EPrints Technical Mailing List Archive

Message: #08270

< Previous (by date) | Next (by date) > | < Previous (in thread) | Next (in thread) > | Messages - Most Recent First | Threads - Most Recent First

Re: [EP-tech] Ask about CSRF. Always get error when edit phrases Editor

Hi Agung PW,

Although the filename as it appears in the HTML source is auto-3.4.0.js, the actual file that is loaded is EPRINTS_PATH/archives/ARCHIVE_NAME/html/en/_javascript_/auto.js and this is the file you need to delete.  EPrints does some clever URL rewriting to load auto.js rather than trying to load auto-3.4.0.js that won't exist.  The reason for this is so that if you upgrade EPrints the filename in the HTML source will change one with the new version number and ensure you do no use the cached _javascript_ from the old version.  auto.js is generated by concatenating all the files in lib/static/_javascript_/auto/ flavours/pub_lib/static/_javascript_/auto/ and archives/ARCHIVE_NAME/cfg/static/_javascript_/.  If any file appears in more the one directory the one included in auto.js comes from the later directory.  This is why I said that one issue might be that you updated the files in lib/static/_javascript_/auto/ but you might have versions of these files in archives/ARCHIVE_NAME/cfg/static/_javascript_/ and these would be used in the concatenated auto.js, so would still not fix your missing CSRF protection code issue.

Regards

David Newman

On 25/07/2020 13:36, Ajunk Pracetio wrote:
Hi David,
You said I can delete auto.js file and will get new version of auto-3.4.0.js that has the CSRF protection code. If I delete the file, how exactly I can get new auto-3.4.0.js that has the CSRF protection code?

Thank you

Regards,
Agung PW

On Thu, Jul 23, 2020 at 7:59 PM David R Newman via Eprints-tech <eprints-tech@ecs.soton.ac.uk> wrote:

Hi Agung Prasetyo Wibowo,

This could be one of two issues:

1. You have updated lib directory versions of the various _javascript_ files that are patched in the two GitHub links you included but there are other versions that take precedence so these changes will not propagate through to the version at MailScanner has detected a possible fraud attempt from "hostname" claiming to be http://HOSTNAME/_javascript_/auto-3.4.0.js.  Look for files with the same name in the equivalent pub_lib, site_lib or archives/ARCHIVE_NAME directories.

2. auto-3.4.0.js is still cached and you need to hard refresh the page to get these changes to come.  I have tried doing this as I know your repository hostname (i.e. Ctrl+Shift+R for a hard refresh) and this seems to make no difference and I cannot find the string 'csrf' anywhere in auto-3.4.0.js.  One other issue with caching might be that archives/ARCHIVE_NAME/html/en/_javascript_/auto.js and the files in archives/ARCHIVE_NAME/html/en/_javascript_/auto/ cannot be overwritten due to a file permission issues.  If you delete all these files, this may resolve the issue and give you the new version of auto-3.4.0.js that has the CSRF protection code.

Regards

David Newman

On 23/07/2020 09:13, Ajunk Pracetio via Eprints-tech wrote:
Hi,
I'd like to ask. My EPrints version is 3.4. I want to edit one of the field on phrases editor, but always get error

Cross-Site Request Forgery (CSRF) was detected whilst processing your last request and therefore its action was not authorised.

The screenshot like this :
image.png

Please help about this issue.

Thank you.

Best regards,
Agung Prasetyo Wibowo.

*** Options: http://mailman.ecs.soton.ac.uk/mailman/listinfo/eprints-tech
*** Archive: http://www.eprints.org/tech.php/
*** EPrints community wiki: http://wiki.eprints.org/

Virus-free. www.avg.com
*** Options: http://mailman.ecs.soton.ac.uk/mailman/listinfo/eprints-tech
*** Archive: http://www.eprints.org/tech.php/
*** EPrints community wiki: http://wiki.eprints.org/