[Nola1974]

This is apparently caused by servers running the Suhosin PHP hardening patch… it encrypts cookies. I was having a simlar problem about a year ago on another site:

Can’t post. Topic turns yellow. Can’t delete.

I found this plugin for WP that fixes it (in WP).. it’s apparently a bug in WP’s AJAX handling. Perhaps something similar is going on inside BBpress’ AJAX functionality?

http://sparepencil.com/code/ajax-referer-fix/

in pluggable.php (current)

if ( !function_exists('bb_check_ajax_referer') ) :

function bb_check_ajax_referer() {

if ( !$current_name = bb_get_current_user_info( 'name' ) )

die('-1');



$cookie = explode('; ', urldecode(empty($_POST['cookie']) ? $_GET['cookie'] : $_POST['cookie'])); // AJAX scripts must pass cookie=document.cookie

foreach ( $cookie as $tasty ) {

if ( false !== strpos($tasty, bb_get_option( 'usercookie' )) )

$user = substr(strstr($tasty, '='), 1);

if ( false !== strpos($tasty, bb_get_option( 'passcookie' )) )

$pass = substr(strstr($tasty, '='), 1);

}



if ( $current_name != $user || !bb_check_login( $user, $pass, true ) )

die('-1');

do_action('bb_check_ajax_referer');

}

endif;

From above mention (wordpress) plugin:

if (!function_exists('check_ajax_referer')) :

function check_ajax_referer() {

// Explode cookie data like WordPress normally does

$cookie = explode('; ', urldecode(empty($_POST['cookie']) ? $_GET['cookie'] : $_POST['cookie'])); // AJAX scripts must pass cookie=document.cookie

foreach ( $cookie as $tasty ) {

if ( false !== strpos($tasty, USER_COOKIE) )

$user = substr(strstr($tasty, '='), 1);

if ( false !== strpos($tasty, PASS_COOKIE) )

$pass = substr(strstr($tasty, '='), 1);

}



// This variable is set when cookie data was sent in an encrypted fashion

// For more information:

// * http://forum.hardened-php.net/viewtopic.php?pid=616

// * http://www.hardened-php.net/suhosin/

if(isset($_SERVER['RAW_HTTP_COOKIE']))

{

// Explode the raw (HTTP) cookie data using the WP method

$crypt_cookie = explode('; ', $_SERVER['RAW_HTTP_COOKIE']);

foreach ( $crypt_cookie as $tasty ) {

if ( false !== strpos($tasty, USER_COOKIE) )

$crypt_user = substr(strstr($tasty, '='), 1);

if ( false !== strpos($tasty, PASS_COOKIE) )

$crypt_pass = substr(strstr($tasty, '='), 1);

}

// Set $user and $pass to the decrypted values if the cookies match

if($crypt_user == $user && $crypt_pass == $pass)

{

$user = $_COOKIE[USER_COOKIE];

$pass = $_COOKIE[PASS_COOKIE];

}

}



if ( !wp_login( $user, $pass, true ) )

die('-1');

do_action('check_ajax_referer');

}

endif;