5
votes
How to fix "This form has expired. Please refresh and try again."
if you have v 2.10 - try to replace
<input type="hidden" name="XID" value="{XID_HASH}">
with
<input type="hidden" name="csrf_token" value="{CSRF_TOKEN}">
The XID constant is ...
- 107
3
votes
Accepted
Automatically creating an alphanumeric number for each new entry
If you are using EE4 then you could use the built-in encrypt / decrypt variable modifiers. So your template entry could end up with something like this perhaps:
{path='SingleSignon/Microsite'}?...
- 3,587
3
votes
Accepted
Is there any setting in Expression Engine that does not permit cross-origin framing?
Le sigh... I always forget to RTFM.
https://docs.expressionengine.com/v3/general/system_configuration_overrides.html#x-frame-options
You can set it in your config.php to NONE.
Edit
Just FFS, here'...
- 5,900
3
votes
Accepted
How to fix "This form has expired. Please refresh and try again."
I've looked through the source code for you but I'm drawing a blank. I thought there was an arbitrery timeout value in the token however in 2.9.2 this seems to have been depreciated (or I imagined it)!...
- 2,418
3
votes
Accepted
Module development: Any reasons creating catch-all action is a bad idea?
It's really your choice here. I imagine that this framework is best for smaller addons. One point of access is always slightly frowned upon; because it creates a SPOF in your addon.
Trust me, I ...
- 5,900
3
votes
Accepted
"This license is in use on multiple domains" - Privacy & Security issue?
Addons is too broad for the forum, you'll have to contact the manufacurers however I've never seen a 3rd party phone home from the popular developers (SolSPace, P&T, GotoLow, Expresso, ...
- 2,418
2
votes
Accepted
Can you add to the restricted tags filter for security in EE to secure the application further?
I too have been faced with rather demanding security injection testing on EE (and non EE) sites so I can fee lyour pain, and speak from some experiance.
First the direct answer to your question. ...
- 2,418
2
votes
Accepted
Security of an Action URL called from AJAX
What data does the script which is being triggered with action URL accept? If that's EE form submission, then you should not worry if you follow standard EE forms security settings/practice.
If it's ...
- 2,846
2
votes
Does anyone know any details on the recent security release notifications?
You'll discover all patch notes here in the changelog.
Security patches are a combination of both EE & underlying frameworks. EE is pretty resilient and a lot of security issues are more server ...
- 3,163
1
vote
Mod_Security Roadblocks, Hosting EE
Your best bet is still to open a support ticket with HostGator and asking them to 'whitelist' those mod_sec rules that are causing the problem. As EE5 isn't as common as say WordPress, most hosting ...
- 401
1
vote
Installation hacked - rogue link inserted onto page
The only timeI've encountered something like this is when the site was on a shared hosting. It turned out this happened because of a leaky joomla install on that same server. You can safely delete the ...
- 1,849
1
vote
Does anyone know any details on the recent security release notifications?
I found out from Robin Sowell with Ellis Lab that the latest security release fixes a previously unknown issue in CodeIgnitor, which is at the core of version 2.
So this definitely affects all ...
1
vote
How to fix "This form has expired. Please refresh and try again."
There's also another possibility that I ran into with the "This form has expired. Please refresh and try again." error.
Using Stash, I recently turned on caching on my pages that include forms. The ...
- 251
1
vote
Accepted
Is it necessary to hide the system folder from search robots?
I would not put it in your robots.txt file. As you noted, it exposes the path to your system folder. Malicious bots or users will certainly look at that file and poke around the paths you have in ...
- 611
1
vote
Channel Form: Why is Wygwam/CKFinder disabling the file browser for security reasons?
This just in from Brad at P&T:
From what I can tell, if Admin->Security & Privacy->Security &
Settings's "Website Session Type" is set to anything with session in
it (session only, ...
- 205
1
vote
ExpressionEngine and CORS?
If you don't want to enable PHP in your templates you can also use https://github.com/nathanpitman/np_access_control_allow_origin.pi.ee_addon to do this. :)
- 878
Only top scored, non community-wiki answers of a minimum length are eligible