[Solved] Any thing better than CSRF

No, I think it would not work as csrf in all circumstances.

For instance it might work on a login screen. Fine. But CSRF is a problem much deeper than login. It exploits the trust a site has for a user, making it seem like a request that was not issued by the user intentionally was sent by the user to a site they happen to be logged into.

So you would need robot checking on every form. Imagine an admin screen. You might have fifty pages with forms on them. Each page would say 'am I a human' and worse, challenge the user every five minutes with a 'what is this text' type question every time it decided it was not sure if it was a human still.

So yes, it would work on a single form, preferably on a contact form or a login form, the sort of place you want that sort of check, as you do not want a robot pumping away trying emails and passwords endlessly. However, CSRF is about making sure all, and any post, from your site is from a form that was actually delivered from your server. Especially when a user is logged in genuinely.

Personally, for me CSRF has always worked perfectly and as intended. I have never had any issues with it at all. Even with ajax it is quite straight forward to work with.

Best wishes,

Paul.

I just can't seem to get CSRF to work each time I submit it throws that error I mentioned I also use form_open_multipart()

PHP Code:

<?php

class Thread extends MX_Controller {

    private $pre_message;

    public function __construct() {
        parent::__construct();
        $this->load->library('form_validation');
        $this->load->library('parsedown');
        $this->load->model('catalog/qna/thread_model');
        $this->load->model('catalog/qna/category_model');
        $this->load->model('catalog/qna/forum_model');
    }

    public function add($forum_id) {
        $this->form_validation->set_rules('subject', 'subject', 'required|min_length[5]|max_length[120]');
        $this->form_validation->set_message('required', 'This thread {field} is required!');

        if ($this->form_validation->run() == true) {

            if ($this->input->post('preview')) {

                $post_tmp_info = $this->thread_model->get_tempory_post($this->input->post('my_post_key'), $forum_id);

                if ($this->input->post('my_post_key') == $post_tmp_info['posting_id']) {

                    $data = array(
                        'forum_id' => $forum_id,
                        'subject' => $this->input->post('subject'),
                        'message' => $this->input->post('message')
                    );

                    $this->db->where('posting_id', $this->input->post('my_post_key'));
                    $this->db->update('post_tmp', $data);

                } else {

                    $data = array(
                        'posting_id' => $this->input->post('my_post_key'),
                        'forum_id' => $forum_id,
                        'subject' => $this->input->post('subject'),
                        'message' => $this->input->post('message')
                    );

                    $this->db->insert('post_tmp', $data);
                }

            }

        }        

        $this->get_form($forum_id);
    }

    public function edit($forum_id) {

        $this->get_form($forum_id);
    }

    public function index() {

    }

    public function get_form($forum_id) {
        

        if (form_error('subject')) {
            $data['error_subject'] = form_error('subject');
        } else {
            $data['error_subject'] = '';
        }

        $thread_info = '';

        if ($this->uri->segment(1) == 'newthread') {
            $data['action'] = 'newthread/' . $forum_id;
            $data['is_edit'] = false;
        }

        if ($this->uri->segment(1) == 'editpost') {
            $data['action'] = 'editpost/';
            $data['is_edit'] = true;
            $thread_info = $this->thread_model->get_post($this->uri->segment(2));
        }

        $post_tmp_info = $this->thread_model->get_tempory_post($this->input->post('my_post_key'), $forum_id);


        $this->parsedown->setLiteralBreaks(true);

        if ($this->input->post('preview')) {
            $data['my_post_key'] = $this->input->post('my_post_key');
            $data['pre_message'] = $this->parsedown->text($post_tmp_info['message']);
        } else {
            $data['my_post_key'] = $this->generateRandomString(15);
            $data['pre_message'] = '';
        }

        if ($this->input->post('message')) {
            $data['message'] = $this->input->post('message');
        } else if (!empty($thread_info)) {
            $data['message'] = $thread_info['message'];
        } else {
            $data['message'] = '';
        }

        $data['header'] = Modules::run('catalog/common/header/index');
        $data['footer'] = Modules::run('catalog/common/footer/index');

        $this->load->view('template/qna/thread_form', $data);
    }

    function generateRandomString($length = 10) {
        $characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
        $charactersLength = strlen($characters);
        $randomString = '';
        for ($i = 0; $i < $length; $i++) {
            $randomString .= $characters[rand(0, $charactersLength - 1)];
        }
        return $randomString;
    }
} 


There's only one rule - please don't tell anyone to go and read the manual.  Sometimes the manual just SUCKS!