<![CDATA[PunBB Forums — confirm_refererer]]> https://punbb.informer.com/forums/topic/18340/confirmrefererer/ Sat, 09 Feb 2008 01:24:49 +0000 PunBB <![CDATA[Re: confirm_refererer]]> https://punbb.informer.com/forums/post/109214/#p109214 pedrotuga: No. CSRF attacks are very real. Without the confirm_referrer check, I can make an administrator do things on a forum just by visiting a page I control (on any site).

]]> Sat, 09 Feb 2008 01:24:49 +0000 https://punbb.informer.com/forums/post/109214/#p109214 <![CDATA[Re: confirm_refererer]]> https://punbb.informer.com/forums/post/109200/#p109200 I don't think you will fall into a critical security hole, but the referer  check makes things a bit more trick on the attacker side, so it's good to have it.
So i guess the answer is: none really. or... you will take one first ( very thin though ) defense down.

PS:Camarada, sem problema, esse inglês está bom. big_smile

]]> Fri, 08 Feb 2008 22:50:36 +0000 https://punbb.informer.com/forums/post/109200/#p109200 <![CDATA[Re: confirm_refererer]]> https://punbb.informer.com/forums/post/109190/#p109190 CSRF attacks.

Moved to PunBB Discussion

]]> Fri, 08 Feb 2008 21:35:30 +0000 https://punbb.informer.com/forums/post/109190/#p109190 <![CDATA[Re: confirm_refererer]]> https://punbb.informer.com/forums/post/109180/#p109180 MattF wrote:

The confirm_referrer function is there...

Cross site? Style php injection?

]]> Fri, 08 Feb 2008 18:28:43 +0000 https://punbb.informer.com/forums/post/109180/#p109180 <![CDATA[Re: confirm_refererer]]> https://punbb.informer.com/forums/post/109177/#p109177 The confirm_referrer function is there for security purposes. I believe cross site scripting is merely one of the attacks you have made yourself open to by removing it.

]]> Fri, 08 Feb 2008 18:21:12 +0000 https://punbb.informer.com/forums/post/109177/#p109177 <![CDATA[confirm_refererer]]> https://punbb.informer.com/forums/post/109175/#p109175 Which are the consequences of the removal of the "confirm_refererer" of the files of the punbb?

I had some problems with the "refererer check" and that was my only solution.

]]> Fri, 08 Feb 2008 17:58:04 +0000 https://punbb.informer.com/forums/post/109175/#p109175