-
-
Notifications
You must be signed in to change notification settings - Fork 221
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
BUGFIX: Configurable uriPathSuffix in EventSourcedFrontendNodeRoutePa… #5189
base: 9.0
Are you sure you want to change the base?
Conversation
for the sake of completeness, we talked about this in the neos-general Slack channel https://neos-project.slack.com/archives/C050C8FEK/p1722245234573379 |
@@ -117,7 +117,7 @@ class NodeController extends ActionController | |||
* @Flow\SkipCsrfProtection We need to skip CSRF protection here because this action could be called | |||
* with unsafe requests from widgets or plugins that are rendered on the node | |||
* - For those the CSRF token is validated on the sub-request, so it is safe to be skipped here | |||
*/ | |||
*/ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
A fluke?
* - For those the CSRF token is validated on the sub-request, so it is safe to be skipped here | ||
* We need to skip CSRF protection here because this action could be called with unsafe requests from widgets or plugins that are rendered on the node - For those the CSRF token is validated on the sub-request, so it is safe to be skipped here | ||
* @Flow\SkipCsrfProtection | ||
* @Flow\IgnoreValidation("node") |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't understand why this should be needed – IIRC IngoreValidation
should be only needed for object arguments!? What happens if you omit this?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If I submit a form which redirects to a node (e.g. via Neos.Form or a Neos.Form:Builder rendered form) without this change, the request ends in a 404 and I get the error in the logs CSRF: token was empty but a valid token is required for Neos\Neos\Controller\Frontend\NodeController::showAction()
.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That should be solved by the SkipCsrfProtection, the IgnoreValidation is also necessary and gives you the same error otherwise?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, exactly @kitsunet. Without the IgnoreValidation
, I get the mentioned error.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
i wonder if the problem here is in any way possibly related to #4909 ? ill have to experiment with this myself
The core change (the uri path options thing) will be fixed with #5224. For the other changes we can keep this pr and its discussion open :) |
Only for Neos 9.
Author & Contributor @sjsone
With this PR it is possible to use a different uriPathSuffix than the one configured in
Neos.Neos.sitePresets
.The Routes.yaml config has to be "dynamic", e.g.
So
uriPattern: '{node}
instead ofuriPattern: '{node}.json'
.Checklist
FEATURE|TASK|BUGFIX
!!!
and have upgrade-instructions