Admin Save Bug

[kdupon]

Description

As an admin, when I am adding new users to the system and assigning their permissions I am constantly getting an error saying "Unauthorized. This action may only be performed with an elevated session." which is causing me to not be able to set up users. I've noticed that if I log out, refresh, and go back into the system I can then add a user, but it won't let me add more than one at a time.

Steps to reproduce

1. Click Users > New User
2. Add their account information
3. Add their permission information
4. The system asks me to login to validate
5. Settings save
6. Click Users > New User
7. Add their account information
8. Add their permission information
9. The system asks me to login to validate
10. Get the error message

Additional info

• Craft version: Pro Trial Craft CMS 3.0.13.2
• PHP version: 7.2.4
• Database driver & version: MySQL 5.6.34
• Plugins & versions:
  Amazon S3 | 1.0.8
  CP Field Inspect | 1.0.4
  CraftQL | dev-master
  Postmark | 1.0.0-rc.1.2
  Redactor | 2.1.0
  Sprout Fields | 3.1.3

[brandonkelly]

Assigning new groups/permissions to a user requires an “elevated session”, which is what you get when that “Enter your password” modal comes up. Elevated sessions only last 5 minutes, so if it’s been more t han 5 minutes, you should be getting another “Enter your password” modal. Is that happening for you? If not, check your browser’s JavaScript console. Are you getting any JS errors before submitting the form that results in the error?

[kdupon]

Yes, so I fill out all the user information and permissions, then click save. The system asks me for my password, I fill that out and then I am immediately thrown to an HTTP 403 – Forbidden screen which says "This action may only be performed with an elevated session".

I am not getting any JS errors before sending the form, just the errors once I enter my password and click submit.

[kdupon]

Also, I've had other admins of our environment try the same task and they are receiving the same error. So it doesn't look like any of us can really update a user's permissions.

[brandonkelly]

Is the site running in a load-balanced environment?

[kdupon]

That was it, Thanks! The App is hosted by Fortrabbit and we forgot to install the fortrabbit/yii-memcached when switching over to the Professional Stack.

[brandonkelly]

Ah great, glad you got it sorted! We’re working on a new support article with tips for running Craft in a load-balanced environment, so hopefully that will help other people in the future.

[mikefrancis]

For anyone arriving here from Google and using AWS EC2:

• ELB: https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-sticky-sessions.html
• ALB: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-target-groups.html#sticky-sessions

[thisisjamessmith]

I had this issue in a non load-balanced environment in Craft 3.1.24. Clearing the Craft cookie solved it for me.

[realflash]

I had this issue in a non load-balanced environment in Craft 2.7.8. Clearing the Craft cookie solved it for me