Loading...
 
Architecture / Installation

Architecture / Installation

Forum List Topic List

Forums » Architecture / Installation » Error CSRF after installing 1.8
 
Thread actions
PDF Print this page
  • Print all pages

    • Error CSRF after installing 1.8

    Posted by joelg posts: 104 France

    I just installed 1.8 on my desktop (running Windows XP, MySQL 4.0.17, PHP 4.3.4, Apache 2).

    Not being in a mind to fiddle, I've installed everything as default as best as I can judge. Managed to get the tiki database installed (using myphpadmin). Did the Tiki install process, everything went fine.

    Get to the Tiki front page, login as admin/admin, get redirected to the "change password enforced" screen, change the password, and get an error message "Sea Surfing (CSRF) detected. Operation blocked" with a button to confirm the action. Pressing the button brings up the same message. And the password remains unchanged so I'm stuck until I resolve the problem.

    Ideas would be welcome, so I don't have to read the explanation of what CSRF is, understand that, then try to work out why my (very vanilla) installation is not working. What causes this message to appear??

    Thanks, Joel

    Reads: 1361
    Link
    Posted by joelg posts: 104 France

    Well, actually I've sorted it and it was not immediately obvious until you had done it!

    Stupid mistake on my part: the php.ini still had /tmp as the session temporary file setting. So Tiki couldn't store the session id file, so couldn't use session id to protect against CSRF. Et voilà!

    Hope my dumb mistake will be useful to others. redface

    JoelG

    Link