The Arcive of Official vBulletin Modifications Site.It is not a VB3 engine, just a parsed copy! |
|
#1
|
||||
|
||||
Right now, on pretty much any message board, a user can modify forms and insert their own data. This means that the maximum character limits, drop down select menus, and virtually every aspect of your profile forms can be modified relatively easily. It's done by logging into the 'edit profile' page, saving it as an html document, modifying it as you see fit, loading it in your browser from your PC, and clicking Submit from the modified html page on their harddrive. It's simple enough for anyone to do... question is, how do we prevent it?
I need a php command (it'd probably only be a line or two of coding) that would prevent people from submitting forms from outside domains and PCs. Did any of what I said just make sense? I just submitted this thread from my harddrive and tried changing the maxlength field from 85 to 120, and the form did submit... but the subject title length was chopped down to 85. This is basically the type of security measure I'd need for profile fields |
#2
|
||||
|
||||
Actually vBulletin uses a combination of sessions, variable tracking and other checks to prevent this as it is seens as a large security hole. While you may be able to submit the form, you can't change the values to hurt the site.
If you want to restrict this you will have to check the referrer and act accordingly. However not all servers can check the referrer information. |
#3
|
||||
|
||||
my server supports referrer commands. Is there a simple way to prevent this for registration and edit profile pages? I'm not really worried about major security issues, but just some custom fields and pull down menus
|
|
|
X vBulletin 3.8.12 by vBS Debug Information | |
---|---|
|
|
More Information | |
Template Usage:
Phrase Groups Available:
|
Included Files:
Hooks Called:
|