Welcome Guest, Not a member yet? Register   Sign In
Server config causing CSRF triggers
#12

(This post was last modified: 09-06-2017, 07:04 AM by objecttothis.)

OK, here is an example of a place where CSRF returns a 403 (when CSRF is disabled I get 200).  I can't figure out what in the code is causing CSRF to not like it.

view form.php
PHP Code:
<?php echo form_open($controller_name '/save/' $person_info->person_id, array('id'=>'customer_form''class'=>'form-horizontal')); ?>
.
.
.
<?php echo form_close(); ?>

<script type="text/javascript">
.
.
.
    var csrf_token = function() {
        return Cookies.get('<?php echo $this->config->item('csrf_cookie_name'); ?>');
    };

    var csrf_form_base = function() {
        return { <?php echo $this->security->get_csrf_token_name(); ?> : function () { return csrf_token();  } };
    };
.
.
.
//validation and submit handling
$(document).ready(function()
{
 $('#customer_form').validate($.extend({
 submitHandler: function(form)
 {
 $(form).ajaxSubmit({
 success: function(response)
 {
 dialog_support.hide();
 table_support.handle_submit('<?php echo site_url($controller_name); ?>', response);
 },
 dataType: 'json'
 });
 },

 rules:
 {
 first_name: "required",
 last_name: "required",
     email:
 {
 remote:
 {
 url: "<?php echo site_url($controller_name '/ajax_check_email')?>",
 type: "post",
 data: $.extend(csrf_form_base(),
 {
 "person_id" : "<?php echo $person_info->person_id?>",
 // email is posted by default
 })
 }
 },
     account_number:
 {
 remote:
 {
 url: "<?php echo site_url($controller_name '/ajax_check_account_number')?>",
 type: "post",
 data: $.extend(csrf_form_base(),
 {
 "person_id" : "<?php echo $person_info->person_id?>"
 // account_number is posted by default
 })
 }
 }
   },

 messages: 
 {
     first_name: "<?php echo $this->lang->line('common_first_name_required'); ?>",
     last_name: "<?php echo $this->lang->line('common_last_name_required'); ?>",
     email: "<?php echo $this->lang->line('customers_email_duplicate'); ?>",
 account_number: "<?php echo $this->lang->line('customers_account_number_duplicate'); ?>"
 }
 }, form_support.error));
});

$("input[name='sales_tax_code_name']").change(function() {
    if( ! $("input[name='sales_tax_code_name']").val() ) {
        $("input[name='sales_tax_code']").val('');
    }
});

var fill_value = function(event, ui) {
    event.preventDefault();
    $("input[name='sales_tax_code']").val(ui.item.value);
    $("input[name='sales_tax_code_name']").val(ui.item.label);
};

$("#sales_tax_code_name").autocomplete({
    source: '<?php echo site_url("taxes/suggest_sales_tax_codes"); ?>',
    minChars: 0,
    delay: 15,
    cacheLength: 1,
    appendTo: '.modal-content',
    select: fill_value,
    focus: fill_value
});

</script> 

controller Customers.php
PHP Code:
/*
 AJAX call to verify if an email address already exists
 */
 
public function ajax_check_email()
 {
 
$exists $this->Customer->check_email_exists(strtolower($this->input->post('email')), $this->input->post('person_id'));

 echo !
$exists 'true' 'false';
 } 

model Customer.php

PHP Code:
/*
 Checks if customer email exists
 */
 
public function check_email_exists($email$customer_id '')
 {
 
// if the email is empty return like it is not existing
 
if(empty($email))
 {
 return 
FALSE;
 }

 
$this->db->from('customers');
 
$this->db->join('people''people.person_id = customers.person_id');
 
$this->db->where('people.email'$email);
 
$this->db->where('customers.deleted'0);

 if(!empty(
$customer_id))
 {
 
$this->db->where('customers.person_id !='$customer_id);
 }

 return (
$this->db->get()->num_rows() == 1);
 } 

config.php
PHP Code:
$config['global_xss_filtering'] = FALSE;

$config['csrf_protection'] = TRUE;
$config['csrf_token_name'] = 'csrf_ospos_v3';
$config['csrf_cookie_name'] = 'csrf_cookie_ospos_v3';
$config['csrf_expire'] = 7200;
$config['csrf_regenerate'] = TRUE;
$config['csrf_exclude_uris'] = array(); 
Reply


Messages In This Thread
RE: Server config causing CSRF triggers - by objecttothis - 09-06-2017, 06:13 AM
SOLUTION - by objecttothis - 09-07-2017, 04:16 AM



Theme © iAndrew 2016 - Forum software by © MyBB