[Topics Anywhere] - Security issue

PerfRen · Joined: 01 Nov 2007 Posts: 36

Hi all,

When i enter http://www.domain.com/forum/topics_anywhere.php I get the following message...

"Sorry, it appears this is your first visit since we added the security questions to accounts. You will only be able to view your profile until you update it and add a question and answer. Thanks!

Click here to goto your profile."

Do you know why this might be happening?

Peter77

Sounds like something more to do with your hosting company or whoever runs your forum. Nothing in the topics anywhere MOD evokes that message.

Good luck.

PerfRen · Joined: 01 Nov 2007 Posts: 36

I have actually done some tracking down and it is some code in the MOD that is conflicting with phpBBSecurity.

It is something about the way the topics_anywhere system is instantiated which brings up this message.

It is the only php file on my forum that does this! It must be something in the code before the session management.

Peter77

hm, CTracker gave me the same issue with topics_anywhere.php back when I tried it ( none seo version ). I suppose your best bet would be to ask at phpbbsecurity's support site. sorry about that.

PerfRen · Joined: 01 Nov 2007 Posts: 36

Hmmm it could be CTracker or phpBBSecurity then!

What did you do to solve it?

Peter77

I got rid of CTracker Laughing

.
Really, its was too heavy of a MOD for what it says it does, IMO You can help block bad bots other ways.

PerfRen · Joined: 01 Nov 2007 Posts: 36

Ok there is something at the start of the topics anywhere file that is getting/setting variables differently that that of a normal phpBB forum.

It si one of the calls before the session handling that I believe is making the baord thinking it is the first time of using the updated security feature.

Can anyone tell me what all the calls before the session management section are doing and why they are needed.

Many thanks!

SeO

Honestly, I'm not very much convinced by ctracker and phpbbsecurity. They mostly protect against old, known and fixed security holes.

I don't know precisely, but it may be possible to deactivate protection for this file only.

Then, you can as well use the GYM sitemaps rss feeds to output links to a last posts/topic listing everywhere, which would have the advantage of providing with links bot can see, topic anywhere is using JS.

PerfRen · Joined: 01 Nov 2007 Posts: 36

I already use the GYM sitemaps so will have a look at the topic you posted thanks Smile

Still as asked previously, can anyone tell me what all the calls before the session management section are doing and why they are needed in the topics anywhere file.

Would love to be able to help others and provide a solution for them too Smile

PerfRen · Joined: 01 Nov 2007 Posts: 36

Anyone?

Peter77

Well, everything above the // Start session management line has to do with the time & date configurations and as well as the SEO part of the MOD. If Your wondering about the SEO code having anything to do with the issue... I had the same problem even with the regular topics_anywhere version.