CakePHP 2.1: Using CSRF protection on Elements - security

I have a somewhat special situation with one of my CommentsController actions, the "add" action.
Since I have an "Add Comment" form on my "view" View of PostsController, I have an "add_comment" Element instead of an "add" View for the Comments. This is that I can just insert the Element with the form inside the "view" View of Posts. I hope this does not sound too complicated.
Now, inside the "add_comment" Element, the form gets submitted to the actual "add" action of CommentsController. If the form has to be rendered again, because of invalid user input for exaxmple, the form gets rendered again by - this time - calling the "add" View of Comments. This "add" View only again includes the "add_comment" Element, which - as was said above - includes the actual form.
Now the thing is, I added the Security component to my CommentsController in order to get CSRF protection. All my admin actions of CommentsController get the protection i.e. e token is rendered inside the form and checked upon submitting the form.
Still, the add_comments Element form does NOT get a token. Probably because it is an Element and not the corresponding View.
How can I manually insert a token into the Element's form or how do I better solve this?
Thank you
EDIT: Se also my other question regarding the setup - it should explain it a little
EDIT2: This is what's inside my add_comment Element
EDIT3: This is the HTML output of the add_comment element. The nonce should be in the <div style="display:none;"> part.
EDIT4: I put Debugger::log($this->Form->request->params); inside the element (add_comment.ctp) and the view (add.ctp) and this shows the output.
I also uploaded the the whole CommentsController (here). Please note that I specified a blackhole function to catch errors of type 'auth'. This is because, every time I entered invalid data in the add_comments.ctp Element and - by submitting the form - the actual add Action of CommentsController was invoked (and thus the add View of comments), I got a blackhole error of type 'auth', which I could not explain so I caught it with this way - this might even be related to my problems.

Related

Kentico V9 Confirm form submission with javascript history.back

My repeater has enough data where I see my pagination. When I view the detail transformation for any items after the first page, the history.back() button gives me the form submission error.
Short of hard coding the back button, what's the easiest solution to avoid this?
I assume the "history.back()" is your javascript? The pagination is most likely occurring through postback, and any navigation back will require that same post data being sent.
One option is you can make the pagination not postback, but instead URL based. In the "Paging" area of your repeater, set the Mode to "QueryString" and set a querystring key (like "page"). Try that!
Otherwise you will need to do a window.location = "/The/Previous/Url" so it won't event attempt a postback and will simply direct them to the page, but your page you were last on will be lost.
Wrap the webpart in an update panel. In the webpart you can check the box to do this very easy and leave the rest of your configurations the way they are. If other elements on the page require a postback or rely on that webparts values then you may have to wrap all of them in an update panel.

Form does not postback when submit is clicked, jade, node.js

I have a form created with jade, it does not postback when submit button is clicked.
I have looked at many similar problems, I tried the solutions, which include ensuring that the input fields all have a 'name', I have made sure all the input field have a name but the form still does not post back, here it is
//views/users/new.jade
h1 New User
form(action="/users", method="POST")
p
label(for="username") Username
input#username(name="username")
p
label(for="name") Name
input#name(name="name")
p
label(for="bio") Bio
textarea#bio(name="bio")
p
input(type="submit",value="Create")
The post handler is this
//routes/users
module.exports=function(app){
app.post('/users',function(req,res){
if(users[req.body.username]){ //Check if user exists
res.send('Confllict, 409')
}else
{
//add to users list
users[req.body.username]=req.body;
res.redirect('/users');
}
});
};
Jade uses indention to show what content goes between the tags
p
this is inside the p tags
also there is shorthand
p this is also in the tag
in your original code you are telling Jade that there is a p tag then the next line is outside the p tags.
This is an easy problem to run into if you aren't careful with indentation using Pug (previously Jade). I realize this is an old question, and it has several hits so perhaps this answer will shed some light for new Pug users.
The problem with the OP's code is the Form does not know how to post without a button, and the Submit button doesn't know where to post to without being associated with the Form. Why? Indentation.
Jade and Pug tips for success:
They produce html, so it helps to think in html layouts when developing the template (would you put text outside of your p element? Of course not).
Pug uses indentation to form layout and element hierarchy.
Html Forms must enclose the elements that are to be associated or bound to it.
A Submit Button does nothing unless you define an event handler.
Forms define a destination in their definition, which a button type element can leverage.
In the code listed by the OP, every Pug element is left-aligned. This puts all elements at the same level, so there is no hierarchy or nesting. Since there is no other event handler explicitly defined for the Submit button, nothing happens when it is clicked, despite the form having an action and a valid method.
To fix this, the Input (submit button) can be nested inside the Form.
Reworking the code to include indented hierarchy will enable the POST to function as expected (removed all the other elements for readability):
h1 New User
form(action="/users", method="POST")
label(for="username") Username
input#username(name="username")
label(for="name") Name
input#name(name="name")
label(for="bio") Bio
textarea#bio(name="bio")
input(type="submit",value="Create")
The resulting form won't be a pretty, but it will function:
The Form has an action and method.
All dependent elements are indented.
The input has a type of Submit and is child to the form.
Of course, a server must have a binding at the address to receive the data in order to do anything with it.

JSF-Calling BackingBean method twice maintaining value of inputFileUpload

I am very new to JSF. I have the following requirement:
On click of a commandButton, call a backing bean method to check if there is some data present satisfying the condition.
If yes, confirm from user for overwrite.
If user says OK, call the same method of backing bean with some parameters set to tell the program to overwrite the data.
What I am doing is:
having action of the commandButton as the method name.
in the backing bean method, check if we have come with certain condition, check if the data is already present.
If yes, go back to page and ask for confirmation.
If confirmed, call the click method of the button.
The problem is, when I come back to the page, the inputFileUpload component on the page loses its value.
What can I do to achieve this? Please help.
This is fully by HTML specification and completely outside control of JSF. It's by HTML specification for security reasons not possible to (re)display the value of a HTML input file field with a value coming from the server side. Otherwise a hazard scenario as shown in this answer would be possible.
You need to redesign the form in such way that the input file field is not been updated during confirmation. You can use among others JavaScript/ajax for this: just submit the form by ajax and make sure that the input file field is not been updated on ajax response.

Using standard validation for read only edit boxes?

Some of my recent posts have to do with the fact that I am doing all of my validation in my Submit button.
The reason I am doing this is that I have a button that sets some read only edit boxes. Well you can configure a validation for a read only edit box but it does not execute at run time.
Since I could not figure this out and wanted to have a consistent look for validation I used my own validation on my Submit button.
Is there a way to validate read only fields?
One nice thing about putting all of the code in the Submit button is that all of the validation code is all in the same place but I can see where it also can cause portability issues when using custom controls.
Also another question is how to fire off validation if my Submit button is not marked as a Submit button.
As Dec says, the ReadOnly flag causes the content of the field to be rendered without the <input> tag. This makes validation impossible on the client side and since there is no data being submitted back to the JVM, validation coded on the field is ignored on the submit.
However, the data source QuerySaveDocument is triggered. Put your validation in there and/or put it in the fields that are rendered (readOnly=false) and be sure to set disableClientSideValidation="true" on all fields with validators on them.
Your QuerySaveDocument code looks something like this (assuming location is the field which is readOnly).
if (personDoc.getItemValueString("Location") == "") {
#ErrorMessage("The inherited location is blank and that is bad.");
return false;
}
return true;
With this, the field based validators will fire first and if they are all successful the QuerySaveDocument fires. This means if any field based validators fail, their messages will appear in your message area but the QuerySaveDocument message will not appear. QuerySaveDocument messages ONLY appear after all field based validators succeed.
When a read only field is rendered to the web browser it does not render using <input> tags but rather a simple <span> tag.
Validation can only be performed on proper input tags so the scenario you are experiencing is correct. There is no field for it to validate in read-only mode.
There is an option to 'display disabled in read only' which will render an <input disabled="true"> type tag for the field but I'm not sure off the top of my head is validation will work for those fields either because if a field is read-only then there really should be no need for any validation because your programmatically putting the value into the field and you should be validating it programmatically before you add the value.

XPages disableOutput tag issue

Has anyone experienced an issue with disableOutputTag property where if you disable output tag for a computed field control inside a repeat control and have ssjs computed content inside that tag, it won't compute the content? Is disableOutputtag property only meant to work with static content inside a repeat control or is it a bug?
I don't know whether its a bug or not, but you can emulate the behavior of disableOutputTag by removing the ID attribute from and setting the disableTheme attribute to true. Maybe this helps you in short term.
EDIT: You can refer here for more information.
Not only does this happen when placing the xp:Text control inside a repeat but in also when you create a new XPage, add a xp:text onto it and define its value like:
<xp:text value="This is a test" disableOutputTag="true"/>
In the above example the xp:text will disappear. This is not what you would have expected. I would expect that only the value would be visible on the rendered page. But I think I can explain why this happens. Since there are no tags defined (disableoutputtag) somewhere in the rendered of this component it states that it should not generate anything. Because it can not bind its id to 'nothing' and so on.
Anyway, I could not think of a scenario where I would like to render plain text without any surrounding tags. It should at least be surrounded by a span or paragraph (<p>) tag so you can style it. And an ID would be nice so I can change the contents with a partial refresh.

Resources