Loading...
 
Skip to main content

Features / Usability

Forum List Topic List

 
Thread actions
Print this page
  • Print all pages

    • CSRF and variable may not be empty: $_POST["user"] in File Gallery

    Posted by smartd

    Trying to upload a file in a new upgrade of 12.2, and I'm getting first a CSRF blocked message. When I allow, I get the error Error
    Notice: this variable may not be empty: $_POST%22user%22
    and stopped. How do I fix this?

    Dan
    Reads: 1832
    Posted by Torsten Fabricius

    Hi Dan,

    my first thought: no idea.

    Second and subsequent thoughts (questions):

    • From which version you did upgrade to Tiki 12.2 and how?
    • Are you running via SVN (kind of a rolling release via Linux shell - if SSH access to the server) or are you downloading and installing a package (via FTP or SFTP).

    • In case you did with FTP => did you review all file permissions? This is to be handled differently from one to another server.

    • Did you do the upgrade directly on the running system?
    • Do you have a database backup (made a dump before the upgrade)?

    • Are your files stored in the database (not recommended) or in the filesystem and if in the filesystem, then outside the Tiki root (recommended)?

    • For FTP I suggest to create a new directory with the new version package - then take a dump of the database and apply a new (copied / imported from dump)) databse to the new instance. Then either relocate the path of the old to the new tikiroot (and keeping a running backup) or test with a temporary subdomain.

    • With FTP if you store outside the database you should copy the files directory "besides" the new installation or use the same files - BUT MIND, that the databases of old and new installation will not stay in sync, in case you test upload in one or the other instance after the dump - so at least for testing better work with a copy of the files directory.

    • Then you need to check, if user and permissions are still the same in the copied file directory.


    All seems not SO much related to CSRF, but anyway these are the first preparations for a proper upgrade anyway.

    Are you using anything like https or so?

    Hmmm "CSRF blocked message" and " variable may not be empty: $_POST%22user%22 " how that goes together?

    Could you reproduce the issue on show.tiki.org so far? This would be an important point wether we have a bug or a configuration and a huge torch fo find the bug, if it would be reproducable ... on show.tiki.org the developers can take a snapshot of the database to try to reproduce and solve at their local desk.

    Sorry, if I could not help you so much at this point. Anyway looking forward to your reply,
    Torsten



    Posted by smartd

    11.0 --> 12.2 in clean directory.

    No https (though I need to get this going)

    Rick sent me down a goog path.  The  "Protect against CSRF with a ticket" didn't fix the issue, however disabling "Require confirmation if possible CSRF detected " did get me going again.  Is it safe to leave this way?