Oops
[image]http://www.bright-shadows.net/logout.php[/image]

Edit: yeah, it is annoying

Yeah that's an old CSRF bug that hasn't been fixed.
http://www.bright-shadows.net/forum/forum_showtopic.php?topicid=2329

Then let's try to fix it.
The most simple way would be a little form at the logout.php which asks "Do you really want to logout?" or something with a POST-Button i guess.

Yeah but the admins are quite busy/lazy for now

PS. did u get urself logged out too?

Well, i turned off loading images to bypass it. But that screws the layout up, so i just edited it

ok, i played around with this a while and noticed the fact that a POST-Form is worthless.

You can't just do an <img src= for this. You have to make the user click on a link to visit your prepared page.

Example:

assuming the logout.php checks for $_POST['submit'] == "ya, log me out"
With this you could of course do other funny things, like giving admin-rights to yourself, adding news etc.
All you need is an admin clicking your link. I don't think everyone here is surfing with javascript turned off and checks the source of every page before visiting

A secure way would be to add an <input type="hidden" or a &secret= in the url with random data, stored in a $_SESSION which is checked before logging out or other things. (And make sure the page doesn't allow XSS.)

this is pretty old news,

Oh well, maybe you overlooked the "With this you could of course do other funny things, like giving admin-rights to yourself, adding news etc."-line.
The logout-thing is just a very simplified example.
The same way you can post forum-posts with the corresponding nick automatically for example, open topics, or if an admin clicks the link: delete topics.
Or if an admin is logged into the adminzone/ (htaccess) do nasty things. (assumed you know the field-names for the different actions.)

I didn't miss anything, It's just old news.

So there's no other way than using random/secret code?
Imagine we have to secure 100 pages like that...
It'll be a tedious and error-prone job.
I wonder what the www's evolving into...