includes/modsystem_functions.php ./includes/functions_bigthree.php ./includes/class_postbit.php ./includes/class_bbcode.php ./includes/functions_reputation.php ./includes/functions_post_thanks.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete showthread_start showthread_getinfo forumjump showthread_post_start showthread_query_postids showthread_query bbcode_fetch_tags bbcode_create showthread_postbit_create postbit_factory postbit_display_start post_thanks_function_post_thanks_off_start post_thanks_function_post_thanks_off_end post_thanks_function_fetch_thanks_start post_thanks_function_fetch_thanks_end post_thanks_function_thanked_already_start post_thanks_function_thanked_already_end fetch_musername postbit_imicons bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete postbit_display_complete post_thanks_function_can_thank_this_post_start tag_fetchbit_complete forumrules navbits navbits_complete showthread_complete
Messages: