Fixed styleid URLs require token?

[Jake Bunce]

Re: http://xenforo.com/community/threads/linking-directly-to-a-specific-style.8228/

IMO the token shouldn't be required for styleid requests.

 

[Paul B]

It only actually occurs if logged in (obviously).

Try logging out and then clicking here: http://xenforo.com/community/misc/style?style_id=1&redirect=/community/
http://xenforo.com/community/misc/style?style_id=1&redirect=/community/or here: http://xenforo.com/community/misc/style?style_id=2&redirect=/community/

 

[Russ]

Whats the correct way for users logged in? I know the style chooser is there for a reason but I'm working on something else that may need manual links to other styles logged in/out.

 

[Mike]

This is entirely intentional - anything that changes the user state shouldn't be available via GET, unless it's protected by a user-specific token. It's effectively a CSRF issue.

I'm not sure what the best option is.

 

[Jake Bunce]

Oh I didn't realize it changes the user preference. I am used to vB where it writes a browser cookie.

 

[Mike]

Either way, it significantly changes what the user may see - and as a GET request, it could be embedded as an image, which would be really confusing.

 

[Mike]

This doesn't error any more, and acts as a confirmation page instead.

 

[kingston]

This doesn't error any more, and acts as a confirmation page instead.

Is there any way for us to mod the page so it auto accepts the style? (and in our part accepting the inherrent risk?)

 

[Jake Bunce]

Is there any way for us to mod the page so it auto accepts the style? (and in our part accepting the inherrent risk?)

Yes it's possible. That would be a Development Question or Add-on Request.

 

[kingston]

Yes it's possible. That would be a Development Question or Add-on Request.

That may have been a bit tongue in cheek. I just funded three big add-ons (IMO). Trophy Promotions, Mass Alerts, and Duplicate IP check for multiple users.