search

cloudflare / Cloudflare-WordPress

A Cloudflare plugin for WordPress
https://www.cloudflare.com/wordpress/
BSD 3-Clause "New" or "Revised" License
215 stars 83 forks source link

Cannot apply any settings Csrf token fail #101

Closed Betawolf1213 closed 7 years ago

Betawolf1213 commented 8 years ago

I read on your other post about the IWP but I don't have that installed, yet I'm still dealing with this issues I understand it could be a number of under plugins but I'm not really sure which is could be.

Help

thellimist commented 8 years ago

@Betawolf1213 Do you have any other plugins installed? If so you should try to turn them on and off one by one to figure out which of those is causing the issue.

Betawolf1213 commented 8 years ago

Alright so I disabled everything on the site and still having the same issue.

jwineman commented 8 years ago

So the root cause is that we read the JSON body from the request with 

file_get_contents('php://input');

The problem is versions of PHP lower than 5.6 (I think) php://input can only be read once. Something is reading the JSON request body before our plugin executes, which causes php://input to be null when we do the CSRF check.

Is there anything custom about your setup that reads JSON from a request?

Betawolf1213 commented 8 years ago

^^ Yea I know of this problem I didn't say anything to avoid sounding like I know when I clearly don't know how to fix the problem. Also to the best of my knowledge no. I checked and the only times the token is being called for is when Cloudflare asks for it but nothing is stopping it from going through it just request it and then nothing happens. I know you guys can't legally login to my site either... But this is kinda a drag. oh also idk if you'd know but has it taken longer than 24 hours to get your ssl cert?

jwineman commented 8 years ago

Can you tell us the other plugins you're currently running?
Where are you hosting your WordPress blog? Is there anything else "non standard" about your blog set up?

Betawolf1213 commented 8 years ago

Hosting on Domain.com

plugins

Accesspress twitter autopost Akismet BBpress Buddypress Cloudflare Essential grid Jet pack Mailchimp forms by mailmunch MO core Slider rev W3 total cache Wordfence security WPsmush WP theme optimizer visual composer Yoast SEO

thellimist commented 8 years ago

@Betawolf1213 I tried installed (almost) all of your plugins, Cloudflare plugin seems to work. What is your PHP version?

Betawolf1213 commented 8 years ago

5.5.22

Betawolf1213 commented 8 years ago

I can't update to 5.6 cause it breaks my site.

Betawolf1213 commented 8 years ago

I recently through my Myphpadmin disabled everything and only enabled Cloudflare and still had the same issue.

thellimist commented 8 years ago

Is there anything else "non standard" about your blog set up?

Betawolf1213 commented 8 years ago

Not to my knowledge.

jwineman commented 8 years ago

Maybe an obvious question but have you searched all the code on your wordpress blog (core + themes, plugins, etc) for php://input?