XF 1.5 Possible Security Issue

[M J Austwick]

Hi,

I moved from vB5 to Xenforo recently and it has been a huge success, but yesterday a new user posted claiming to have been randomly logged in as two different users, one of whom is a mod.

They posted proof that they had indeed had Moderator level access, so I'm happy that they aren't just lying for fun.

It is possible that the specific mod account may have been compromised, but I need to rule out the possibility that they are telling the truth. I'm not using any add ons other than the Media pack.

Any thoughts?

Oz

 

[NeoCHI]

Is there a way to setup Engintron to work with xenforo? If so how do I tell my hosting service to do that?

 

[Optic]

I don't use Engintron/nginx (am on LiteSpeed using their XF LSCache plugin) but looks like you need to adjust exclusion rules:
https://github.com/engintron/engintron/issues/12

Probably best to ask them for help.

I don't think any full page cache will do logged in users on forums (only for guests) - there's so many ways you can adjust permissions for each member/group (which changes how each page can look on both a thread and forum level) it probably isn't worth the overhead.