9
I don't think we are facing exactly the same problem. But, in my case, there was a trouble when an anonymous user try to post a comment: he gets that error message "taking you ... where you were".
This is caused by the empty $_SESSION['XOOPS_TOKEN_SESSION'] as far as I know. (please bear in mind that I'm not a coder. :-p) So I swapped class/xoopssecurity.php with the one for "XoopsCube". (XoopsCube is compatible with XOOPS 2.0.x for the time being.) And I also uploaded "class/token.php" from XoopsCube, added some lines within XoopsSecurity class.
Add the following code somewhere in class/xoopssecurity.php
function checkReferer($docheck=1)
{
$ref = xoops_getenv('HTTP_REFERER');
if ($docheck == 0) {
return true;
}
if ($ref == '') {
return true;
// return false;
}
if (strpos($ref, XOOPS_URL) !== 0 ) {
return false;
}
return true;
}
Please remember the fact that it may create an gaping security hole for I'm not a professional. At very least, it weakens the protection against CRSF. So all the webmasters must turn on referrer when s/he manages his/her web sites.
Anyway, this hack solved MY problem, and my site became more friendly to anonymous visiters. That's all I can say.
Liberty is never being too sure you're right....
