cakeDC用户插件获取与寄存器经过黑洞(cakeDC users plugin gets blac

2019-11-01 11:04发布

我已经通过之前问这个问题,其他用户cakeDC插件问题阅读。

我已经添加了cakeDC用户插件到一个干净的安装CakePHP的2.2.3。 我也有路由问题在第一,但通过移动用户插件路由到配置路由我能得到我预期的路由。

因此,而不是用户/用户/注册,移动路由后,我得到了用户/注册工作。

我现在遇到的问题是与寄存器。 一旦电子邮件已配置,我可以提交报名表,我得到以下错误:

错误:请求的地址“/ cakeDC /用户/添加”在此服务器上找到。

这里是“添加”动作“注册”被路由到:

public function add() {
    if ($this->Auth->user()) {
        $this->Session->setFlash(__d('users', 'You are already registered and logged in!'));
        $this->redirect('/');
    }

    if (!empty($this->request->data)) {
        $user = $this->User->register($this->request->data);
        if ($user !== false) {
            $this->_sendVerificationEmail($this->User->data);
            $this->Session->setFlash(__d('users', 'Your account has been created. You should receive an e-mail shortly to authenticate your account. Once validated you will be able to login.'));
            $this->redirect(array('action' => 'login'));
        } else {
            unset($this->request->data[$this->modelClass]['password']);
            unset($this->request->data[$this->modelClass]['temppassword']);
            $this->Session->setFlash(__d('users', 'Your account could not be created. Please, try again.'), 'default', array('class' => 'message warning'));
        }
    }
}

这里的表格:

<div class="users form">
    <h2><?php echo __d('users', 'Add User'); ?></h2>
    <fieldset>
        <?php
            echo $this->Form->create($model);
            echo $this->Form->input('username', array(
                'label' => __d('users', 'Username')));
            echo $this->Form->input('email', array(
                'label' => __d('users', 'E-mail (used as login)'),
                'error' => array('isValid' => __d('users', 'Must be a valid email address'),
                'isUnique' => __d('users', 'An account with that email already exists'))));
            echo $this->Form->input('password', array(
                'label' => __d('users', 'Password'),
                'type' => 'password'));
            echo $this->Form->input('temppassword', array(
                'label' => __d('users', 'Password (confirm)'),
                'type' => 'password'));
            $tosLink = $this->Html->link(__d('users', 'Terms of Service'), array('controller' => 'pages', 'action' => 'tos'));
            echo $this->Form->input('tos', array(
                'label' => __d('users', 'I have read and agreed to ') . $tosLink));
            echo $this->Form->end(__d('users', 'Submit'));
        ?>
    </fieldset>
</div>

这是在堆栈跟踪信息:

CORE \蛋糕\控制器\元器件\ SecurityComponent.php线232

    }
    if ($isPost && $isNotRequestAction && $this->csrfCheck) {
        if ($this->_validateCsrf($controller) === false) {
            return $this->blackHole($controller, 'csrf');
        }

SecurityComponent->黑洞(UsersController,字符串)

object(UsersController) {
    name => 'Users'
    helpers => array(
        [maximum depth reached]
    )
    components => array(
        [maximum depth reached]
    )
    presetVars => array(
        [maximum depth reached]
    )
    uses => array(
        [maximum depth reached]
    )
    request => object(CakeRequest) {}
    response => object(CakeResponse) {}
    viewPath => 'Users'
    layoutPath => null
    viewVars => array(
        [maximum depth reached]
    )
    view => 'add'
    layout => 'default'
    autoRender => true
    autoLayout => true
    Components => object(ComponentCollection) {}
    viewClass => 'View'
    View => null
    ext => '.ctp'
    plugin => 'Users'
    cacheAction => false
    passedArgs => array([maximum depth reached])
    scaffold => false
    methods => array(
        [maximum depth reached]
    )
    modelClass => 'User'
    modelKey => 'user'
    validationErrors => null
    Session => object(SessionComponent) {}
    Auth => object(AuthComponent) {}
    Cookie => object(CookieComponent) {}
    Paginator => object(PaginatorComponent) {}
    Security => object(SecurityComponent) {}
    Prg => object(PrgComponent) {}
}
'csrf'

我明白这个插件应该开箱的,但我没有看到不处理登记表和黑洞任何明显的原因。

Answer 1:

安全组件正在考虑一个CRSF攻击。 可以肯定的是:

  1. 你是不是重装形式(重发数据)
  2. 正在创建正确的形式。 我建议用基本形式的插件提供的测试。
  3. 它不使用AJAX。 它的工作原理与AJAX,但我认为你需要设置一些东西。
  4. 您的浏览器正常发送所有的头。 也许你有一个调试插件,被篡改的请求,从而创造一个CRSF攻击

安全组件看起来非常明智,轻松地标志不寻常的要求作为潜在的攻击。



文章来源: cakeDC users plugin gets blackholed with register