• Do not register here on develop.twiki.org, login with your twiki.org account.
• Use View topic Item7848 for generic doc work for TWiki-6.1.1. Use View topic Item7851 for doc work on extensions that are not part of a release. More... Close
• Anything you create or change in standard webs (Main, TWiki, Sandbox etc) will be automatically reverted on every SVN update.
Does this site look broken?. Use the LitterTray web for test cases.

Item6270: REST upload requires http POST method error in upload via paperclip icon in TinyMCEPlugin

Item Form Data

AppliesTo: Component: Priority: CurrentState: WaitingFor: TargetRelease ReleasedIn
Engine   Urgent Closed   patch  

Edit Form Data

Summary:
Reported By:
Codebase:
Applies To:
Component:
Priority:
Current State:
Waiting For:
Target Release:
Released In:
 

Detail

When using TinyMCE and trying to use the paperclip icon to add an attachment I still get the error REST upload requires http POST method. -- Reported by TWiki:Main.AJAlfieriCrispin in Item6251.

This is a bug introduce by security fix Item6251, CSRF vulnerability CVE-2009-1339.

-- TWiki:Main/PeterThoeny - 01 Jun 2009

Invested some time on this -

 my $query = TWiki::Func::getCgiQuery();

The $query gets value <method />

we are passing method post through the form written at

/pub/TWiki/TinyMCEPlugin/tinymce/jscripts/tiny_mce/plugins/twikibuttons/attach.htm

point is - resthandler is not passing exact cgi-query

-- TWiki:Main.SopanShewale - 02 Jun 2009

wrong method name on cgi object, fixed the issue

-- TWiki:Main.SopanShewale - 03 Jun 2009

Will there be a patch for this, or is there something simple I can edit to fix? Thanks!

-- TWiki:Main.AJAlfieriCrispin - 08 Jun 2009

Here we go:

Modified: twiki/branches/TWikiRelease04x03/twikiplugins/WysiwygPlugin/lib/TWiki/Plugins/WysiwygPlugin.pm
===================================================================
--- twiki/branches/TWikiRelease04x03/twikiplugins/WysiwygPlugin/lib/TWiki/Plugins/WysiwygPlugin.pm   2009-05-20 16:51:04 UTC (rev 18082)
+++ twiki/branches/TWikiRelease04x03/twikiplugins/WysiwygPlugin/lib/TWiki/Plugins/WysiwygPlugin.pm   2009-06-03 13:05:18 UTC (rev 18083)
@@ -744,7 +744,7 @@
    my ($session, $plugin, $verb, $response) = @_;
    my $query = TWiki::Func::getCgiQuery();

-    if( $query && $query->method() !~ /^POST$/i ) { 
+    if( $query && $query->request_method() !~ /^POST$/i ) { 
        returnRESTResult( $response, 405, 'REST upload requires http POST method' ); 
        return undef; 
    }

(thanks Sopan)

-- TWiki:Main.PeterThoeny - 08 Jun 2009

Thanks kindly to you both!

-- TWiki:Main.AJAlfieriCrispin - 10 Jun 2009

Closing this one

-- TWiki::Main.SopanShewale - 12 Oct 2009

ItemTemplate
Summary REST upload requires http POST method error in upload via paperclip icon in TinyMCEPlugin
ReportedBy TWiki:Main.PeterThoeny
Codebase 4.3.1
SVN Range TWiki-5.0.0, Sat, 18 Apr 2009, build 18024
AppliesTo Engine
Component

Priority Urgent
CurrentState Closed
WaitingFor

Checkins TWikirev:18083 TWikirev:18084
TargetRelease patch
ReleasedIn

Edit | Attach | Watch | Print version | History: r11 < r10 < r9 < r8 < r7 | Backlinks | Raw View | Raw edit | More topic actions
Topic revision: r11 - 2009-10-12 - SopanShewale
 
This site is powered by the TWiki collaboration platform Powered by PerlCopyright © 2008-2019 by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
Ideas, requests, problems regarding TWiki? Send feedback