Search options (Page 9 of 307)

Yes, the issue would be your IP changing between when you view the page and when you click the logout link. However, I think I would argue that the IP changing so often is the bug, not the CSRF token
It's not an issue outside of 1.2, since 1.3's CSRF token system does not depend on IP. I don't know how I would go about dealing with ths in 1.2, so I'm tempted to leave it as it is.
To fix the issue by removing the token, you can just remove the check in login.php and the csrf_token generation in include/functions.php

No new features that come immediately to mind, just security issues and bugfixes
http://punbb.org/download/hdiff/hdiff-1 … .2.17.html

I don't think it's necessarily rewrite, it looks like it's Apache serving up files even without their extensions.

No problem, glad to help

You have to call pun_setcookie with the same parameters, just change the expire parameter to the new time.

Yes, upgrading should be simple and painless.
You'll replace all the PHP files for the forum and run a script to upgrade the database.

That's because it isn't documented, it's a hack to get around a limitation

Divnain: Yes.
To hide the option, you need to edit register.php and profile.php to remove not only the option but the PHP that allows you to set it. Then, you run an update command to set save_pass to 0 on the users table. Then I think you're set.

SuperMAG: That's not the issue
Irulan: You're right, that is the issue here, although it shouldn't happen: that's not a default Apache behavior, at least.

Moved to Modifications, since that's what you want.

SuperMAG: I already confirmed that there are no extensions and that the problem is unrelated to PunBB's rewrite system