Invalid redirect url appearing since security patch

[Bahadar Musalman]

There are 3 solutions mentioned, have you tried any of them? Best is to use the .htaccess option.

Thanks Black Tiger
This option set my problem
Now My Forum is Right

[canyoncomposite]

I'm not sure if this problem is related but at the bottom bar there's a link to my forum labeled "www.compositescentral.com" but it refers to "www.compositescentral.com/www.compositescentral.com".

This same issue appears with the lost pw form where my forum url is repeated twice before the login do function is after it. I think this might be the source of my issues. Any ideas?

[Lynne]

What *exactly* do you have in AdminCP > vBulletin Options > site name/url/etc > Forum URL ?

[canyoncomposite]

Below is a screenshot. Thanks for the help!

[Trevor Hannant]

Forum URL should be http://...

[kmike]

Looks like the 3.8 patch has a flaw:

// if the "realurl" of this request does not equal $bburl, add it as well..
$realurl = VB_URL_SCHEME . '://' . VB_URL_HOST;

The problem is that VB_URL_SCHEME and VB_URL_HOST are undefined in vB 3.8. Maybe it's a piece of code from 4.x?

It's supposed to add the real URL of the site (not the one defined in the options, but the real URL taken from the web server request) to the whitelist. Looks like if it was working, it would take care of the issues in this thread.

[Webbstre]

I found an easyer solution, just add "http://domain.com/forums" to your Redirect Domain Whitelist in the Admincp->Site/Url/Contact details.
Problem fixed.

However, an automatic redirect from domain.com to www.domain.com should be nicer.

Thanks for this! It fixed it on my site.

[Paul M]

Looks like the 3.8 patch has a flaw:

// if the "realurl" of this request does not equal $bburl, add it as well..
$realurl = VB_URL_SCHEME . '://' . VB_URL_HOST;

The problem is that VB_URL_SCHEME and VB_URL_HOST are undefined in vB 3.8. Maybe it's a piece of code from 4.x?

Yep, that looks like a bug.

[hossenpheffer]

I'm running version 3.8.7 PL2. I've tried changing the "Cookie Domain" and "Path to Save Cookies" solutions without success. I don't see a "Redirect Domain Whitelist" option in the "Site/Url/Contact Details" page. And I'm currently running on Windows Server 2003/IIS6, so the .htaccess solution isn't going to help either.

I can just put up a notice for users to make sure they use www with the url for now, but will a code patch be offered soon? Any other options or solutions?

[dknelson99]

Yep, that looks like a bug.

So what is the correct fix?

[Paul M]

There is a fix in the pipeline, I have no eta tho.

[pirate4x4lance]

Here's how we fixed it...

Temporary patch to functions.php redirect_whitelist doesn't exist as an "option". It's called "allowedreferrers" in the settings table. By changing the check for the whitelist to options['allowedreferrers'] it fixed our issue.

[kiss of death]

never mind figured it out