Did the login routine change from 2.3.2 to 3.0.7?

[dgraff]

Yesterday, I upgraded my vBulletin SW from version 2.3.2 to 3.0.7. Since my server sits in the DMZ it is accessed from two different URLs. Internally, everything is working fine, but now all of my customers get the following error when they enter their username and password.

"POST requests from foreign hosts are not allowed."

Everything worked fine before the upgrade. Is there a different login routine in 3.0.7 from 2.3.2? If so, what do I need to tell my firewall guys?

Thanks,
Doug

[Zachery]

Alot... there was a security change in 3.0.6/7 that made it so POST requests from foreign hosts, are not allowed. This means any url that is not set to be the forum url.

You can try adding this to the config, however, you will lose the security benifit.

define('SKIP_REFERRER_CHECK', true);

[dgraff]

When you say,

" You can try adding this to the config, however, you will lose the security benifit."
Would I do that through the admincp or in a file somewhere. If it's in a file...can you point me to where the file might be?

Thanks,
Doug

[Steve Machol]

The first thing I recommend is that you reupload all the original vB non-image files (except install.php). Make sure you upload these in ASCII format and overwrite the ones on the server.

[dgraff]

I don't see how doing the same thing again will change the security routine? I'd rather have someone tell me where I enter the "SKIP_REFERRER_CHECK" property.

Thanks,
Doug

[Zachery]

I did say, you need to add that line to config.php

[dgraff]

OK...so this is the exact line I put into config.php

$define SKIP_REFERRER_CHECK = true;

and it didn't change the outcome. I'm still getting

POST requests from foreign hosts are not allowed.

If I did everything correct above. Any suggestions on how to manage a server that sits in a DMZ and is addressed from two URLs?

[Steve Machol]

Just out of curiousity, did you reupload the original vB files as I sugggested?

[Zachery]

OK...so this is the exact line I put into config.php

$define SKIP_REFERRER_CHECK = true;

and it didn't change the outcome. I'm still getting

POST requests from foreign hosts are not allowed.

If I did everything correct above. Any suggestions on how to manage a server that sits in a DMZ and is addressed from two URLs?

It needs to be this line exactly as i said above

define('SKIP_REFERRER_CHECK', true);

Steve this is an issue from the security measures added in 3.0.6/7

[Steve Machol]

Steve this is an issue from the security measures added in 3.0.6/7

Are you saying this is common with the original vB 3.0.7 files? If so, this is the fiorst I've heard of this.

[Marco van Herwaarden]

Yes this was added in 3.0.6 to prevent a possible security issue.

You will only have problems with this new protection if you access your board from different domains.

There was also a way (but that required a 1 line hack i think) to only accept the second domain and keep the rest of the protection up.

[Steve Machol]

Ahh, forgot about the second domain issue. Thanks.

[dgraff]

Thanks Guys,

This seems to have done the trick.

Doug

[Gordon Regar]

Is a reboot necessary after adding the line:
define('SKIP_REFERRER_CHECK', true);
to ./includes/config.php?
tks.
I'll reboot the Windows server anyway just to be on the safe side.

[Marco van Herwaarden]

No.

PHP scripts are always evaluated when they are called.