How to fix this?

[BalkanW]

Thanks :bloodlust:

BalkanW Reviewed by BalkanW on 27th Oct 2008. How to fix this? http://www.croatia-picturehost.com/images/mo9p0bbz4t1oa3lh2hri.jpg Thanks :bloodlust: Rating: 5

[Greeny]

User CP > Edit Options > and set "DST Correction Option" to "dst corrections always off", you should be able to set it as always off as default for all users but idk, I don't use vB anymore.

[Ak47]

Wrong.

This may help:

With the new version of vBulletin 3.6.10 and 3.7.0 RC4 +, a new protection against Cross Site Request Forgery (CSRF) has been introduced. This new protection might influence the coding in modifications.

Cross Site Request Forgery (CSRF) involves taking advantage of the stateless nature of HTTP, there are no ways to ensure the exact origin of a request, its also not possible to detect what was actually initiated by a user and what was forced by a third party script. A token was added to the latest version of each of the vBulletin products, with the release of 3.6.10 and 3.7.0 RC4 it is no longer possible to submit a POST request directly without passing in the known token.

The addition of a security token for each POST request removes the ability for a remote page to force a user to submit an action. At the moment this protection will only apply to vBulletin files and third party files will need to opt into this protection and add the appropriate hidden field. This was done to preserve backwards compatibility.

Adding Protection to your own files

To opt your entire file into CSRF protection the following should be added to the top of the file under the define for THIS_SCRIPT.

PHP Code:

define('CSRF_PROTECTION', true);

With this change all POST requests to this file will check for the presence of the securitytoken field and compare it to the value for the user, if its wrong an error message will be shown and execution with halt.

If this value is set to false then all CSRF protection is removed for the file, this is appropriate for something that intentionally accepts remote POST requests.

You should always add this to your file, even if you don't think the script is ever going to receive POST requests.

An absence of this defined constant within your files will result in the old style referrer checking being performed.

Template Changes
The following should be added to all of the forms which POST back to vBulletin or a vBulletin script. This will automatically be filled out with a 40 character hash that is unique to the user.

PHP Code:

<input type="hidden" name="securitytoken" value="$bbuserinfo[securitytoken]" />

Again it is worthwhile adding this to your templates even if it is currently not using the CSRF protection.

Exempting Certain Actions
It may be appropriate to exempt a particular action from the CSRF protection, in this case you can add the following to the file.

PHP Code:

define('CSRF_SKIP_LIST', 'action_one,action_two');

The above example would exempt both example.php?do=action_one and example.php?do=action_two from the CSRF protection, if the CSRF_SKIP_LIST constant is defined with no value then it will exempt the default action.

If the skip list needs to be changed at runtime is it available within the registry object, using the init_startup hook the following code would be used to exempt 'example.php?do=action_three'.

PHP Code:

if (THIS_SCRIPT == 'example') 
{ 
        $vbulletin->csrf_skip_list[] = 'action_three'; 
}

.................................................. .................................................. ..
AJAX requests
.................................................. .................................................. ..
You need to add the security token to AJAX requests using POST. This can be simply added using the variable "SECURITYTOKEN". An example is below.

PHP Code:

YAHOO.util.Connect.asyncRequest('POST', scriptpath + '?do=ajax', { 
    success: this.handle_ajax_response, 
    failure: this.handle_ajax_error, 
    timeout: vB_Default_Timeout, 
    scope: this 
}, SESSIONURL + 'securitytoken=' + SECURITYTOKEN + '&foo=' + foo);

.................................................. .................................................. ..
Searching for templates that need editing
.................................................. .................................................. ..
If you want to search all template that you need to edit to add:

<input type="hidden" name="securitytoken" value="$bbuserinfo[securitytoken]" />

you can use that query in your MySQL database or maintenance sql quiry:

SELECT templateid , title , styleid FROM template WHERE template_un NOT LIKE '%<input type="hidden" name="s" value="$session[sessionhash]" />%<input type="hidden" name="securitytoken" value="$bbuserinfo[securitytoken]" />%' AND template_un LIKE '%<input type="hidden" name="s" value="$session[sessionhash]" />%' ORDER BY title ASC, styleid ASC;

.................................................. .................................................. ..
Security token errors
.................................................. .................................................. ..
In your Admin CP under Styles & Template select Search In Templates...

Search for:
HTML Code:

value="$session[sessionhash]"

In every template this occurs in add this line directly after the line containing the above, if it doesn't exist already:

PHP Code:

<input type="hidden" name="securitytoken" value="$bbuserinfo[securitytoken]" />

Save the template.

I did not make this tutorial. Credit goes to Hoxxy of LittleWhiteLines.

[Hawk]

You should search before posting this, It was solved numerous times. Anyway lokiloki helped me when I had that problem.

[michigan033]

Or you could just get a legal Vbulletin license. It is worth it.

[detailz]

Or you could just get a legal Vbulletin license. It is worth it.

It's nothing to do with being legit or not.

It's a to do with the skins installed.

[clarksta]

Or you could just get a legal Vbulletin license. It is worth it.

i had a genuine version and when i upgraded i had that issue so that has nothing to do with it

[Greeny]

Wrong.

This may help:

Actually, there are multiple errors that cause this, the one you posted failed for me, I too searched the error in google. The one I posted worked for me and another site I know of. So simply saying "Wrong." is kinda stupid.

Or you could just get a legal Vbulletin license. It is worth it.

This happens with legal vb's too.

[BalkanW]

When you use one tuoch ban it's my show,end i have vb licence

[detailz]

When you use one tuoch ban it's my show,end i have vb licence

It's the skin, it needs to be updated and the token needs to be sorted, or you
will keep getting the above errors.