How To Disable 'Please Confirm' Style Switch?

[DRE]

Hi. How do I disable the confirmation screen before choosing a style when using this type of url?

For instance: http://www.xenforo.com/community/misc/style?style_id=7

 

[Jake Bunce]

It requires an addon. You can post a request here:

http://xenforo.com/community/forums/resource-and-add-on-requests.68/

Though removing the confirmation opens up your users to potentially annoying csrf attacks where their style can change without their consent.

 

[DRE]

Don't know what a csrf attack is but if you click that link while viewing it as a guest, it does not give you a confirmation page. It just automatically takes you to the style. What's wrong with that while being logged in?

 

[Jake Bunce]

For example, some one could put an IMG tag in their signature that loads the "style switch" URL, thereby changing the style preference of all registered users who view their sig.

 

[DRE]

Lmaooo i remember there being similiar tricks in vb3 where peeps would lose all of their thread subscriptions cause of a deceptive link.