0

在问这个问题之前,我已经阅读了其他 cakeDC 用户插件问题。

我已将 cakeDC 用户插件添加到 cakePHP 2.2.3 的全新安装中。起初我确实遇到了路由问题,但是通过将用户插件路由移动到配置路由,我能够获得我期望的路由。

因此,在移动路由之后,我让 users/register 开始工作,而不是 users/users/register。

我现在遇到的问题是注册。配置电子邮件并且我能够提交注册表单后,我收到以下错误:

错误:在此服务器上找不到请求的地址“/cakeDC/users/add”。

这是“注册”被路由到的“添加”操作:

public function add() {
    if ($this->Auth->user()) {
        $this->Session->setFlash(__d('users', 'You are already registered and logged in!'));
        $this->redirect('/');
    }

    if (!empty($this->request->data)) {
        $user = $this->User->register($this->request->data);
        if ($user !== false) {
            $this->_sendVerificationEmail($this->User->data);
            $this->Session->setFlash(__d('users', 'Your account has been created. You should receive an e-mail shortly to authenticate your account. Once validated you will be able to login.'));
            $this->redirect(array('action' => 'login'));
        } else {
            unset($this->request->data[$this->modelClass]['password']);
            unset($this->request->data[$this->modelClass]['temppassword']);
            $this->Session->setFlash(__d('users', 'Your account could not be created. Please, try again.'), 'default', array('class' => 'message warning'));
        }
    }
}

这是表格:

<div class="users form">
    <h2><?php echo __d('users', 'Add User'); ?></h2>
    <fieldset>
        <?php
            echo $this->Form->create($model);
            echo $this->Form->input('username', array(
                'label' => __d('users', 'Username')));
            echo $this->Form->input('email', array(
                'label' => __d('users', 'E-mail (used as login)'),
                'error' => array('isValid' => __d('users', 'Must be a valid email address'),
                'isUnique' => __d('users', 'An account with that email already exists'))));
            echo $this->Form->input('password', array(
                'label' => __d('users', 'Password'),
                'type' => 'password'));
            echo $this->Form->input('temppassword', array(
                'label' => __d('users', 'Password (confirm)'),
                'type' => 'password'));
            $tosLink = $this->Html->link(__d('users', 'Terms of Service'), array('controller' => 'pages', 'action' => 'tos'));
            echo $this->Form->input('tos', array(
                'label' => __d('users', 'I have read and agreed to ') . $tosLink));
            echo $this->Form->end(__d('users', 'Submit'));
        ?>
    </fieldset>
</div>

这是堆栈跟踪中的信息:

CORE\Cake\Controller\Component\SecurityComponent.php 第 232 行

    }
    if ($isPost && $isNotRequestAction && $this->csrfCheck) {
        if ($this->_validateCsrf($controller) === false) {
            return $this->blackHole($controller, 'csrf');
        }

SecurityComponent->blackHole(UsersController, 字符串)

object(UsersController) {
    name => 'Users'
    helpers => array(
        [maximum depth reached]
    )
    components => array(
        [maximum depth reached]
    )
    presetVars => array(
        [maximum depth reached]
    )
    uses => array(
        [maximum depth reached]
    )
    request => object(CakeRequest) {}
    response => object(CakeResponse) {}
    viewPath => 'Users'
    layoutPath => null
    viewVars => array(
        [maximum depth reached]
    )
    view => 'add'
    layout => 'default'
    autoRender => true
    autoLayout => true
    Components => object(ComponentCollection) {}
    viewClass => 'View'
    View => null
    ext => '.ctp'
    plugin => 'Users'
    cacheAction => false
    passedArgs => array([maximum depth reached])
    scaffold => false
    methods => array(
        [maximum depth reached]
    )
    modelClass => 'User'
    modelKey => 'user'
    validationErrors => null
    Session => object(SessionComponent) {}
    Auth => object(AuthComponent) {}
    Cookie => object(CookieComponent) {}
    Paginator => object(PaginatorComponent) {}
    Security => object(SecurityComponent) {}
    Prg => object(PrgComponent) {}
}
'csrf'

我知道这个插件应该开箱即用,但我看不出有任何明显的理由不处理注册表和黑洞。

4

1 回答 1

2

安全组件将其视为 CRSF 攻击。请确保:

  1. 您没有重新加载表单(重新发送数据)
  2. 正在正确创建表单。我建议使用插件提供的基本形式进行测试。
  3. 它没有使用 AJAX。它适用于 AJAX,但我认为您需要设置一些东西。
  4. 您的浏览器正在正确发送所有标题。也许您有一个用于调试的插件,它正在篡改请求,从而创建 CRSF 攻击

安全组件似乎非常明智,并且很容易将异常请求标记为潜在攻击。

于 2013-02-22T11:36:07.333 回答