securitytoken issue with method="get" question

[scotsmist]

Sorry if this has already been asked.

During a vB upgrade, all of my custom templates which have


<input type="hidden" name="s" value="$session[sessionhash]" />
had this added after the above line


<input type="hidden" name="securitytoken" value="$bbuserinfo[securitytoken]" />
The problem is with forms that use method="get" - the securitytoken is being passed in the URL.

Looking through the vbulletin-style.xml I see templates that use method="get" that also include the $session[sessionhash], do not have the securitytoken so my question is, do I need to go through the custom templates and remove the securitytoken that was added by the vB upgrade, from all forms that use method="get"

[scotsmist]

Never mind, I found the answer looking at the code in upgrade_370rc4.php where it sets an array of $get_forms_only to exclude from having the securitytoken inserted after the sessionhash.

I'll amend the "get" forms that the upgrade changed now. Is there any reason for concern, passing the security token in the URLs ? An example of a custom template that has changed, is one similar to the forumjump, that passes the ID by a "get" method.