I've just completed an upgrade from 2.5.3 to 2.7.0 (never want to do THAT again ;) ) and have run into an issue that seems to be coming from some changed security restrictions.
I have several simple pages that (in a nutshell)
- read the contents of a web page into a variable
- allow the selection (via radio button) of an e-mail address value for another variable
- mails the html content to the provided e-mail address
This has been done for the last year or so, no problems at all. Two lines of php have capture the content and another line sends the mail with the native mail() function. The page has used a form to post the html payload and email address selection back to itself (action="") and then based on the value of a couple hidden variable has either executed the mail() command or recycled the page with alternate html to be delivered as payload.
Since upgrading to 2.7 these form submission have stopped working, and I am confronted with that ugly grey box stating
The following errors were encountered
- The action you have requested is invalid.
Return to Previous Page
A "wonderful" generic message, which says absolutely nothing at all. (sigh)
I bit of time with google had me thinking this was being caused by a now mandatory CSRF token, but looking at my config I saw that CSRF protection was not even enabled.
I can't find a hint of anything in any log file anywhere, nor does anything appear on screen for a superuser. Also, the action does not complete, the mail is not sent.
I whittled one of the pages down to the following contents as a test:
<form action="" method="post"> <input type="hidden" name="toAddy" value="email@example.com" /> <input type="submit" name="submit" value="mail" /> </form>
And this also generated the error page.
Looking at a web console in FF, nothing is generated at all. I simply cannot find any specific error information anywhere which can lead me to a next step.
Has anybody seen this, or does anybody have an suggestions?
Any help is very much appreciated.