cakeDC users plugin gets blackholed with register

Question

I have read through other cakeDC user plugin questions prior to asking this question.

I've added the cakeDC users plugin to a clean install of cakePHP 2.2.3. I did have routing problems at first, but by moving the user plugins routing to the config routing I was able to get the routing I expected.

So, instead of users/users/register, after moving the routing I got users/register to work.

The problem I'm having now is with register. Once the email has been configured and I'm able to submit the registration form, I get the following error:

Error: The requested address '/cakeDC/users/add' was not found on this server.

Here is the 'add' action the 'register' is routed to:

public function add() {
    if ($this->Auth->user()) {
        $this->Session->setFlash(__d('users', 'You are already registered and logged in!'));
        $this->redirect('/');
    }

    if (!empty($this->request->data)) {
        $user = $this->User->register($this->request->data);
        if ($user !== false) {
            $this->_sendVerificationEmail($this->User->data);
            $this->Session->setFlash(__d('users', 'Your account has been created. You should receive an e-mail shortly to authenticate your account. Once validated you will be able to login.'));
            $this->redirect(array('action' => 'login'));
        } else {
            unset($this->request->data[$this->modelClass]['password']);
            unset($this->request->data[$this->modelClass]['temppassword']);
            $this->Session->setFlash(__d('users', 'Your account could not be created. Please, try again.'), 'default', array('class' => 'message warning'));
        }
    }
}

Here's the form:

<div class="users form">
    <h2><?php echo __d('users', 'Add User'); ?></h2>
    <fieldset>
        <?php
            echo $this->Form->create($model);
            echo $this->Form->input('username', array(
                'label' => __d('users', 'Username')));
            echo $this->Form->input('email', array(
                'label' => __d('users', 'E-mail (used as login)'),
                'error' => array('isValid' => __d('users', 'Must be a valid email address'),
                'isUnique' => __d('users', 'An account with that email already exists'))));
            echo $this->Form->input('password', array(
                'label' => __d('users', 'Password'),
                'type' => 'password'));
            echo $this->Form->input('temppassword', array(
                'label' => __d('users', 'Password (confirm)'),
                'type' => 'password'));
            $tosLink = $this->Html->link(__d('users', 'Terms of Service'), array('controller' => 'pages', 'action' => 'tos'));
            echo $this->Form->input('tos', array(
                'label' => __d('users', 'I have read and agreed to ') . $tosLink));
            echo $this->Form->end(__d('users', 'Submit'));
        ?>
    </fieldset>
</div>

Here is the information in the Stack Trace:

CORE\Cake\Controller\Component\SecurityComponent.php line 232

    }
    if ($isPost && $isNotRequestAction && $this->csrfCheck) {
        if ($this->_validateCsrf($controller) === false) {
            return $this->blackHole($controller, 'csrf');
        }

SecurityComponent->blackHole(UsersController, string)

object(UsersController) {
    name => 'Users'
    helpers => array(
        [maximum depth reached]
    )
    components => array(
        [maximum depth reached]
    )
    presetVars => array(
        [maximum depth reached]
    )
    uses => array(
        [maximum depth reached]
    )
    request => object(CakeRequest) {}
    response => object(CakeResponse) {}
    viewPath => 'Users'
    layoutPath => null
    viewVars => array(
        [maximum depth reached]
    )
    view => 'add'
    layout => 'default'
    autoRender => true
    autoLayout => true
    Components => object(ComponentCollection) {}
    viewClass => 'View'
    View => null
    ext => '.ctp'
    plugin => 'Users'
    cacheAction => false
    passedArgs => array([maximum depth reached])
    scaffold => false
    methods => array(
        [maximum depth reached]
    )
    modelClass => 'User'
    modelKey => 'user'
    validationErrors => null
    Session => object(SessionComponent) {}
    Auth => object(AuthComponent) {}
    Cookie => object(CookieComponent) {}
    Paginator => object(PaginatorComponent) {}
    Security => object(SecurityComponent) {}
    Prg => object(PrgComponent) {}
}
'csrf'

I understand this plugin should work out of the box, but I don't see any obvious reason for not processing the registration form and the black hole.

rlcabral rlcabral · Accepted Answer · 2013-02-22T11:36:07

Security component is considering it a CRSF attack. Be sure that:

You are not reloading the form (resending the data)
The form is being created properly. I suggest testing with the basic form the plugin offers.
It is not using AJAX. It works with AJAX, but I think you need to setup a few things.
Your browser is sending all the headers properly. Perhaps you have an addon for debugging that is tampering requests, hence creating a CRSF attack

The Security component seems quite sensible and easily flags unusual requests as potential attack.

cakeDC users plugin gets blackholed with register

1 Answers