Bug SEO + Two factor - Infinite login loop

[madmaxmangos]

When trying to access the SEO Control panel with Two factor enabled on my account I always get redirected to the misc.php and told im connecting from a new IP.

Even after putting in the auth code it just enter a loop and keeps asking for the code over and over.

My work around for this was to install mod_cloudflare into Apache, a lot of users wont be able to do that if they are using cloudflare and don't have root access to their own physical server.

My conclusion: It seems even with the vbulletin mods installed to detect the real IP - that the SEO mod is still seeing the cloudflare IPs and forwarding you to the misc.php two factor auth page.

 

[Fillip H.]

This is not a bug in our software, as it's up to each individual server to communicate with CloudFlare to ensure the correct IP is passed along to vBulletin. For security purposes, we need to use the "IPADDRESS" variable vBulletin provides. The reason for this is that the variable in question is "immutable", i.e. it can't be changed by modifications after it's created.

In the end, this means less chance of malicious code being able to bypass the security of your server.