After upgrade to 2.2.8 problem "access denied" on save

All I know is that it happens just about every time I login on any client site, BUT I don't think it has ever happened to me on modxcloud (but my brain isn't what it used to be). So it could be just cpanel sites only. Only actual fact I know is that one client still on 2.2.6 never has the issue.

OK, here's an interesting clue:

I just logged in later than usual this morning, after other users are probably logged in. I tried to download the Error Log report, which is currently too large to display (this has nothing to do with this problem, it's correctly logging debugging messages from a custom add-on) so it has a download link.

When I click the download button, it takes me to this URL:

/connectors/system/errorlog.php?action=download&HTTP_MODAUTH=0

The content of the URL is a JSON array like this:

in other words, it's giving me an access denied error in raw form.

Notice the HTTP_MODAUTH=0 in the URL.

If I view the source of the report log manager page, there is a script with this line:

I don't know a lot about the way the scripts for these manager pages are generated, but I'm guessing the line above is the problem? It should be hard-coding my actual auth token into the page, right?

So, I tried flushing my permissions, logging out and back in, and sure enough now there's a real auth token on that line instead of 0, and I can download the log.

For those familiar with the manager, I'm probably just stating the very obvious. I don't have time to investigate further right now. When I have time I'll look more deeply into it.

Quote from: esnyder at Sep 25, 2013, 10:47 AM

OK, here's an interesting clue:

MODx.load({xtype: "modx-layout",accordionPanels: MODx.accordionPanels || [],auth: "0"});

I don't know a lot about the way the scripts for these manager pages are generated, but I'm guessing the line above is the problem? It should be hard-coding my actual auth token into the page, right?

So, I tried flushing my permissions, logging out and back in, and sure enough now there's a real auth token on that line instead of 0, and I can download the log.

For those familiar with the manager, I'm probably just stating the very obvious. I don't have time to investigate further right now. When I have time I'll look more deeply into it.

I wrote about all of this many time ago.
* And read comments after.

Like I said, probably obvious but I thought it better to over-share.

Quote from: esnyder at Sep 25, 2013, 11:24 AM

Like I said, probably obvious but I thought it better to over-share.

There a said not problem only, but and solution too here and here.

Jason not agree with me, but i know what i`m doing.
And yes, it`s hardcode, but while we dont got official path and if you tried to do relogin, it`s may help you.

No worries, we can cope with the problem until we get an official fix. I'm just trying to find the source of the problem and I thought I should document my efforts to do so. I'll probably have more obvious and/or redundant observations to share later ;-)

Strike that - just happened in the cloud too

Quote from: phil_w at Sep 25, 2013, 01:57 AM

All I know is that it happens just about every time I login on any client site, BUT I don't think it has ever happened to me on modxcloud (but my brain isn't what it used to be). So it could be just cpanel sites only. Only actual fact I know is that one client still on 2.2.6 never has the issue.

Hi Phil,

Would you mind sending an email to [email protected] with the name of the cloud in question if you don't mind us spinning up a snapshot of it for testing? If we can reproduce this in the MODX Cloud environment, it'll be much easier to understand and solve.

Email sent, Mike

Quote from: netProphET at Sep 30, 2013, 01:09 PM

Hi Phil,

Would you mind sending an email to [email protected] with the name of the cloud in question if you don't mind us spinning up a snapshot of it for testing? If we can reproduce this in the MODX Cloud environment, it'll be much easier to understand and solve.

Can those of you experiencing this confirm or deny that this occurs when you are viewing a Resource in the front-end within the same browser session as using the Manager? I stepped through this with someone experiencing the problem yesterday, and turning off sessions in the front-end Context( s ) or viewing the front-end in an incognito window prevented the problem from reoccurring.