Problem with "Possible CSRF attempt was detected" detection

Note that the problem described here was the same in MODx 1.0.1

When I log in the manager I get for each of the 3 panels the message :

"A possible CSRF attempt was detected. No referer was provided by the server."

Obviously I cannot do anything. This started when I enabled the option to detect it back in 1.0.1. Even tough I disabled the detection later on because I could not access the manager anymore. The problem remained.
The only fix was for me to change the line 228 in manager/index.php

from
if (isset($modx->config[’validate_referer’]) && $modx->config[’validate_referer’]) {

to
if (isset($modx->config[’validate_referer’]) && $modx->config[’validate_referer’] == ’1’) {

It seems that if the option is set (whether true or false), the detection is activated.

Note that with the fix mentionned above, there is no problem.

I’m running MODx 1.0.2 on MAMP/Mac OS 10.6.

Quote from: lmestre at Nov 08, 2009, 07:24 AM

It seems that if the option is set (whether true or false), the detection is activated.

What value did you set in the database for this option. If ’0’ the existing logic should return false. If you set it to the string ’false’, it will evaluate to true and that would cause the problem.

You are right. I mistakenly put 00 in the field in the database last time I fixed it. Putting back a simple 0 makes everything work again with the actual shipped code.

Actually I discovered that the situation is a bit more tricky than thought. In fact the "00" in the setting value for "validate_referer" was NOT my mistake but is put by MODx when you opt not to get the warning of that setting being at 0.

Basically, the setting being at 0 everything is ok. When you opt to say that you don’t want to be bothered with the warning that the setting is 0, MODx write 00 in the setting value. And then the checking of the referer is done anyway and you cannot access the manager.

So they are 2 ways to fix this :
- not to mess up the value 0 of validate_referer
- change the test in manager/index.php as I suggested earlier.

For now I go back to my fix in manager/index.php

I set my DB field to 0 and am getting that error as well. Ontop of that I’m being redirected to the wrong base url.

The value of the field is cached in
assets/cache/siteCache.idx.php

You may need to delete this file to make sure you pick up the current database value when you change it.

************ [[ SOLUTION ]] *******************


My Friend if Modx Works fine in IE, Crome etc... and only have problems in Firefox... that is the problem Firefox!!

so is just configuration.

1. Type “about:config” in the location bar, and press Enter.
2 In the filter box, type “referer” and press Enter. This should leave you with one preference, network.http.sendRefererHeader. This is probably set to 0.
3 Right click on network.http.sendRefererHeader and select “Modify”

- Just change it to 2

and thats all.

Are just some things about security in firefox...

I HOPE THAT WORKS FOR YOU TOO, MORE INFORMATION HERE:

http://www.belafontecode.com/fix-modx-csrf-error-in-firefox/