Different "No thread specified... " + Polls when not logged in

[PHPdev]

First for the requested information:

vBull Ver: 2.2.7
MySql: 4
PHP: 4.2.3
Apache: 1.3.26
OS: FreeBSD

Error Message: No thread specified. If you followed a valid link, please notify the webmaster


This forum has no Hacks and No Files have been edited.. the only things that we have changed are the colors and the Logo Image File.

Problem is that when a user is not logged in and they go to a poll, they are allowed to vote on the poll, if they have a valid username. (These are the default Perms settings in the AdminCP) So they first vote on the poll, and then get the login box. The URL at this point reads poll.php, the thread ID is not there.

Enter valid login data, and you will get the "Thank you for logging in" message. Next message the user sees is the message in question.

Now if the user has previously logged in they can vote just fine.

I did submit this issue to support, and they stated to post it here...

URLS:
http://www.worldspankingforum.com/forums/ - Entrance
http://www.worldspankingforum.com/forums/showthread.php?threadid=113 - Poll Thread

Thanks

PHPdev

[Steve Machol]

Confirmed in my unhacked 2.2.8 test forum.

[Scott MacVicar]

its a limitation of the login form it will include GET data but not POST data mainly due to the fact that a redirect is used after you login.

[PHPdev]

Scott,

So now we know where the problem lies... Is this something you all are looking at fixing. I mean it is not that big of an issue, and we have not received any complaints from our members, Just curios.

Thanks

PHPdev

[Scott MacVicar]

it can't be fixed without removing the redirects after the login pages which would cause alot of confusion with users, hence why they are there.

the redirect page only passes on get data.

[george_proost]

Originally posted by Scott MacVicar
it can't be fixed without removing the redirects after the login pages which would cause alot of confusion with users, hence why they are there.

the redirect page only passes on get data.

Weak argument it seems to me.

It is a problem if an administrator needs to be notified when something occurs that is not normal for a reason that is known and not documented correctly.

Either fix it or provide a corrected error message eg. :D

"Oops, we have a problem.. normally at this stage we give you a message telling you about an "invalid thread" and to contact the administrator .. just logout completely .. login again and re-vote .. that's not too difucult.. Is it?"


:)

gEORGE

[PHPdev]

george_proost,

I must agree with you, there always is a solution, just some of them are not a "Prity" as others.

I will first say that I dont think I know as much about vBulletin as Scott or any other member of the vBulletin team. But it seems to me that POST.php could be modifed to look for get variables as well as post. Or to just look for get variables all together. Assuming you all are using the header() function of PHP for redirection it does make sense why the POST variables are not getting there.

Another solution would be to mofidfy the security so that if the security settings for a thread do not allow "Unregistered/Not Loggedin" to vote on polls, then the user is given a message stating they must login first.

Finally a third sudgestion is that if an "Unregistered/Not Loggedin" user votes on the poll they see the login box as they do now, but they are then redirected to the actual thread using SHOWTHREAD and a GET variable, to vote again.

I do think that vBulletin is a great product, and this bug is not that big of an issue.

Thanks

PHPdev

[Scott MacVicar]

the easiest way would be disabling the vote button if the user does not have permission to vote.