Hot answers tagged

6

You must create a module and a module action. There are docs here. The key is to grant your action a CSRF exemption, like so: ee()->db->insert('actions', array( 'class' => 'Module_name' , 'method' => 'method_to_call', 'csrf_exempt' => 1, )); Look up the action_id in the exp_actions table for your newly created action. Your action can ...


4

1.) Ensure your server time is set correctly and check your ExpressionEngine server timezone setting. Both the form hash ID and the session ID are time sensitive. If ExpressionEngine is calculating when to expire them based on an incorrect time, your hash ID may expire much sooner than it should. 2.) Quickest way to test whether it’s due to Secure Mode is to ...


4

ExpressionEngine has a protection against Cross-site Request Forgery - CSRF and a documentation available here. You just have to add that line to your form: <input type="hidden" name="csrf_token" value="{csrf_token}"> And send the data in your AJAX request. I had the same problem today and that fixed it for me.


4

You can avoid the XID validation by making a GET request instead of a POST request. XID validation only occurs when secure_forms is y and the $_POST array is not empty. Or you can generate a valid XID hash by using {XID_HASH} in your template. Maybe something like: <body data-xid="{XID_HASH}"> <script> $.post( 'site/inifinite_scroll_ajax', ...


3

I wouldn't recommend this but in cases where you have no choice, e.g. you cannot tweak the code in an app in time or something to that effect, you can opt to conditionally disable secure forms in your config.php or bootstrap. E.g. // Make an exception to make AJAX forms app-compatible // EE 2.7.x introduced mandatory XIDs even for AJAX, but an app won't ...


3

We have fixed this with a couple of changes, seems Cartthrob has a couple of issues... 1) Based on this post XID POST from third party we added the we added 'csrf_exempt' => 1 into the database for the payment_return_action in the Cartthrob exp_actions table. We do not know if this helped, but seems like we should do it. Carttrhob does not add this in when ...


3

I see you're already attempting to grab the new XID from the return data of the Ajax call: // update the XID hash in the form so we don't run afoul of EE's secure forms $("input[name=XID]").val(response.XID); But I fell onto this documentation the other day which I think is new and relating to new EE version handling. Seems like if submitted by Ajax the ...


2

Yes, you need to get a new XID each time via Ajax and update your form hidden value, so next time the form is submitted it uses the new XID. Depends what your Ajax is returning of course and where it's submitting to, but in the past on return from the Ajax submission, I've fired another function to just do an Ajax request, then do the replacements. For ...


2

A more programatic approach to this could involve creating an ACTion URL. There is not much documentation about them except to read through the EE codebase, but these URLs could remove the need to deal with XIDs. From http://ellislab.com/expressionengine/user-guide/development/module_tutorial.html: $data = array( 'class' => 'Download' , '...


2

I think, the addon may be generating the form with the following code: $hidden_fields = array( 'ACT' => 'ACTION ID', 'RET' => 'RETURN URL' ); $data = array( 'action' => 'FORM ACTION', 'hidden_fields' => $hidden_fields, 'id' => 'FORM ID', ); $tagdata = $this->EE->TMPL->tagdata; $form ...


2

YYYYYYEEEEEEEEESSSSSSSS!!!! Thank F for that. I have got this working. Peter's answer was the right way to go. It was in the docs all along! For those that may run into a similar situation, I fixed this by adding the recommend ajaxPrefilter that is mentioned in the docs - with a little tweak to define the form. An updated JS Fiddle: http://jsfiddle.net/...


2

I checked and I can see the XID param being sent to the jquery.ajax by looking in chrome network panel, i can see the query string it builds. So we are good there. It sounds like you are sending the XID in GET instead of POST data. CSRF tokens must be present in the POST data if POST data is received by ExpressionEngine. 2.7.3: POST: XID 2.8+: POST: ...


1

Solved. Problem was caused by new cross-site request forgery protections in EE. Setting the corresponding webhook action as csrf_exempt fixed it.


1

Just thought I'd throw this in there for others that might find this post. EE 2.8.1 removed the secure form option in the admin section of the CP. The only way to disable now is to add this to your config: $config['disable_csrf_protection'] = 'y'; Just some FYI.


1

We have an add-on for this that is very simple to use and will allow you to put a plugin tag under your form {exp:formrefresher} and if that template is loaded via the back button it will refresh the page, and will refresh your form with a new XID to remove the users frustration on repeated form submissions with errors do to expired XID. Form Refresher -> ...


1

Every time you submit the form, you need to create a new XID and pass it back into the hidden input values. Essentially, each time you process the form it uses the XID token so the next time you process it without a page load, you will get that error. It's also possible the CT devs could add some to code to reuse the last XID if an AJAX request has been ...


1

This isnt an answer as such, just some comments. In 2.7, if secure forms is on, a form wont submit without an xid. Prior to 2.7 it would if youd created your own form tags. If xid is blank, you can add it manually like this <input type="hidden" name="XID" value="{XID_HASH}" /> This answer may help too link Good luck


1

Edit: heres the bug report response from EE It’s really not a bug, but it would be nice if we could only generate it when needed- i.e., the template parser spots a form tag. The sticking point is ajax and how the lack of an xid would jam things up there. I know this started the devs bouncing some ideas around, but at the moment, the behavior ...


1

EE Docs. Also details Ajax handling of XID. As Bhashkar stated: $this->EE->functions->form_declaration($data); Or the new method: ee()->functions->form_declaration($data); "so the XID (secure hash ID) is added automatically as a hidden input field." As part fo the $data array sent you can force secure by adding it: $data['secure'] = ...


1

If you just create a hidden input field name XID and use the EE Tag {XID_HASH} I think it'll generate the value for you. <input type="hidden" name="XID" value="{XID_HASH}" />


1

When I throw an ajax error I use ee()->security->restore_xid() so I can use the same token again. Per http://ellislab.com/expressionengine/user-guide/development/guidelines/security.html#cross-site-request-forgery


Only top voted, non community-wiki answers of a minimum length are eligible