Today's Posts Follow Us On Twitter! TFL Members on Twitter  
Forum search: Advanced Search  
Navigation
Marketplace
  Members Login:
Lost password?
  Forum Statistics:
Forum Members: 24,254
Total Threads: 80,792
Total Posts: 566,472
There are 1683 users currently browsing (tf).
 
  Our Partners:
 
  TalkFreelance     TalkFreelance Information     Suggestions and Feedback :

Security Issue Redirect

Thread title: Security Issue Redirect
Reply  
Page 2 of 3 < 1 2 3 >
    Thread tools Search this thread Display Modes  
02-10-2010, 06:11 PM
#11
ChrisGwynne is offline ChrisGwynne
Status: Member
Join date: Nov 2007
Location: Wales
Expertise: Development
Software: TextMate, Transmit, Photoshop.
 
Posts: 242
iTrader: 0 / 50%
 

ChrisGwynne is on a distinguished road

  Old

Just to double check, are the users who are experiencing this problem using Firefox 3.6?

Reply With Quote
02-10-2010, 11:39 PM
#12
ChrisGwynne is offline ChrisGwynne
Status: Member
Join date: Nov 2007
Location: Wales
Expertise: Development
Software: TextMate, Transmit, Photoshop.
 
Posts: 242
iTrader: 0 / 50%
 

ChrisGwynne is on a distinguished road

  Old

After some research unless I'm mistaken the current problem resides with Firefox 3.6 as described here - http://support.mozilla.com/tiki-view...5399&forumId=1

At present, there is no fix. Hopefully either Firefox or vBulletin will issue a workaround. I would air on the side of vBulletin releasing a fix for this quicker than Firefox as they won't roll out a fix until their next release, which is less often than vBulletins.

Reply With Quote
02-11-2010, 12:32 AM
#13
Spherions is offline Spherions
Status: Junior Member
Join date: Mar 2009
Location:
Expertise: Investment
Software: Photoshop & phpDesigner
 
Posts: 59
iTrader: 0 / 0%
 

Spherions is on a distinguished road

  Old

That can't be. I have several computers still running 3.5.x and they are receiving this error. I did find that if I disabled DST (Daylight Savings Time) altogether, it stopped the error from showing up.

In includes/adminfunctions.php find:

Code:
echo "<input type=\"hidden\" name=\"adminhash\" value=\"" . ADMINHASH . "\" />\n";
Add below:
Code:
echo "<input type=\"hidden\" name=\"securitytoken\" value=\"" . $vbulletin->userinfo['securitytoken'] . "\" />\n";

Whoever did the upgrading most likely forgot to revert the templates, and that causes bugs. I've done lots of work on vBulletin and IP.Board, so take my word for it.

Additionally, if you want to proof it, you can revert the template now to when it got upgraded for 3.8.x, and then add the template mods again, it'll take some time. Is the orange/green skin a child style off of a parent or a lone style?

Edit: This issue has been around for a few years. The above fix should work, if not, revert the template and force the default style onto users while you do the necessary mods again. If you still have issues, let me know and I'll look into it more, but I'm confident the problem should be fixed after you do the above.

Reply With Quote
02-11-2010, 12:54 AM
#14
ChrisGwynne is offline ChrisGwynne
Status: Member
Join date: Nov 2007
Location: Wales
Expertise: Development
Software: TextMate, Transmit, Photoshop.
 
Posts: 242
iTrader: 0 / 50%
 

ChrisGwynne is on a distinguished road

  Old

The templates in themselves are no longer the problem with this issue, I've rechecked them all today, there is no current error with them relating to this problem.

The code modification you posted, is already within includes/adminfunctions.php

Reply With Quote
02-11-2010, 01:20 AM
#15
Spherions is offline Spherions
Status: Junior Member
Join date: Mar 2009
Location:
Expertise: Investment
Software: Photoshop & phpDesigner
 
Posts: 59
iTrader: 0 / 0%
 

Spherions is on a distinguished road

  Old

Hmm, thanks for the fast response. I'll look into it for you.

Was getting some coffee and I remembered that I was experiencing this problem on this site in Opera, Safari, and Chrome. I thought they were screwed up but Firefox 3.5.7 gives the error too. I've turned on back the DST corrections to see if the error can replicate itself so I can assist you with this.

For now the default skin is the best to use so that users don't get this issue. But just wondering, is the orange/green skin a lone style or is it a child of a parent style?


Edit: A form or more is missing the code I posted above. Search for "<form" and ensure they all have that code. I gave you something else to do before. Sorry! This would be checked in all templates.

I know it happened a lot when I was reading the iTrader reviews for members. Going to advanced post, and such.

Reply With Quote
02-11-2010, 01:42 AM
#16
ChrisGwynne is offline ChrisGwynne
Status: Member
Join date: Nov 2007
Location: Wales
Expertise: Development
Software: TextMate, Transmit, Photoshop.
 
Posts: 242
iTrader: 0 / 50%
 

ChrisGwynne is on a distinguished road

  Old

Originally Posted by Spherions View Post
Hmm, thanks for the fast response. I'll look into it for you.

Was getting some coffee and I remembered that I was experiencing this problem on this site in Opera, Safari, and Chrome. I thought they were screwed up but Firefox 3.5.7 gives the error too. I've turned on back the DST corrections to see if the error can replicate itself so I can assist you with this.

For now the default skin is the best to use so that users don't get this issue. But just wondering, is the orange/green skin a lone style or is it a child of a parent style?


Edit: A form or more is missing the code I posted above. Search for "<form" and ensure they all have that code. I gave you something else to do before. Sorry! This would be checked in all templates.

I know it happened a lot when I was reading the iTrader reviews for members. Going to advanced post, and such.
I'm not understanding where you'd like me to look?

Reply With Quote
02-11-2010, 02:01 AM
#17
Spherions is offline Spherions
Status: Junior Member
Join date: Mar 2009
Location:
Expertise: Investment
Software: Photoshop & phpDesigner
 
Posts: 59
iTrader: 0 / 0%
 

Spherions is on a distinguished road

  Old

Give me a day to look over my templates so I can give you the list of them to check for. Sound good?

Reply With Quote
02-13-2010, 11:19 PM
#18
Spherions is offline Spherions
Status: Junior Member
Join date: Mar 2009
Location:
Expertise: Investment
Software: Photoshop & phpDesigner
 
Posts: 59
iTrader: 0 / 0%
 

Spherions is on a distinguished road

  Old

Find:

Code:
<input type="hidden" name="s" value="$session[sessionhash]" />
Directly add under that:

Code:
<input type="hidden" name="securitytoken" value="$bbuserinfo[securitytoken]" />

Reply With Quote
02-13-2010, 11:31 PM
#19
ChrisGwynne is offline ChrisGwynne
Status: Member
Join date: Nov 2007
Location: Wales
Expertise: Development
Software: TextMate, Transmit, Photoshop.
 
Posts: 242
iTrader: 0 / 50%
 

ChrisGwynne is on a distinguished road

  Old

Originally Posted by Spherions View Post
Find:

Code:
<input type="hidden" name="s" value="$session[sessionhash]" />
Directly add under that:

Code:
<input type="hidden" name="securitytoken" value="$bbuserinfo[securitytoken]" />
In where?

Reply With Quote
02-14-2010, 12:21 AM
#20
Spherions is offline Spherions
Status: Junior Member
Join date: Mar 2009
Location:
Expertise: Investment
Software: Photoshop & phpDesigner
 
Posts: 59
iTrader: 0 / 0%
 

Spherions is on a distinguished road

  Old

Search the headerinclude template for this:

Code:
var SESSIONURL = "$session[sessionurl_js]";
Look directly under that line, if the following isn't there, add it directly below the above code:

Code:
var SECURITYTOKEN = "$bbuserinfo[securitytoken]";


Then search all templates for this:

Code:
<input type="hidden" name="s" value="$session[sessionhash]" />
And then add this line of code right under the above code for every single instance:

Code:
<input type="hidden" name="securitytoken" value="$bbuserinfo[securitytoken]" />

So intead of the instances looking like this:

Code:
<input type="hidden" name="s" value="$session[sessionhash]" />

They will look like this:

Code:
<input type="hidden" name="s" value="$session[sessionhash]" />
<input type="hidden" name="securitytoken" value="$bbuserinfo[securitytoken]" />

On the other hand, you can use the template search engine and replace the code there, by following this screenshot.

Reply With Quote
Reply  
Page 2 of 3 < 1 2 3 >


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 

  Posting Rules  
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump:
 
  Contains New Posts Forum Contains New Posts   Contains No New Posts Forum Contains No New Posts   A Closed Forum Forum is Closed