Closed umlaeute closed 9 years ago
Which beta version? There have been many fixes related to auto csrf checking false positives lately.
It is triggered because something is doing a write on read that is not accounted for.
@thet should know
It's Plone 5 b4
Aha, write on read ... I have to re-check, maybe this is caused by an addon.
I can't reproduce this. There have been some recent CSRF auto protect fixes to plone.subrequest.
I'm going to close for now. Please re-open if this is still a problem on master.
Confirmed. With new Plone 5, I cannot reproduce this issue either.
Hi, I had the same issue today using Plone-5.0-UnifiedInstaller-r1.tgz. I've created some Plone site instance to investigate, ever using advance wizard. I think this issue happen only when I select plone.app.multilingual for immediate activation on plone creation.
Hi, I had the same issue today using Plone-5.0-UnifiedInstaller-r1.tgz. I've created some Plone site instance to investigate, ever using advance wizard. I think this issue happen only when I select plone.app.multilingual for immediate activation on plone creation.
I know this thread is a few years old but I have just confirmed that my current installation and configuration still had the CSRF false positives. I'm using Plone 5.1.1, installed via Plone UnifiedInstaller, and have the following Addons installed:
-collective.easyform 2.0.0b7 -collective.themefragments 2.11.1 -collective.lineage 2.1.1 -plone.app.jquery 1.11.2 -collective.z3cform.datagridfield 1.2 -plone.session 2.7.0 -plone.app.mosaic 2.1.1 -collective.multitheme 1.0 -webcouturier.dropdownmenu 3.0.3 dev0 -medialog.iconpicker 0.6.4 -medialog.controlpanel 1.1.3 -plone.app.multilingual 5.1.4
Once I disabled plone.app.multilingual, I didn't receive another false positive CSRF protection page. Don't know why it was happening, but I didn't really NEED that addon anyways so I'm glad this is what fixed it. Hope my specific example helps someone else.
Running Plone-5.0beta, I get the following error whenever I click a link for the first time (
listing_view
is the default view ofbar
):When I click on
Confirm action
or go back and click the same link again, I can access the content (even in future sessions). I understand that this is some XSS-protection, but why is it triggered? Esp. when the access is totally legit?