2013-01-19 53 views
0

在問這個問題之前,我已經通讀了其他的cakeDC用戶插件問題。cakeDC用戶插件獲取寄存器的黑名單

我已將cakeDC用戶插件添加到cakePHP 2.2.3的全新安裝中。起初我確實有路由問題,但通過將用戶插件路由移動到配置路由,我能夠獲得我期望的路由。

所以,而不是用戶/用戶/註冊,移動路由後,我有用戶/註冊工作。

我現在遇到的問題是使用註冊表。一旦電子郵件配置完成,我可以提交註冊表格,我收到以下錯誤:

錯誤:在此服務器上找不到請求的地址'/ cakeDC/users/add'。

這裏是 '添加' 行動 '註冊' 被路由到:

public function add() { 
    if ($this->Auth->user()) { 
     $this->Session->setFlash(__d('users', 'You are already registered and logged in!')); 
     $this->redirect('/'); 
    } 

    if (!empty($this->request->data)) { 
     $user = $this->User->register($this->request->data); 
     if ($user !== false) { 
      $this->_sendVerificationEmail($this->User->data); 
      $this->Session->setFlash(__d('users', 'Your account has been created. You should receive an e-mail shortly to authenticate your account. Once validated you will be able to login.')); 
      $this->redirect(array('action' => 'login')); 
     } else { 
      unset($this->request->data[$this->modelClass]['password']); 
      unset($this->request->data[$this->modelClass]['temppassword']); 
      $this->Session->setFlash(__d('users', 'Your account could not be created. Please, try again.'), 'default', array('class' => 'message warning')); 
     } 
    } 
} 

這裏的形式:

<div class="users form"> 
    <h2><?php echo __d('users', 'Add User'); ?></h2> 
    <fieldset> 
     <?php 
      echo $this->Form->create($model); 
      echo $this->Form->input('username', array(
       'label' => __d('users', 'Username'))); 
      echo $this->Form->input('email', array(
       'label' => __d('users', 'E-mail (used as login)'), 
       'error' => array('isValid' => __d('users', 'Must be a valid email address'), 
       'isUnique' => __d('users', 'An account with that email already exists')))); 
      echo $this->Form->input('password', array(
       'label' => __d('users', 'Password'), 
       'type' => 'password')); 
      echo $this->Form->input('temppassword', array(
       'label' => __d('users', 'Password (confirm)'), 
       'type' => 'password')); 
      $tosLink = $this->Html->link(__d('users', 'Terms of Service'), array('controller' => 'pages', 'action' => 'tos')); 
      echo $this->Form->input('tos', array(
       'label' => __d('users', 'I have read and agreed to ') . $tosLink)); 
      echo $this->Form->end(__d('users', 'Submit')); 
     ?> 
    </fieldset> 
</div> 

這裏是在堆棧跟蹤信息:

CORE \ Cake \ Controller \ Component \ SecurityComponent.php line 232

} 
    if ($isPost && $isNotRequestAction && $this->csrfCheck) { 
     if ($this->_validateCsrf($controller) === false) { 
      return $this->blackHole($controller, 'csrf'); 
     } 

SecurityComponent->黑洞(UsersController,字符串)

object(UsersController) { 
    name => 'Users' 
    helpers => array(
     [maximum depth reached] 
    ) 
    components => array(
     [maximum depth reached] 
    ) 
    presetVars => array(
     [maximum depth reached] 
    ) 
    uses => array(
     [maximum depth reached] 
    ) 
    request => object(CakeRequest) {} 
    response => object(CakeResponse) {} 
    viewPath => 'Users' 
    layoutPath => null 
    viewVars => array(
     [maximum depth reached] 
    ) 
    view => 'add' 
    layout => 'default' 
    autoRender => true 
    autoLayout => true 
    Components => object(ComponentCollection) {} 
    viewClass => 'View' 
    View => null 
    ext => '.ctp' 
    plugin => 'Users' 
    cacheAction => false 
    passedArgs => array([maximum depth reached]) 
    scaffold => false 
    methods => array(
     [maximum depth reached] 
    ) 
    modelClass => 'User' 
    modelKey => 'user' 
    validationErrors => null 
    Session => object(SessionComponent) {} 
    Auth => object(AuthComponent) {} 
    Cookie => object(CookieComponent) {} 
    Paginator => object(PaginatorComponent) {} 
    Security => object(SecurityComponent) {} 
    Prg => object(PrgComponent) {} 
} 
'csrf' 

我明白這個插件應該開箱的,但我沒有看到不處理登記表和黑洞任何明顯的理由。

回答

1

安全組件正在將其視爲CRSF攻擊。可以肯定的是:

  1. 你是不是重裝形式(重發數據)
  2. 被正確創建的形式。我建議使用插件提供的基本形式進行測試。
  3. 它不使用AJAX。它適用於AJAX,但我認爲你需要設置一些東西。
  4. 您的瀏覽器正在發送所有標題。也許你有一個調試插件是篡改請求,因此創建CRSF攻擊

安全組件看起來非常明智,並且容易將不尋常的請求標記爲潛在的攻擊。