EE 2.9.2 - WYGWAM 3.3.3

In a Channel Form, I am getting the error...

"The file browser is disabled for security reasons. Please contact your system administrator and check the CKFinder configuration file."

...when trying to link to or upload a file.

In the Control Panel, Wygwam is working fine and the above scenario plays out as expected (works)

Yes, the Wygwam configuration setting is pointing to a proper directory. Yes, we've added an XID hash to the form.

What else should I be looking for?

1 Answer 1


This just in from Brad at P&T:

From what I can tell, if Admin->Security & Privacy->Security & Settings's "Website Session Type" is set to anything with session in it (session only, cookies and session), then EE just won't log you in from the front-end of the site at all. No idea why.

It will only work with "cookies only" selected. If EE were to log you in on the front-end with sessions, then it would automatically start the PHP $_SESSION global. Where Wygwam runs into trouble is that it sees that $_SESSION hasn't been started so it calls session_start(), but for some reason, EE sets that to a path restriction of {segment_2} causing Wygwam not to able to read/write to it.

However, if you go to Admin->Security & Privacy->Cookie Settings and explicitly set the "Cookie Path" to "/", then it will save the cookie with no path restriction and all of the sudden, CKFinder works like it should on the front-end.

I don't know if this fits the definition of an Expression Engine bug, but it sure is hinkey.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.