Myshoutbox 1.7 security problem csrf

[emiak]

Hello some one can help me to secure this plugins because it s a very good plugins but they are some probleme about the security.

for the csrf i know we need to use token

inc/plugins/tpl_sf_shoutbox.txt
find :

<td class="trow2" align="center"><form onSubmit="ShoutBox.postShout(); $('shout_data').value = ''; return false;">{$lang->sf_sb_shout} <input type="text" id="shout_data" size="50" /> - <input type="submit" value="{$lang->sf_sb_shoutnow}" id="shouting-status" /></form></td>

replace by :

<td class="trow2" align="center"><form onSubmit="ShoutBox.postShout(); $('shout_data').value = ''; return false;">{$lang->sf_sb_shout} <input type="hidden" id="shout_key" value="{$mybb->post_code}" /><input type="text" id="shout_data" size="50" /> - <input type="submit" value="{$lang->sf_sb_shoutnow}" id="shouting-status" /></form></td>

jscripts/shoutbox.js
find :

message = $("shout_data").value;

and put this line after :

key = $("shout_key").value;

find :

postData = "shout_data="+encodeURIComponent(message).replace(/+/g, "%2B");

replace by :

postData = "shout_data="+encodeURIComponent(message).replace(/+/g, "%2B")+"&shout_key="+key;

inc/plugins/spicefuse_shoutbox.php
find :

if ($mybb->user['usergroup'] == 1 OR $mybb->user['uid'] < 1 OR !sb_can_view()) {
die("failed!");
}

and put this line after :

verify_post_check($mybb->input['shout_key']);

after that desactive/réactive the plugin shoutbox and it s good.


but this correction is for spicefuse shoutbox how i can adapte it for myshoutbox 1.7
because for the last step :


inc/plugins/spicefuse_shoutbox.php
find :

if ($mybb->user['usergroup'] == 1 OR $mybb->user['uid'] < 1 OR !sb_can_view()) {
die("failed!");
}

i cant find this line on the myshoutbox 1.7 plugins



sorry for my bad english

help me thanks in advance

[emiak]

no one can help me ????

[Diogo Parrinha]

Those instructions are for the spicefuse shoutbox and not MyShoutbox thus they may not apply correctly.
There is a CRSF vulnerability for sure which I always forget to fix when I've got some free time. It isn't a big deal though, it won't damage your forum.

[emiak]

thanks for your reply