MyBB Community Forums

Hello,
in the table users, the field "loginkey" what is it???

It is a key that is unique to a user. It makes sure that when a user clicks "logout" only the user who is truly logged in as that username can logout.

Eg: if any user could type: http://your site.com/member.php?action=logout&userid=1 they could log anyone out

I don't see why it couldn't just be action=logout and have it get the userid by $mybb->user['uid'].

Because of CSFR exploits. I could add an image to http://example.com/member.php?action=logout then every user who loads it would get logged out because they would have the correct uid for their session.

Exactly ^

I did not understand why can not fit the method of dragonexpert ..
The loginkey when it is created? Remains the same or change based on an event?

It remains the same. But if you think, I can find out your uid by visiting your profile .

http://community.mybb.com/user-22157.html

Your user ID is 22157. Then I could simply hack your uid into my session (using a POST data editor via a plugin for Firefox) and visit the logout link, and log you out.

However, I have no way of finding your post key. It is randomly generated on signup. Mybb tells your computer what your post key is when you login, so your computer can authenticate yourself when logging out

(2012-04-10, 02:47 PM)Tom K. Wrote: [ -> ]It remains the same. But if you think, I can find out your uid by visiting your profile .

http://community.mybb.com/user-22157.html

Your user ID is 22157. Then I could simply hack your uid into my session (using a POST data editor via a plugin for Firefox) and visit the logout link, and log you out.

However, I have no way of finding your post key. It is randomly generated on signup. Mybb tells your computer what your post key is when you login, so your computer can authenticate yourself when logging out

I did not know you could edit a data session...
Now, i'm understand.

thank you.

(2012-04-10, 12:46 AM)Charlie Hadden Wrote: [ -> ]Because of CSFR exploits. I could add an image to http://example.com/member.php?action=logout then every user who loads it would get logged out because they would have the correct uid for their session.

If its about CSRF, Why not check the referal url (http_referer).
If the referal url is not the forum itself, dont make the user logout.

It works fine just as it is.