Log in with username/password: lyceum/lyceum

Ticket #379 (closed defect: fixed)

Opened 2 years ago

Last modified 1 year ago

page edit tokens

Reported by: jjb Assigned to: jjb
Priority: highest Milestone: 0.34
Keywords: stumped Cc: michael@bodybuilding.com, mark@garbers.co.uk

Description

if a post is edited, and then "save and continue editing" is clicked, then after the the token for "save" will be invalid.

Change History

04/19/06 23:04:31 changed by jjb

  • status changed from new to closed.
  • resolution set to fixed.

09/05/06 23:26:36 changed by ageller

i just experienced this problem running .33 in firefox. i pushed publish and got the error.

09/06/06 06:56:19 changed by ageller

  • status changed from closed to reopened.
  • resolution deleted.

09/06/06 06:56:33 changed by ageller

  • milestone changed from 0.30 to 0.34.

09/26/06 04:27:45 changed by jjb

i can't reproduce this. adam- can you tell us step-by-step how to reproduce?

09/29/06 00:21:05 changed by ageller

  • priority changed from high to highest.

edit edit edit.

click "save and continue." bam. get error message.

SO, not only did tonight this happen again to me, but when I clicked the "reload" link, it didn't work. then i tried again, no luck. finally i hit the refresh button on my browser.

it refreshed to the post.php screen. there were three copies of my post in draft version somehow. the problem is that all three of them had been corrupted and i lost all my work!

this is MAJOR MAJOR MAJOR bad. not to mention, I am MAJOR MAJOR MAJOR mad.

09/29/06 00:42:25 changed by ageller

i tried logging out and back in. that didn't solve the problem

i just published the post that was in triplicate draft form. all versions of the draft went away.

11/07/06 00:57:58 changed by jjb

  • cc set to michael@bodybuilding.com.

Michael Bahnmiller says:

I have narrowed it down a little:

  • Possible Actions: post, edit, editpost, default
  • Possible Scripts: post.php, wp-comments-post.php
  • Scenarios:
    1. the $_SESSION token variable is unset when validate is called
    2. the $_SESSION token variable is created but not present when checking

(it must be unset *somehow*)

11/15/06 15:08:55 changed by jjb

  • keywords set to stumped.

11/24/06 23:07:55 changed by jjb

update: ageller has confirmed that this bug is not repeatable with a particular series of actions. it happens seemingly randomly. the search for a repeatable pattern continues...

12/01/06 22:02:46 changed by jjb

mark says:

Ok, looks like I've found the problem.

Line 67 of the wp-admin/post.php file reads like so: validateToken($_REQUESTtoken?, 'post.php', 'edit', (int)$_REQUESTpost?);

However, if you add a 'true' argument to the function call, like this: validateToken($_REQUESTtoken?, 'post.php', 'edit', (int)$_REQUESTpost?, true);

it seems to resolve the bug. In effect, all it does is preserve the $_SESSION variables for the tokens. They were getting removed and causing the problem.

Now, I'm not quite sure what effect this has on security, but from what I can tell, it doesn't seem to have a negative effect.

(follow-up: ↓ 14 ) 12/01/06 22:07:35 changed by jjb

mark figured out how to reproduce the bug!

  1. Start writing a new post.
  2. Click 'save and continue editing'.
  3. when the page has reloaded, click 'save and continue editing' again.
  4. once the page has reloaded again, click 'Publish'.

(in reply to: ↑ 13 ; follow-up: ↓ 15 ) 12/02/06 15:14:49 changed by lyceum

from adam:

I agree. This crashes my installation.

To note, will crash if pushed any number of times greater than once.

(in reply to: ↑ 14 ) 12/04/06 15:39:49 changed by jjb

Replying to lyceum:

To note, will crash if pushed any number of times greater than once.

Do you mean that step 3 is unnecessary? The more minimal the steps-to-reproduce, the better. Mark can you verify if step 3 is necessary on your installation?

12/04/06 15:42:22 changed by jjb

  • cc changed from michael@bodybuilding.com to michael@bodybuilding.com, mark@garbers.co.uk.

12/04/06 17:08:06 changed by ageller

Sorry I was unclear.

I meant that it also happens if I repeat step three. So, if the button is pushed 2 times, it crashes. If the button is pushed 5 times it happens.

12/28/06 02:58:13 changed by jjb

  • status changed from reopened to closed.
  • resolution set to fixed.

08/12/07 15:20:34 changed by jjb

It's back... see #729

Log in with username/password: lyceum/lyceum