search

sproctor / php-calendar

PHP-Calendar
http://www.php-calendar.org/
Apache License 2.0
140 stars 67 forks source link

Forgery Error #65

Closed fitty75 closed 10 years ago

fitty75 commented 10 years ago

Hi, when trying any action on the installed calendar on my web host's server, I get the following errors (this is from creating an event):

Error
Secret token mismatch. Possible request forgery attempt.

Backtrace

#0 /hermes/bosoraweb177/b1740/ipg.springbranchitcouk/garnier3/php-calendar/includes/calendar.php(723): soft_error('Secret token mi...')
#1 /hermes/bosoraweb177/b1740/ipg.springbranchitcouk/garnier3/php-calendar/includes/event_form.php(305): verify_token()
#2 /hermes/bosoraweb177/b1740/ipg.springbranchitcouk/garnier3/php-calendar/includes/event_form.php(31): process_form()
#3 /hermes/bosoraweb177/b1740/ipg.springbranchitcouk/garnier3/php-calendar/includes/calendar.php(679) : eval()'d code(1): event_form()
#4 /hermes/bosoraweb177/b1740/ipg.springbranchitcouk/garnier3/php-calendar/includes/calendar.php(679): eval()
#5 /hermes/bosoraweb177/b1740/ipg.springbranchitcouk/garnier3/php-calendar/includes/calendar.php(625): do_action()
#6 /hermes/bosoraweb177/b1740/ipg.springbranchitcouk/garnier3/php-calendar/index.php(77): display_phpc()
#7 {main}
sproctor commented 10 years ago

Can you give some information about your host?

The reason this exists is: your session has a secret token. When you submit a form, that token is generated in the form and submitted with it. This is to stop someone from using a XSS attack on a 3rd party site to get you to submit an event (or any other form) using your own credentials, since they would need to know your secret token to create the form.

Somehow your tokens are not matching up. I'll add a bit of a debugging in there to display the two of them and see if we can figure out what is going on.

sproctor commented 10 years ago

At some point I made this worthless. The next version of PHP-Calendar will have slightly rewritten forgery detection. In the meantime, you can just delete the contents of the function verify_token and it should work. Closing this issue for now. New version should be out within a week.