sillsdev / webonary

Source code for Webonary and related applications that support it
https://www.webonary.org
MIT License
5 stars 3 forks source link

Valid WordPress passwords should not cause the upload to fail. #514

Closed vernastutzman closed 1 year ago

vernastutzman commented 1 year ago

Tom Willet reset his password: "I reset the password and got into my dashboard without a hitch, but when I try to upload from FLEx, it still gives a login error. I'm currently using FW 9.1.18.682." Later he discovered that "that the apostrophe in my password was the problem. I reset it again and FLEx connected fine."

johntseng commented 1 year ago

I used Fiddler to inspect traffic from FieldWorks to Webonary. It shows that the password was sent over correctly using basic auth (with just base64 encoding and nothing else), but the response was a 403.

johntseng commented 1 year ago

@phillip-hopper I changed my password to the following, and the wp-json API worked as long as it doesn't have the trailing single quote. I was able to log in with the trailing single quote. I think validatePermissionToPost is where it's going, but I don't understand why it's failing. Can you take a look at the wordpress side to see what's going on?

john@john:~$ curl --location --request POST 'https://www.webonary.work/test-peacock1/wp-json/webonary-cloud/v1/validate' \
> -u "johntseng:TvrX&pSJGKcMoVVClb%7hPrJ" \
> --header 'Content-Type: application/json' \
> --data-raw '{}'
"test-peacock1,test-peacock2"
john@john:~$ curl --location --request POST 'https://www.webonary.work/test-peacock1/wp-json/webonary-cloud/v1/validate' \
> -u "johntseng:TvrX&pSJGKcMoVVClb%7hPrJ'" \
> --header 'Content-Type: application/json' \
> --data-raw '{}'
"Invalid username or password"
john@john:~$ curl --location --request POST 'https://www.webonary.work/test-peacock1/wp-json/webonary-cloud/v1/validate' \
> -u "johntseng:TvrX&pSJGKcMoVVClb%7hP" \
> --header 'Content-Type: application/json' \
> --data-raw '{}'
"test-peacock1,test-peacock2"