Ad Seller Pro breaks Remove Old Posts

[David8]

I am running an SMF 2.0 RC4 system and want to remove old posts from some of my boards.  I get the following error message: "Unable to verify referring url. Please go back and try again."

I have traced the problem to the appearance of an "action=adpro" in a 'old_url' that is tested by Security.php

Here is the thread I opened on the SMF support board.

http://www.simplemachines.org/community/index.php?topic=415940.0

I think that I have identified the source of the problem.  It seems that the
package Ad Seller Pro 1.0.8 is messing up the URL.

The error message is triggered by code in Security.php at lines 723 to 728 in
definition of function checkSession().  This function is called by function
RemoveOldTopics2() in RemoveTopics.php with the arguments shown:

   checkSession('post', 'admin');

At line 724 checkSession tests to see if the code 'action=admin' is present in
the URL returned by the PHP function $_SESSION['old_url'].  The test fails and
triggers the error 'verify_url_fail'.

To debug I inserted the following line of code after line 725 in Security.php

      log_error('old_url=[' . $_SESSION['old_url'] . ']');

This code returns the following in the error log:

http://...my board domain.../index.php?action=admin;area=maintain;sa=topics;activity=pruneold
old_url=[http://...my board domain.../index.php?action=adpro;sa=v&id=7&l=2&m=0&t=1297440989]

The second line above shows the problem.  It says 'action=adpro' not 'action=admin'
and the test fails.  It looks like Ad Seller Pro is messing up the old_url.

Now the question is how to fix it.

[SMFHacks]

Try changing the following

Open Sources/Subs.php

Find

Code: [Select]

// Remember this URL in case someone doesn't like sending HTTP_REFERER.
if (strpos($_SERVER['REQUEST_URL'], 'action=dlattach') === false && strpos($_SERVER['REQUEST_URL'], 'action=viewsmfile') === false)
$_SESSION['old_url'] = $_SERVER['REQUEST_URL'];


Change to

Code: [Select]

// Remember this URL in case someone doesn't like sending HTTP_REFERER.
if (strpos($_SERVER['REQUEST_URL'], 'action=dlattach') === false && strpos($_SERVER['REQUEST_URL'], 'action=adpro') === false && strpos($_SERVER['REQUEST_URL'], 'action=viewsmfile') === false)
$_SESSION['old_url'] = $_SERVER['REQUEST_URL'];



[David8]

Your hack fixed it.  Why did the problem occur?  Is Ad Seller Pro changing the old_url variable that SMF seems to rely on for verification? 

[SMFHacks]

Will SMF logs all urls/actions so when a view occurs after the page is loaded that is the last url that is visited.

Will add the fix then update for RC5.