Security error on Save or Apply

[dvdbrln]

So I tried this branch and I confirm it installs well.

Upload works fine also, but I encounter the following error when I click Save or Apply on a node with or without attachment.

Security Error

The requested address was not found on this server.
Request blackholed due to "auth" violation.

More precisely, if I create a node, there is no Attachments tab, then I click save, and it works.
Then I edit the node, I can see the attachments tab, but if I click on Apply or Save, I get the error along with a 400 Bad Request answer from the server.
I also get this error when clickin the Delete icon.

Disabling the plugin makes the problem vanish...

Now I don't really know where I should begin to debug... I added the filename column (varchar(255) not null) and it gets filled up. The path column seems to be unused so far I've seen.... Am I missing something ?

Hope it helps ;-}
DvD

[elcuro]

v 1.5 has incompatible table structure with previous version. I added migrations, so try fetch from github or download updated plugin

[dvdbrln]

Hi, I just tried the last commit from the 1.5 banch. It doesn't solve the issue.
By the way, in the schema, the encoding is utf8_slovak_ci , I changed it to utf8_unicode_ci to suit my database settings (croogo defaults).

Maybe should I precise I'm using Croogo 1.5.6 upon Cakephp 2.4.4 ... Is it okay or should i upgrade something ?

Again, on node-creation, no attachment-tab, Apply and Save work.
But as soon as the attachments-tab is displayed, Apply and Save both throw the same security error along with a 400 Bad Request Header...
Deleting a node always works.

I'll try on a fresh install of Croogo to see if it could have something to do with my install...

Have a nice evening.
David

[dvdbrln]

Ok, I just tried on a fresh croogo-v1.5.6 with nothing else as image2-master and nodeattachment-branch-1.5. I confirm the auth violataion error on appy/save .
I'll now try on a fresh 1.5.7, just to be sure...

[dvdbrln]

Confirmed on v1.5.7 too, to reproduce

• fresh install,
• upload image2-master.zip,
• activate,
• upload nodeattachment-br1.5
• activate
• go to content list
• edit about page
• click save => Security Error : The requested address was not found on this server. Request blackholed due to "auth" violation.

I'd really like to know if you can reproduce this strange thing or if I'm the only one concerned...

I'm using nginx with php5-fpm, but I don't think it is related since disabling the plugin just solves the issue, and the post url is the same in both cases...

Best regards,
DvD

[elcuro]

I repeat your steps one by one and everything ok (on windows).
Upload works fine?

2014-04-03 17:36 GMT+02:00 dvdbrln notifications@github.com:

Confirmed on v1.5.7 too, to reproduce

• fresh install,
• upload image2-master.zip,
• activate,
• upload nodeattachment-br1.5
• activate
• go to content list
• edit about page
• click save => Security Error : The requested address was not found
  on this server. Request blackholed due to "auth" violation.

I'd really like to know if you can reproduce this strange thing or if I'm
the only one concerned...

I'm using nginx with php5-fpm, but I don't think it is related since
disabling the plugin just solves the issue, and the post url is the same in
both cases...

Best regards,
DvD

Reply to this email directly or view it on GitHubhttps://github.com//issues/5#issuecomment-39466317
.

[dvdbrln]

Yes, upload is working fine.

Actually, and what I don't understand, the plugin itself is working fine, but when the model gets loaded (when the attachment-tab is displayed), something gets wrong when saving nodes/pages/blog... So it's kind of messing up with something in Croogo or Cake, that lets the security component believe there's something wrong with the request.

Well on windows I'm not really surprised that you don't get the error (security and windows were never best friends ;-). An interesting test would be on apache/linux since I'm testing on nginx/linux, and very few webservers on the internet are running windows ;-}

I'll give it a try, but could the following link be useful in any way to understand what's going on ?
http://stackoverflow.com/questions/19912575/security-component-and-postlinks
and this on is interesting too:
http://www.devarticles.in/cakephp/security-component-black-hole-form-submit-dies-on-a-blank-page-with-no-error/

Cheers,
DvD

[dvdbrln]

I confirm the issue on Apache2/linux too.

I don't have windows, so I can't try. Maybe the security component doesn't work the same way in windows, because of different environment.

Let me know if you have no issue on a Linux server (if you or someone you know can test that of course), that would mean I'm doing something wrong or missing something...

It looks like it's time to XDebug Croogo, I'll get my hands dirty ;-}

[dvdbrln]

So my hands are dirty now, but I isolated at least where the error is thrown :
in lib/Cake/Controller/Components/SecurityComponent.php, lines 237-240 (Croogo-v1.5.7)

if (!in_array($this->_action, (array)$this->unlockedActions) && $isPost && $isNotRequestAction) {
            if ($this->validatePost && $this->_validatePost($controller) === false) {
                return $this->blackHole($controller, 'auth');
            }

That's where the app goes through when I click Apply or Save, the condition in the second if is true with Nodeattachments enabled, so it returns $this->blackHole, and false when disabled, so the request completes.

I still don't know why, but you might understand it better than I do since I'm really new to Cake/Croogo. At least I'm learning faster thanks to this issue ;-}

Have a nice evening/weekend,

DvD

[dvdbrln]

Digging further, it appears that the reason of this is in the _validatePost() function of SecurityComponent.php :

• when NodeAttachments is disabled, the line 513

    $check = Security::hash(serialize($fieldList) . $unlocked . Configure::read('Security.salt'), 'sha1');

returns the same value that is stored in $token.

• however, when NodeAttachments is enabled, $check has another value, leading to a security error.

Now I'm really curious about why this doesn't happen on a windows machine...

[rchavik]

I'm not sure why you're getting the SecurityError in linux. Maybe you're hitting this croogo/croogo#460 (comment). Nothing at all in tmp/logs/error.log?

I do however have some issues with the admin menu and an element. Here's a patch I tried:

diff --git a/Config/bootstrap.php b/Config/bootstrap.php
index 9b72130..dda6684 100644
--- a/Config/bootstrap.php
+++ b/Config/bootstrap.php
@@ -21,7 +21,7 @@
             'children' => array(
                 'settings' => array(
                     'title' => __('Configure'),
-                    'url' => array('plugin' => '', 'controller' => 'settings', 'action' => 'prefix', 'Nodeattachment')
+                    'url' => array('plugin' => 'node_attachment', 'controller' => 'settings', 'action' => 'prefix', 'Nodeattachment')
                 )
             )
         ));
diff --git a/Controller/NodeattachmentController.php b/Controller/NodeattachmentController.php
index 87b6a78..fca601a 100644
--- a/Controller/NodeattachmentController.php
+++ b/Controller/NodeattachmentController.php
@@ -23,7 +23,7 @@ class NodeattachmentController extends NodeattachmentAppController {
            'Js' => array('Jquery'),
            'Text',
            'Image',
-           'Filemanager',   
+           'FileManager.FileManager',
        );

        /**
diff --git a/View/Nodeattachment/admin_index.ctp b/View/Nodeattachment/admin_index.ctp
index a5e597b..4a970b9 100644
--- a/View/Nodeattachment/admin_index.ctp
+++ b/View/Nodeattachment/admin_index.ctp
@@ -71,7 +71,7 @@
             if ($mimeType == 'image') {
                 $thumbnail = $html->link($image->resize('/uploads/' . $attachment['Node']['slug'], 100, 200), array('controller' => 'nodeattachment', 'action' => 'edit', $attachment['Node']['id']), array('escape' => false));
             } else {
-                $thumbnail = $html->image('/img/icons/page_white.png') . ' ' . $attachment['Node']['mime_type'] . ' (' . $filemanager->filename2ext($attachment['Node']['slug']) . ')';
+                $thumbnail = $html->image('/img/icons/page_white.png') . ' ' . $attachment['Node']['mime_type'] . ' (' . $this->FileManager->filename2ext($attachment['Node']['slug']) . ')';
             }

             $rows[] = array(

[dvdbrln]

Thanks for the quick answer.

I have nothing in the logs, neither croogo logs, php logs or webserver logs. I checked the SQL logs but as I expected it has nothing to do with SQL, the only request before the error being which role the current user has (Role.Id , here =1).

Your patch seems to fit the master branch, which didn't installed well on a fresh Croogo1.5.5/7 install. As i reported this in a first place on the master-branch, the answer was there's a 1.5.x-branch, which provokes the current issue, but only on unix server so far we know : elcuro couldn't repoduce the error on windows.

This looks tricky, and is ony about the Security-component, I was wondering if anybody could reproduce this error.

Here is the configs I tried :
in both cases, php 5.4.26 / mysql 14.4 distrib 5.5.33

1. nginx 1.4.4
2. apache 2.2.22

Cheers,
DvD