Wedge
Public area => The Pub => Bug reports => Topic started by: CerealGuy on July 21st, 2016, 11:57 PM
-
Following problem occurs from time to time:
When I'm, trying to create a new post and during this the session expires, the content gets lost. I think that's true to all $_POST related stuff. $_GET stuff is fine because of the redirection after the login.
Idea: Put all $_POST data in a hidden form when the Login form is getting displayed and try to send that back to the original form/action. I will try to do that.
How is SMF doing this?
-
I don't think SMF is doing anything about that..?
Your session shouldn't usually expire anyway..? I think the default in Wedge is the upper end of our cookie length choices..?
-
This works until your session expires. The bigger the length the smaller the chance of losing your stuff. Still this is something that bugs me, and should be done better (in my opinion).
-
If you plan on putting $_POST/$_GET data in hidden inputs, remember that if done slightly wrong is a potential security risk, very similar to the one fixed two or three years ago for the admin login function.
-
If you plan on putting $_POST/$_GET data in hidden inputs, remember that if done slightly wrong is a potential security risk, very similar to the one fixed two or three years ago for the admin login function.
That's the thing. It's a potential CSRF vulnerabiltiy if done wrong (?!). Or at least, it's what I muse about.