Re: Invalid Referer

Hello Nerijus:

In message <[email protected]>,
Nerijus Baliunas via Roundup-users writes:

>On Tue, 14 Aug 2018 20:21:04 -0400 "John P. Rouillard"
><[email protected]> wrote:
>
>> >I upgraded 1.5.1 to 1.6.0, and now when I try to login I get:
>> >Invalid Referer https://host.name/roundup/support/, /roundup/support/
>> 
>> Check the [tracker] section of config.ini. What is the value of your
>> "web" variable? I am guessing it is set to a relative path like:
>> 
>>   /roundup/support/
>> 
>> If so set it to:
>> 
>>   https://host.name/roundup/support/
>> 
>> The referer check expects an absolute URL. I thought web was required
>> to be an absolute URL even in 1.5.1 since it is used in emails.
>
>Yes, I had /roundup/support/ (in 1.5.1), changing it to full URL helped.
>Why I had it so -
> https://sourceforge.net/p/roundup/mailman/roundup-users/?viewmonth=201512

Ok, that patch is not in roundup 1.6.0. So that explains it.  It also
confirms my expectation that that URL is supposed to be absolute.

These days http is discouraged especially if there is
login/authentication involved.

What is your use case for supporting both http and https?

>> >http://www.roundup-tracker.org/docs/upgrading.html#cross-site-request-forgery-detection-added
>> >says "If you have forms using the POST method that are not using the
>> >standard submit routine, you should add the following field to all forms".
>> >How do I know if my methods are using standard submit routine?
>> 
>> Check your template. You should see something like this:
>> 
>>   <span tal:replace="structure context/submit">submit button</span>
>> 
>> If your form has an html tag with an attribute:
>> 
>>    tal:replace="structure context/submit"
>> 
>> you are using the standard submit routine that adds the appropriate
>> csrf tokens.
>> 
>> You can also check the forms in your tracker using your browser.  Load
>> a page and look at the source for the page (or use the developer tools
>> to inspect the submit button). Look for the submit button. It usually
>> looks like:
>> 
>>   <input type="submit" ...
>> 
>> If you see a hidden input named @csrf before the submit button that
>> looks similar to:
>> 
>>    <input type="hidden" name="@csrf"
>>       value="56b4cddbf477babd0339579d202b67cc4b0c3ff72150e92e20a11f4a3d43a9ee">
>> 
>> then you are all set. (Note there may be an input called @action
>> between the @csrf and the submit button.)
>
>There were no input named @csrf in the page source. But I got it now -
>when you speak about "If you have forms using the POST method that
>are not using the standard submit routine", you mean that templates
>were updated to the new version.

Correct. The distributed templates (classic, devel, minimal etc.) were
updated, so you can copy those files in if you haven't customized
them.

In some cases where I do not expect the tracker admin to have changed
the template, I do suggest copying it in from the default
template. For example:

http://www.roundup-tracker.org/docs/upgrading.html#html-generic-404-html-in-trackers-use-page-template


... If your deployed tracker is based on: classic, minimal, responsive
    or devel templates and has not changed the html/_generic.404.html
    file, you can copy in the new file to get this additional
    functionality.

Templates that were customized or new templates built for the roundup
tracker need to be manually updated. My assumption is that people were
probably not running the distributed templates.

>Mine were not. When I updated them
>to 1.6.0 versions (I use classic template), I got @csrf in the page source.
>
>It's probably worth mentioning in upgrading docs that templates should
>preferably be updated too.

If you were using the default templates without any changes, you can
copy in the new default templates from the distribution.

I didn't expect many people would run with the default tracker
templates.

The upgrading directions provide the instructions on how to upgrade
the existing tracker templates so they have the same features/changes
as the 1.6.0 distributed templates.

Some template changes are required (e.g. Login from a search or after
logout works better), while some are optional (e.g. Option to make
adding multiple keywords more convenient). So the tracker admins can
pick and choose which optional template changes they want to use.

Have a great week and I am glad you got it working.    

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot