diff --git a/web/inc/secure_login.php b/web/inc/secure_login.php
index dcfc2b82..b360c1e8 100644
--- a/web/inc/secure_login.php
+++ b/web/inc/secure_login.php
@@ -74,7 +74,7 @@ function prevent_post_csrf ($hard_check=false) {
$level = 1;
if ($hard_check == true) $level = 2;
if ($_SERVER['HTTP_ORIGIN'] != $expected_http_origin) {
- die ("CSRF detected (".$level.").
Your browser sent HTTP_ORIGIN with value: ".$_SERVER['HTTP_ORIGIN']."
myVesta expected HTTP_ORIGIN with value: ".$expected_http_origin."
Probably some browser extension is blocking it... disable all browser extensions and try again (or try to login with other browser).
If you are system administrator of this server, you can disable CSRF check by doing (as root, in SSH): mkdir /usr/local/vesta/conf_web && touch /usr/local/vesta/conf_web/dont_check_csrf
(but we don't recommend it)
If you are not system administrator of this server and you can't access the hosting panel even you disabled all browser extensions, please copy-paste this message to the system administrator of this server.
Once again, before you disable CSRF check, try to disable all browser extensions or try to login with other browser.");
+ die ("CSRF detected (".$level.").
Your browser sent HTTP_ORIGIN with value: ".$_SERVER['HTTP_ORIGIN']."
myVesta expected HTTP_ORIGIN with value: ".$expected_http_origin."
Probably some browser extension is blocking it... disable all browser extensions and try again (or try to login with other browser).
If you are system administrator of this server, you can disable CSRF check by doing (as root, in SSH): mkdir -p /usr/local/vesta/conf_web && touch /usr/local/vesta/conf_web/dont_check_csrf
(but we don't recommend it)
If you are not system administrator of this server and you can't access the hosting panel even you disabled all browser extensions, please copy-paste this message to the system administrator of this server.
Once again, before you disable CSRF check, try to disable all browser extensions or try to login with other browser.");
}
}
}
@@ -98,7 +98,7 @@ function prevent_get_csrf () {
$expected_http_referer = "https://".$hostname.":".$port;
$expected_http_referer_length = strlen($expected_http_referer);
if (substr($_SERVER['HTTP_REFERER'], 0, $expected_http_referer_length) != $expected_http_referer) {
- die ("You clicked on someone's link from other site.
This is just a protection layer to prevent potentially dangerous clicks, so if it was your link - you can proceed safely to your hosting panel.
Technical details:
Your browser sent HTTP_REFERER with value: ".$_SERVER['HTTP_REFERER']."
myVesta expected HTTP_REFERER to begin with value: ".$expected_http_referer."
If you got this error during casual work in your hosting panel, probably some browser extension is blocking HTTP_REFERER... disable all browser extensions and try again (or try to login with other browser).
If you are system administrator of this server, you can disable CSRF check by doing (as root, in SSH): mkdir /usr/local/vesta/conf_web && touch /usr/local/vesta/conf_web/dont_check_csrf
(but we don't recommend it)
If you are not system administrator of this server and you can't access the hosting panel even you clicked \"proceed safely to your hosting panel\" and disabled all browser extensions or changed the browser, please copy-paste this message to the system administrator of this server.
Once again, before you disable CSRF check, try to click \"proceed safely to your hosting panel\", and if that does not help then try to disable all browser extensions or try to login with other browser.");
+ die ("You clicked on someone's link from other site.
This is just a protection layer to prevent potentially dangerous clicks, so if it was your link - you can proceed safely to your hosting panel.
Technical details:
Your browser sent HTTP_REFERER with value: ".$_SERVER['HTTP_REFERER']."
myVesta expected HTTP_REFERER to begin with value: ".$expected_http_referer."
If you got this error during casual work in your hosting panel, probably some browser extension is blocking HTTP_REFERER... disable all browser extensions and try again (or try to login with other browser).
If you are system administrator of this server, you can disable CSRF check by doing (as root, in SSH): mkdir -p /usr/local/vesta/conf_web && touch /usr/local/vesta/conf_web/dont_check_csrf
(but we don't recommend it)
If you are not system administrator of this server and you can't access the hosting panel even you clicked \"proceed safely to your hosting panel\" and disabled all browser extensions or changed the browser, please copy-paste this message to the system administrator of this server.
Once again, before you disable CSRF check, try to click \"proceed safely to your hosting panel\", and if that does not help then try to disable all browser extensions or try to login with other browser.");
}
}