Re: Invalid Referer

On Tue, 14 Aug 2018 20:21:04 -0400 "John P. Rouillard" <[email protected]> wrote:

> >I upgraded 1.5.1 to 1.6.0, and now when I try to login I get:
> >Invalid Referer https://host.name/roundup/support/, /roundup/support/
> 
> Check the [tracker] section of config.ini. What is the value of your
> "web" variable? I am guessing it is set to a relative path like:
> 
>   /roundup/support/
> 
> If so set it to:
> 
>   https://host.name/roundup/support/
> 
> The referer check expects an absolute URL. I thought web was required
> to be an absolute URL even in 1.5.1 since it is used in emails.

Yes, I had /roundup/support/ (in 1.5.1), changing it to full URL helped.
Why I had it so - https://sourceforge.net/p/roundup/mailman/roundup-users/?viewmonth=201512

> >http://www.roundup-tracker.org/docs/upgrading.html#cross-site-request-forgery-detection-added
> >says "If you have forms using the POST method that are not using the
> >standard submit routine, you should add the following field to all forms".
> >How do I know if my methods are using standard submit routine?
> 
> Check your template. You should see something like this:
> 
>   <span tal:replace="structure context/submit">submit button</span>
> 
> If your form has an html tag with an attribute:
> 
>    tal:replace="structure context/submit"
> 
> you are using the standard submit routine that adds the appropriate
> csrf tokens.
> 
> You can also check the forms in your tracker using your browser.  Load
> a page and look at the source for the page (or use the developer tools
> to inspect the submit button). Look for the submit button. It usually
> looks like:
> 
>   <input type="submit" ...
> 
> If you see a hidden input named @csrf before the submit button that
> looks similar to:
> 
>    <input type="hidden" name="@csrf"
>       value="56b4cddbf477babd0339579d202b67cc4b0c3ff72150e92e20a11f4a3d43a9ee">
> 
> then you are all set. (Note there may be an input called @action
> between the @csrf and the submit button.)

There were no input named @csrf in the page source. But I got it now -
when you speak about "If you have forms using the POST method that
are not using the standard submit routine", you mean that templates
were updated to the new version. Mine were not. When I updated them
to 1.6.0 versions (I use classic template), I got @csrf in the page source.
It's probably worth mentioning in upgrading docs that templates should
preferably be updated too.

Thank you very much for the help!

Regards,
Nerijus

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot