QuickEdit doesn't work in new release?

1 Posts

Zombie Reply #1, 18 years ago

I just installed modx 0.9.6.2 en set the Validate HTTP_REFERER headers? to Yes.

When I try to use QuickEdit, I get the message:

A possible CSRF attempt was detected. No referer was provided by the server.

When I set the Validate HTTP_REFERER headers? to No, QuickEdit works fine.

Are there others who experience the same problem and how can I solve this?

MODX Staff
12,272 Posts

Ryan Thrash Reply #2, 18 years ago

Sounds like mod_security to me.

Ryan Thrash, MODX Co-Founder
Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me

1 Posts

Zombie Reply #3, 18 years ago

Thanks for your quick answer

I had to do a Google search to find out what mod_security is and what I can do to make QuickEdit work.

I found two pieces of code to place in the .htaccess file to temporarily ’switch off’ mod_security:

<LocationMatch "/path/to/application">
SecFilterInheritance Off
</LocationMatch>

and just

SecFilterInheritance Off

What’s the best solution? Do I use the first code in the .htaccess file in the root, or the second one in a .htaccess file in the /assets/modules/quick_edit directory?

4,205 Posts

dev_cw Reply #4, 18 years ago

I don’t know the answer, but see the article in the wiki. http://wiki.modxcms.com/index.php/What_is_mod_security_and_how_does_it_affect_me

[font=Verdana]Shane Sponagle | [wiki] Snippet Call Anatomy | MODx Developer Blog | [nettuts] Working With a Content Management Framework: MODx

Something is happening here, but you don't know what it is.
Do you, Mr. Jones? - [bob dylan]

MODX Staff
10,725 Posts

opengeek Reply #5, 18 years ago

This is not a result of mod_security, in all likelihood. It seems there may be a problem with QuickEdit not sending the proper headers to validate. I’m researching and will post back.

Jason Coward
Chief Architect @ MODX
http://www.jasoncoward.com | http://twitter.com/drumshaman | https://github.com/opengeek

MODX Staff
10,725 Posts

opengeek Reply #6, 18 years ago

QuickEdit is working fine with this setting for me. Does the manager work at all with this setting for you? If not, your server is not setting the HTTP_REFERRER headers and you will not be able to use this setting in all likelihood.

Jason Coward
Chief Architect @ MODX
http://www.jasoncoward.com | http://twitter.com/drumshaman | https://github.com/opengeek

1 Posts

Zombie Reply #7, 18 years ago

I haven’t experienced any problems with the Manager so far.

Everything is working just fine, except QuickEdit.

MODX Staff
10,725 Posts

opengeek Reply #8, 18 years ago

Quote from: WeBe at Sep 22, 2008, 03:34 PM

I haven’t experienced any problems with the Manager so far.

Everything is working just fine, except QuickEdit.

Are you logging into the manager before using QuickEdit, or are you using a front-end component to log in the user’s to their manager account?

Jason Coward
Chief Architect @ MODX
http://www.jasoncoward.com | http://twitter.com/drumshaman | https://github.com/opengeek

1 Posts

Zombie Reply #9, 18 years ago

I logged into the manager before I tried to use QuickEdit.

By the way: I’ve tried a .htaccess file in the assets/modules/quick_edit directory but that not only messes up my design, QuickEdit also doesn’t work at all.

MODX Staff
10,725 Posts

opengeek Reply #10, 18 years ago

For some reason, QuickEdit is not sending an HTTP_REFERER header then from your client. It is from the manager or the manager would not work with that setting. I cannot explain this. Anyone have any ideas why QuickEdit would not be sending HTTP_REFERER in it’s request? Or could this be an issue with a specific browser? What browser are you using?

Jason Coward
Chief Architect @ MODX
http://www.jasoncoward.com | http://twitter.com/drumshaman | https://github.com/opengeek