Save revision on channel entry error

Question

We've setup a site for a client to populate with their content and they are having a recurring issue when they go to 'save revision' or 'submit' the entry.

If they've spent a bit of time adding the entry content, when they click either save or submit, they're getting dumped out to the control panel home.

I wondered whether the session could have been expiring (or changing somehow) so changed the security to cookies only, but they're still having the issue.

Anyone else come across this or have any thoughts as to why it might be happening?

Cheers!

Answer 1

ExpressionEngine natively processes forms in secure mode which means each for submission is tied to an automatically generated XID / Hash which is passed as a hidden field in all CP and most front-end forms.

The XID is a hash containing a reference to a database entry which gives EE a bunch of info about the user (their user agent, timestamp created, ip address and some other identifying 'stuff').

The XID is validated on submission (to ensure the same user visiting the form is the same user submitting the form) so if the XID fails to validate, or expires - EE will block the submission and in the case of a user being in the CP, it simply redirects them to the home page which isn't very helpful.

To prevent your issue, you can disable secure form processing globally via:

Admin -> Security and Session Preferences -> Process form data in Secure Mode? -> No

I'm always quite wary of disabling this though, if you do - proceed with caution. You're opening a few holes and it's up to you to determine if the risk is worth it.

EDIT: I should also mention that a common cause of what you are describing is a user submitting a form and using their browser's back button to submit again. Because the XID has been used, it is no longer 'valid' and EE will reject it.

Answer 2

Oddly enough, the only known solution to this that I've been able to use is to use the back button, and save again. It works more often than it doesn't.

This is what made me think that the issue was not the XID at all.

Also, none of the content being submitted differs greatly from a successful submit to a failed one. New entries v edits, paragraphs v images, everything appears to be fair game for this random occurrence.

On the front end, an invalid XID results in "You are not authorized to perform this action." This results in no obvious error. Anyone who did not expect a View Entry screen would think that their entry had saved just fine.

As someone still experiencing this issue, my client cannot turn off Secure Mode because the site relies heavily on user-generated content.

This is a bug, and it needs to be handled as such.

Answer 3

I've experienced these same symptoms with clients running a site on multiple servers behind a load balancer. When this is the case, you may need to whitelist the proxy IPs.

You can do this in /system/expressionengine/config/config.php in the Reverse Proxy IPs section.

/*
|--------------------------------------------------------------------------
| Reverse Proxy IPs
|--------------------------------------------------------------------------
|
| If your server is behind a reverse proxy, you must whitelist the proxy IP
| addresses from which CodeIgniter should trust the HTTP_X_FORWARDED_FOR
| header in order to properly identify the visitor's IP address.
| Comma-delimited, e.g. '10.0.1.200,10.0.1.201'
|
*/
$config['proxy_ips'] = "";