| # |
Dec 29th 2019, 17:52 |
 birdy247 |
Really weird issue with a cake site |
| # |
Dec 29th 2019, 17:52 |
birdy247 |
Hi Guys |
| # |
Dec 29th 2019, 13:33 |
dereuromark |
@brandon https://github.com/dereuromark/CakePHP-DatabaseLog has some functionality to send emails after x min with an excerpt of fails. You dont want to send emails syncronous, and you dont want them all per single item, you might end up with millions of mails per hour^^ |
| # |
Dec 29th 2019, 09:54 |
challgren |
https://book.cakephp.org/3/en/core-libraries/form.html |
| # |
Dec 29th 2019, 09:52 |
challgren |
You can always create an entity without a table class |
| # |
Dec 29th 2019, 09:52 |
challgren |
Like for a modelless form? |
| # |
Dec 29th 2019, 09:48 |
jotpe |
Morning. Is it somehow possible to create a Table/Entities from array without any db connection? |
| # |
Dec 29th 2019, 08:30 |
dsar |
Yes, that is a better idea (or just use a logger) |
| # |
Dec 29th 2019, 03:42 |
brandon |
Alternatively, I was thinking of just having a custom error handler that emails the errors instead of displaying them to the admins. |
| # |
Dec 29th 2019, 03:42 |
slackebot |
just give out 404s instead of redirecting to login. Anyone have experience with this? |
| # |
Dec 29th 2019, 03:42 |
brandon |
I am having a bit of difficulty configuring custom error pages on 3.8. I want the error pages to be generic for end users but if the logged in user is an admin, I want the error to be more detailed so it can be reported, if needed. I learned that I need to add the AuthenticationMiddleware before the ErrorHandlingMiddleware so I could access authentication from the template. This, however, has a side effect - it causes unauthorized requests to |
| # |
Dec 28th 2019, 23:32 |
challgren |
Ok cool then its on cloudflare, I guess Im stuck til my dns clears |
| # |
Dec 28th 2019, 23:32 |
dsar |
104.18.56.26 |
| # |
Dec 28th 2019, 23:31 |
challgren |
Bah stupid DNS cache |
| # |
Dec 28th 2019, 23:30 |
challgren |
can anyone tell me what the ip address for truepedigree.com comes back as for them? |
| # |
Dec 28th 2019, 22:13 |
dsar |
I would make it optional for mission critical forms such as payment ones, for example 'extraSecurity' => true |
| # |
Dec 28th 2019, 22:12 |
dsar |
As markstory said, it is not easy to support this since we need a persistent place to store all the action urls for the hash later |
| # |
Dec 28th 2019, 22:07 |
admad |
Like I said you have 2 options: either implement your own form tampering mechanism or submit a patch to address the issue. |
| # |
Dec 28th 2019, 22:06 |
dsar |
Also I didn't want to compare, just to share an issue while porting an application |
| # |
Dec 28th 2019, 22:04 |
dsar |
I didn't mean that, however I don't think other are so naive |
| # |
Dec 28th 2019, 22:02 |
admad |
"X" doesn't do this so CakePHP shouldn't either isn't a very good argument |
| # |
Dec 28th 2019, 22:01 |
dsar |
However, I bumped into this problem while porting a Symfony application where a big complex form was splitted in multiple actions for multiple submits, also Symfony has form security stuff, but it doesn't include the url of the form in the hash (and neither Zend, but I don't use it since long time) |
| # |
Dec 28th 2019, 21:59 |
dsar |
Well, not many people are aware of new html5 features :) |
| # |
Dec 28th 2019, 21:58 |
admad |
and no one did anything about it for 2 years. Are you willing to submit a patch to address it? |
| # |
Dec 28th 2019, 21:57 |
dsar |
It is about the new formaction attribute |
| # |
Dec 28th 2019, 21:57 |
dsar |
The issue is already here: https://github.com/cakephp/cakephp/issues/11427 |
| # |
Dec 28th 2019, 21:57 |
admad |
or you can open an issue to see if making the inclusion of form url in the hash optional is acceptable and if so provide a patch to implement it |
| # |
Dec 28th 2019, 21:54 |
admad |
if a feature doesn't suit your needs supplant it with your own implementation. Just because you don't consider something a class of abuse doesn't mean other dont |
| # |
Dec 28th 2019, 21:52 |
dsar |
@admad I don't understand, a sort of provocation? |
| # |
Dec 28th 2019, 21:48 |
admad |
so implement your own form tampering prevention :) |
| # |
Dec 28th 2019, 21:48 |
dsar |
https://www.w3schools.com/tags/att_button_formaction.asp |
| # |
Dec 28th 2019, 21:47 |
dsar |
Plus, this kind of prevention limits the use of the new formaction attribute of html5 |
| # |
Dec 28th 2019, 21:47 |
dsar |
I don't consider this a "class of abuse" but a very uncommon kind of attack |
| # |
Dec 28th 2019, 21:44 |
challgren |
if its the same controller with different prefixes |
| # |
Dec 28th 2019, 21:44 |
challgren |
And 99% of the time they will |
| # |
Dec 28th 2019, 21:44 |
dsar |
Those two forms must have the same fields to work |
| # |
Dec 28th 2019, 21:43 |
challgren |
Someone changing the action url to submit the form elsewhere. Aka /entity/edit to /admin/entity/edit |
| # |
Dec 28th 2019, 21:34 |
dsar |
@admad I see, however hashing form fields is an already strong fingerprint, what class of abuses this countermeasure does prevent? |
| # |
Dec 28th 2019, 21:24 |
admad |
@dsar https://github.com/cakephp/cakephp/commit/f23d811ff59c50ef278e98bb75f4ec1e7e54a5b3 |
| # |
Dec 28th 2019, 19:48 |
dsar |
Other frameworks also have security related measure against form tampering, but cakephp is the only one that took this in consideration (and it is rather limiting both ajax and the new formaction attribute for submit buttons) |
| # |
Dec 28th 2019, 19:46 |
dsar |
Could someone explain me why the action url is included in the hash generated by the FormProtection component? |