Problems with latest version 2.3.10

[Taffman]

Since upgrading to version 2.3.10 today I can no longer edit any pages, when I try I get this error:

{"msg":"Unauthorized access!","error":true}
Also can post new messages to chatbox 2 I get unauthorised access error.

Is this a bug or some issue with my install?

[Kanonimpresor]

Hi @Taffman,

That's correct! The installation finishes, but it doesn't allow access to the frontend. You can only access it through http://localhost/e107_2.3.10/e107_admin/admin.php

Then, through Admin, you have access to the frontend.

Friend @e107help You have a job!

[Deltik]

Thanks for the reports, @Taffman and @Kanonimpresor. I'm investigating the cause right away.

Automated testing did not catch this, and neither did my own live testing on real e107 websites.

[Deltik]

Update on the situation: It's complicated, and @e107help is working through the identified deficiencies.

• Fix the v2.3.10 write lockout, and let the operator choose which proof a request must bring #5859 will land in the upcoming e107 v2.3.11, which I want to get out to y'all as soon as possible.
• Port the CSRF lockout fix to master, with the browser check as the default #5860 will be the equivalent fixes on the master branch.

I did look into fetch metadata request headers, but this doesn't help on "untrusted" (HTTP or invalid HTTPS) websites, which surely exist, so I can't use them as a panacea.

And while fixing CSRF-related bugs in e107 v2.3.10, more bugs are being uncovered.

I will need more time to develop a better solution. Sorry for the wait!

[Kanonimpresor]

Excuse me? That's only asked as an excuse when nothing has been done!

Great job @Deltik, you're a phenomenon! 😄

PS: They that sow in tears Shall reap in joy. Psalm 126:5

[Taffman]

@Deltik no problem, I've rolled back to v2.3.9 and everything is fine.

[Deltik]

@Taffman, @Kanonimpresor, and @kvnorde: The known form submission bugs should have been fixed in e107 v2.3.11.

This release fixes critical security vulnerabilities that enable guests to take over e107 sites, so you must upgrade immediately.

If you continue to have problems with form submissions, please do not downgrade, let me know how to reproduce the problem, and work with me to solve your use case.

---

If you go to /e107_admin/prefs.php#nav-core-prefs-security (Admin Area » Site Preferences » Security & Protection), there is a new "Proof that a request came from this site" setting.

The current preset is the one intended to have the best compatibility: "Security token or browser check". If you're having issues with themes, "Browser check" might work better for you. If "Browser check" causes issues and you have HTTPS with a modern browser, I want to know about it, because I'd like it to be the default for the future e107 v2.4.

[kvnorde]

Same problem here, edit news or other things i get Unauthorized access!