BoardMod Mirror - Form SPOOFING in YaBB

(UTC)

Choose Language:

BoardMod Mirror › YaBB & BoardMod › Programming & Coding Board › Form SPOOFING in YaBB

‹ Previous Topic | Next Topic ›

Pages: 1

Send Topic

Form SPOOFING in YaBB (Read 8087 times)

Martin_W Senior Member Offline I love YaBB 1G - SP1.2! Posts: 463 Location: Devon Joined: Jun 22^nd, 2005 Gender:	Form SPOOFING in YaBB Jan 18^th, 2009 at 3:28pm	Print Post
	I am writing a small script that opens a window which contains a small form. When I submit the form, I get this message: "Error: ALERT!! Form Spoofing Detected coming from IP address: xxx" I thought this message would come up if the submitted form was comming from a different URL? I am not finding it easy to trouble shoot this! The form action I am using is "$scripturl?action=mynewsub" Any pointers?


	WWW IP Logged

Martin_W Senior Member Offline I love YaBB 1G - SP1.2! Posts: 463 Location: Devon Joined: Jun 22^nd, 2005 Gender:	Re: Form SPOOFING in YaBB Reply #1 - Jan 18^th, 2009 at 3:44pm	Print Post
	OK, Adding the below to my form has worked, but I am sure it is not the correct way to do things!?!?!?! <input type="hidden" name="formsession" value="$mbname$username">


	WWW IP Logged

deti

Full Member

Offline

YaBB is the best!!!

Posts: 101
Location: Prien am Chiemsee
Joined: Mar 13^th, 2008

Re: Form SPOOFING in YaBB
Reply #2 - Jan 18^th, 2009 at 5:20pm

Print Post

In Subs.pl you find this:

Code

	$output =~ s~</form>~<input type="hidden" name="formsession" value="$formsession" /></form>~g;

Was immer Du tun kannst oder erträumst tun zu können, beginne es. Kühnheit besitzt Genie, Macht und magische Kraft. Beginne es jetzt.		Whatever you can do or dream you can, begin it. Boldness has genius, power and magic in it. Begin it now.
	Johann Wolfgang Goethe

IP Logged

Martin_W Senior Member Offline I love YaBB 1G - SP1.2! Posts: 463 Location: Devon Joined: Jun 22^nd, 2005 Gender:	Re: Form SPOOFING in YaBB Reply #3 - Jan 18^th, 2009 at 5:45pm	Print Post
	Thanks. Still not sure what I am meant to do?


	WWW IP Logged

deti

Full Member

Offline

YaBB is the best!!!

Posts: 101
Location: Prien am Chiemsee
Joined: Mar 13^th, 2008

Re: Form SPOOFING in YaBB
Reply #4 - Jan 18^th, 2009 at 7:15pm

Print Post

Martin_W wrote on Jan 18^th, 2009 at 5:45pm:

Still not sure what I am meant to do?

To avoid form spoofing the actual formsession must be transmitted. So, if you run the output through the sub in Subs.pl you must do nothing, if your output goes extra, then add the <input ..>-tag from inside the RegEx inside your <form ... >...</form>

Was immer Du tun kannst oder erträumst tun zu können, beginne es. Kühnheit besitzt Genie, Macht und magische Kraft. Beginne es jetzt.		Whatever you can do or dream you can, begin it. Boldness has genius, power and magic in it. Begin it now.
	Johann Wolfgang Goethe

IP Logged

Pages: 1

Send Topic

‹ Previous Topic | Next Topic ›

« Board Index ‹ Board Top