EE 2.9.2 - WYGWAM 3.3.3
In a Channel Form, I am getting the error...
"The file browser is disabled for security reasons. Please contact your system administrator and check the CKFinder configuration file."
...when trying to link to or upload a file.
In the Control Panel, Wygwam is working fine and the above scenario plays out as expected (works)
Yes, the Wygwam configuration setting is pointing to a proper directory. Yes, we've added an XID hash to the form.
What else should I be looking for?
This just in from Brad at P&T:
From what I can tell, if Admin->Security & Privacy->Security & Settings's "Website Session Type" is set to anything with session in it (session only, cookies and session), then EE just won't log you in from the front-end of the site at all. No idea why.
It will only work with "cookies only" selected. If EE were to log you in on the front-end with sessions, then it would automatically start the PHP $_SESSION global. Where Wygwam runs into trouble is that it sees that $_SESSION hasn't been started so it calls session_start(), but for some reason, EE sets that to a path restriction of {segment_2} causing Wygwam not to able to read/write to it.
However, if you go to Admin->Security & Privacy->Cookie Settings and explicitly set the "Cookie Path" to "/", then it will save the cookie with no path restriction and all of the sudden, CKFinder works like it should on the front-end.
I don't know if this fits the definition of an Expression Engine bug, but it sure is hinkey.
