Topic: Keep getting "CSRF detected!"

Hi, I wanted to give Get-Simple a try, but I keep getting the "CSRF detected!" message when I try to do edit, or create anything.

Debug mode does not help.

I took a quick look to the code and well 

function check_nonce($nonce, $action, $file = ""){
                return ( $nonce === get_nonce($action, $file) || $nonce === get_nonce($action, $file, true) );
        }

This allways fail, those condition just never succeed :(

I'm trying to use this in sourceforge (if this help at all).

  • Connie
  • Connie
  • GetSimple Moderator
  • Offline
  • From: Hamburg + Gribow
  • Registered: 2011-02-28
  • Posts: 2,016
  • Reputation : 22

Re: Keep getting "CSRF detected!"

hi, welcome!

Pity that you start with a bad situation

1) Did you upload everything in the correct manner? Maybe delete everything and re-upload, that helped me out once

2) did you edit some of the core files or maybe edited the gsconfig.php and entered some wrong code there?

3) did you add some plugins already?

I noticed this CSRF once, and it was due to a faulty plugin ... (which I had edited myself ... )

|--
Die deutsche GetSimple-Webseite: http://www.Get-Simple.de = the german Get-Simple-Website!
Das deutschsprachige GetSimple-(Unter-)Forum:   http://get-simple.info/forum/forum/16/german-deutsch/

3 Reply by todoesverso (edited by todoesverso 2011-04-16 11:54:13)

Re: Keep getting "CSRF detected!"

Connie wrote:

hi, welcome!

Pity that you start with a bad situation

1) Did you upload everything in the correct manner? Maybe delete everything and re-upload, that helped me out once

2) did you edit some of the core files or maybe edited the gsconfig.php and entered some wrong code there?

3) did you add some plugins already?

I noticed this CSRF once, and it was due to a faulty plugin ... (which I had edited myself ... )

I tried with v3.0 and the svn trunk, both the same resutls :(

I only uncommented some things in the gsconfig.php.

No plugins added.

  • mikeh
  • mikeh
  • Web Developer
  • Offline
  • From: Fort Myers, Florida
  • Registered: 2011-02-22
  • Posts: 512
  • Reputation : 13

Re: Keep getting "CSRF detected!"

What did you uncomment in gsconfig?

Multi User
Front End User Login
GS Blog v.0
All my plugins

mikeh's Website

Re: Keep getting "CSRF detected!"

mikeh wrote:

What did you uncomment in gsconfig?

Just this

# Turn on debug mode
define('GSDEBUG', TRUE);

Why is there anything in gsconfig that could be causing this problem?
As far as I can tell the "nonce" thing is not wroking for me, all hashes are different.

  • nitsuj
  • GetSimple Newbie
  • Offline

Re: Keep getting "CSRF detected!"

I was just searching for the same error msg. I also simply downloaded the newest version, haven't changed anything.
After the first Login and changing my password. I then set the Website name and clicked the Use Fancy URLs. The error comes after pressing Save Settings.

Is this also what's causing your error?

  • snooze
  • GetSimple Student
  • Offline

Re: Keep getting "CSRF detected!"

I edited a page. I took out a Break tag, saved it and then, Boom! CSRF Detected

Now putting the Break tag back doesn't satisfy whatever is throwing the error.

  • Connie
  • Connie
  • GetSimple Moderator
  • Offline
  • From: Hamburg + Gribow
  • Registered: 2011-02-28
  • Posts: 2,016
  • Reputation : 22

Re: Keep getting "CSRF detected!"

snooze wrote:

I edited a page. I took out a Break tag, saved it and then, Boom! CSRF Detected

Now putting the Break tag back doesn't satisfy whatever is throwing the error.

without an URL and more info we cannot check what happens ...

|--
Die deutsche GetSimple-Webseite: http://www.Get-Simple.de = the german Get-Simple-Website!
Das deutschsprachige GetSimple-(Unter-)Forum:   http://get-simple.info/forum/forum/16/german-deutsch/
  • nitsuj
  • GetSimple Newbie
  • Offline

Re: Keep getting "CSRF detected!"

Just a quick update from my side. I tried the cms on another server and everything worked fine.
My problem was somehow related to my test server.

It's a shame that even with debug mode active the only error msg I got was "CSRF detected!"

  • Connie
  • Connie
  • GetSimple Moderator
  • Offline
  • From: Hamburg + Gribow
  • Registered: 2011-02-28
  • Posts: 2,016
  • Reputation : 22

Re: Keep getting "CSRF detected!"

nitsuj wrote:

It's a shame that even with debug mode active the only error msg I got was "CSRF detected!"

Let me say first, I also do not know what it means, but:

I do not accept that "this is a shame", don't blame GS for that.

This error is not GS specific. If you do a google search, you will find a lot of systems which produce this error or where this error happens. So you could have found some explanations for that maybe I am not sure ...

I learned that this might happen when you do not save edited text in a given time, for example playing with a cat for 30 minutes and then saving the test

mostly it is related to submitting data with some ajax techniques involved, it might also be related to the cookie behaviour of the browser etc.

So, do not call it a shame! Shame is a moral category, and this here is technique! ;=)

|--
Die deutsche GetSimple-Webseite: http://www.Get-Simple.de = the german Get-Simple-Website!
Das deutschsprachige GetSimple-(Unter-)Forum:   http://get-simple.info/forum/forum/16/german-deutsch/
  • nitsuj
  • GetSimple Newbie
  • Offline

Re: Keep getting "CSRF detected!"

I didn't know that it was a PHP error. I'd just searched these forums.

As I said I think it has something to do with my test server, I uploaded it to another server and everything worked fine.

  • Connie
  • Connie
  • GetSimple Moderator
  • Offline
  • From: Hamburg + Gribow
  • Registered: 2011-02-28
  • Posts: 2,016
  • Reputation : 22

Re: Keep getting "CSRF detected!"

nitsuj wrote:

I didn't know that it was a PHP error. I'd just searched these forums.

As I said I think it has something to do with my test server, I uploaded it to another server and everything worked fine.

nitsuj, I just did a text search in the program files and I see that this message is in the script, always in connection with cookies

so the script uses some "tech speach"

so, as a consequence I would suggest whenever this message occurs to check the cookie-settings of the browser

Cheers, COnnie

|--
Die deutsche GetSimple-Webseite: http://www.Get-Simple.de = the german Get-Simple-Website!
Das deutschsprachige GetSimple-(Unter-)Forum:   http://get-simple.info/forum/forum/16/german-deutsch/
  • snooze
  • GetSimple Student
  • Offline

Re: Keep getting "CSRF detected!"

Try this on for size. Previously, the site I was working on was giving me the error CSRF Detected immediately after I removed a break tag. After removing the site, all of GS 3 and beginning the site again, I once again am getting the same error. The last thing I did was remove some break tags from between some short paragraphs in order to make them list items. Hmmm.

SNZ

::Hears the haunting strains of the Twilight Zone theme::

  • snooze
  • GetSimple Student
  • Offline

Re: Keep getting "CSRF detected!"

Just realized: Debug won't work because the error is in the admin. Most the threads - if not all - deal with the error occurring when trying to save in the editor. The actual site is not affected since the update save was halted.

  • Connie
  • Connie
  • GetSimple Moderator
  • Offline
  • From: Hamburg + Gribow
  • Registered: 2011-02-28
  • Posts: 2,016
  • Reputation : 22

Re: Keep getting "CSRF detected!"

I ran into this error message when I was logged in the backend, changed my password in the settings, did not log out and log in, but tried to write a page

when I logged out, cleared the cache, logged in again, I could write a page and did not get that error anymore

I think this situation is very common to many users ...

|--
Die deutsche GetSimple-Webseite: http://www.Get-Simple.de = the german Get-Simple-Website!
Das deutschsprachige GetSimple-(Unter-)Forum:   http://get-simple.info/forum/forum/16/german-deutsch/
  • Aron
  • GetSimple Newbie
  • Offline

Re: Keep getting "CSRF detected!"

Have the same issue, but after I CHMOD'd gsconfig.php to 755, the issue hasn't popped up again. I'd like to see some testing on this so we can figure out, definitively, why it happens. My customer got this after every (attempt) to save; I got it after reinstalling and changing the admin password from within the control panel.

  • ccagle8
  • ccagle8
  • GetSimple Administrator
  • Offline
  • From: Pittsburgh, PA
  • Registered: 2009-08-06
  • Posts: 1,814
  • Reputation : 15

Re: Keep getting "CSRF detected!"

I am very interested in finding out what might be causing this as well. In 3.1 I just updated the code to turn "off" CSRF protection via gsconfig.php, but I would prefer to fix the issue than have people turning it off.

Unfortunately I can't troubleshoot the problem because i am not getting the error message with csrf.

- Chris
Thanks for using GetSimple! - Download

Please do not email me directly for help regarding GetSimple. Please post all your questions/problems in the forum!

ccagle8's Website

  • snooze
  • GetSimple Student
  • Offline

Re: Keep getting "CSRF detected!"

Info update

In my issue reported in item #13 and 14 above, I had to be away shortly after the error showed up. When Ii returned ~2 hours later, all was fine as if nothing untoward had happened. Would this be evidence for a server environment cause?

For Aron: My gsconfig.php is 755 by default.

Chris: My remote host is logging the following persistent error in the site root - over and over several times an hour. Possibly related?

[27-Apr-2011 10:07:00] PHP Warning:  PHP Startup: Unable to load dynamic library '/usr/local/lib/php/extensions/no-debug-non-zts-20060613/php_curl.dll' - /usr/local/lib/php/extensions/no-debug-non-zts-20060613/php_curl.dll: cannot open shared object file: No such file or directory in Unknown on line 0

  • ccagle8
  • ccagle8
  • GetSimple Administrator
  • Offline
  • From: Pittsburgh, PA
  • Registered: 2009-08-06
  • Posts: 1,814
  • Reputation : 15

Re: Keep getting "CSRF detected!"

i dont think it's related since the CSRF protection doesnt use Curl. Take a look here: http://forums.theplanet.com/index.php?showtopic=90796

- Chris
Thanks for using GetSimple! - Download

Please do not email me directly for help regarding GetSimple. Please post all your questions/problems in the forum!

ccagle8's Website

  • snooze
  • GetSimple Student
  • Offline

Re: Keep getting "CSRF detected!"

ccagle8 wrote:

i dont think it's related since the CSRF protection doesnt use Curl. Take a look here: http://forums.theplanet.com/index.php?showtopic=90796

Well, the DLL was active in the php.ini. I commented it but the error log still is reporting the error. I'll check with the hosting company.

  • Aron
  • GetSimple Newbie
  • Offline

Re: Keep getting "CSRF detected!"

Is there any way to disable CSRF protection without needing the 3.1 update? And what does CSRF protection do exactly?

  • ccagle8
  • ccagle8
  • GetSimple Administrator
  • Offline
  • From: Pittsburgh, PA
  • Registered: 2009-08-06
  • Posts: 1,814
  • Reputation : 15

Re: Keep getting "CSRF detected!"

no, it was quite a bit of coding to be able to turn it off. You might be able to mess with the function within /admin/inc/nonce.php though to make it always return a "true"

Look up CSRF in Google... it can better explain it than i can... Sorry for any inconvenience here.

- Chris
Thanks for using GetSimple! - Download

Please do not email me directly for help regarding GetSimple. Please post all your questions/problems in the forum!

ccagle8's Website

  • SamWM
  • GetSimple Follower
  • Offline

Re: Keep getting "CSRF detected!"

I'm also getting 'CSRF Detected' whenever I edit a page as well, even if I clear everything in the rich text box. Only solution for me seems to be to edit the code so it always returns true. Running Windows Server 2008.

What's strange is that it worked a few months ago...

-- Sam
  • ccagle8
  • ccagle8
  • GetSimple Administrator
  • Offline
  • From: Pittsburgh, PA
  • Registered: 2009-08-06
  • Posts: 1,814
  • Reputation : 15

Re: Keep getting "CSRF detected!"

samWM - are you willing to give the newest SVN code a try to see if my "turning off of CSRF" via the gsconfig file works?

- Chris
Thanks for using GetSimple! - Download

Please do not email me directly for help regarding GetSimple. Please post all your questions/problems in the forum!

ccagle8's Website

25 Reply by SamWM (edited by SamWM 2011-05-27 11:56:27)

  • SamWM
  • GetSimple Follower
  • Offline

Re: Keep getting "CSRF detected!"

Turning off CSRF via gsconfig.php does work when using SVN version.

Also found what is probably the cause of the error... my IP address can occasionally change (depending on which internet gateway I am going through). Since the IP address is used to generate the nonce, then the CSRF error occurs if it ever changes.

Perhaps other people who have this issue belong to a large network where they go through various proxies and gateways to connect to the internet and it changes since you connect through the one with the most capacity available. It would also explain why you can't replicate the problem.

Since it is for preventing cross site scripting attacks, maybe the nonce could use something unique on the server? A server variable like 

$_SERVER["SCRIPT_FILENAME"]

which will be unique for each website and can't be retrieved without having direct access to the server

-- Sam