Chris Boulton Wrote:It's because we changed the logout authentication in 1.2.10 because it didn't work in some circumstances (and this is an example of a case where it didn't work correctly previously). I left in backwards compatibility for the old session based links, but it isn't working correctly on yoru forum.
Your forum is doing something unusual causing a new session ID to be generated on search page load. This is why the old links no longer work. I'll look in to that later.
For now, you can do a global search and replace in the templates.
Find: &sid={$session->sid}
Replace with: &logoutkey={$mybb->user['logoutkey']}
That should update any incorrect templates.
Incase it doesn't, open up the "header_welcomeblock_member" template and perform the replacement yourself.
Also - if possible, could you please send me your FTP details so I can possibly look in to the reason why new sessions are always being generated (what the actual cause of this problem is)
You can also revert your member.php to a fresh one form the download.
Chris
Got it working now must have not copy over it right...
Quote:Find: &sid={$session->sid}
Replace with: &logoutkey={$mybb->user['logoutkey']}
That helped me with the top login / logout function. But the one in the footer still does the same problem and doesn´t log me out.
I mean that one on the bottom:
Quote:Logout | Mark All Forums Read | Forum Team | Forum Statistics
How to fix that ?
WarBirD
Quote:Logout | Mark All Forums Read | Forum Team | Forum Statistics
How to fix that ?
WarBirD
You can find that link in the
Index Page Templates >
index_logoutlink.
Replace it with:
<a href="member.php?action=logout&logoutkey={$mybb->user['logoutkey']}">{$lang->index_logout}</a> |
Thanks, that did it for me.
I'll add this info to the cannot logout thread.
I had experienced it myself on my forum but Tiki assured me that the old ones would still work.
I was experiencing the same thing, it was very annoying, but this fixed it.
Thanks!
Yeah this occurs because of users having to edit the logout links manually in 1.2.9. The board sees it as a custom template and doesn't overwrite.
This will only occur if you haven't updated your templates - Those of you who received one of the first copies of 1.2.10 had a bug because of the way template versions work (The diff comparison thought that 129 was > than 1210) so those of you will need to redownload the MyBB Package & reupdate and then the template diff will work correctly so you can properly update your boards.
I can confirm this. And when you try to logout on my Forums, you can see &sid= but still, it says the javascript malicious message.
Edit: Oh, it now uses logoutkey? Hmm, the template must have not updated somehow... I'll update it manually
For everyone...
// Check session ID if we have one
if($mybb->input['sid'] && $mybb->input['sid'] != $session->sid)
{
error($lang->error_notloggedout);
}
// Otherwise, check logoutkey
else if($mybb->input['logoutkey'] != $mybb->user['logoutkey'])
{
error($lang->error_notloggedout);
}
As you can see, sid will still work