/import request black-holed

[MightyCreak]

Hi!

I just reinstalled Sonerezh from scratch, it was working before (on @gs11's fork), but I get an error now when I want to import my albums (I tried with only one album, I get the same result).

I can access the /import page, but when I click on Update, I get a HTTP 400 answer.
Looking at the request's answer, I get an HTML text which basically can be summed up to:

The request has been black-holed
The requested address '/import' was not found on this server.

I'm on Debian 8, with nginx 1.10.3, PHP 5.6.36, and MySQL 14.14.

[MightyCreak]

Here is the request header:

POST /import HTTP/1.1
Host: sonerezh.##scrambled##.com
User-Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:61.0) Gecko/20100101 Firefox/61.0
Accept: */*
Accept-Language: fr-FR,fr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Referer: https://sonerezh.##scrambled##.com/import
Cookie: Sonerezh=##scrambled##; SonerezhCookie[lang]=Q2FrZQ%3D%3D.yZ6K; SonerezhCookie[auth]=##scrambled##
Connection: keep-alive
Content-Length: 0

Here is the answer header:

HTTP/2.0 400 Bad Request
server: nginx/1.10.3
date: Sun, 26 Aug 2018 21:15:59 GMT
content-type: text/html; charset=UTF-8
content-length: 8343
X-Firefox-Spdy: h2

[MightyCreak]

Here the text I have in the answer if I put fastcgi_param CAKEPHP_DEBUG 1; in the nginx php block:

'_Token' was not found in request data.

Error: The requested address '/import' was not found on this server.
Stack Trace

    CORE/Cake/Controller/Component/SecurityComponent.php line 490 → SecurityComponent->_validToken(SongsController)
    CORE/Cake/Controller/Component/SecurityComponent.php line 247 → SecurityComponent->_validatePost(SongsController)
    [internal function] → SecurityComponent->startup(SongsController)
    CORE/Cake/Utility/ObjectCollection.php line 128 → call_user_func_array(array, array)
    [internal function] → ObjectCollection->trigger(CakeEvent)
    CORE/Cake/Event/CakeEventManager.php line 243 → call_user_func(array, CakeEvent)
    CORE/Cake/Controller/Controller.php line 678 → CakeEventManager->dispatch(CakeEvent)
    CORE/Cake/Routing/Dispatcher.php line 189 → Controller->startupProcess()
    CORE/Cake/Routing/Dispatcher.php line 167 → Dispatcher->_invoke(SongsController, CakeRequest)
    APP/webroot/index.php line 108 → Dispatcher->dispatch(CakeRequest, CakeResponse)

[MightyCreak]

Last update:
I tried with @gs11's fork, on branch development-new which is synced on v1.2.0 and it works. I think there's no changes between gs11's branch and the 1.2.0 tag here, so I would say that the problem comes from the commits between 1.2.0 and 1.2.1.

[lGuillaume124]

Yes it is.

[lGuillaume124]

Sorry for that, it comes from the latest CakePHP release : https://book.cakephp.org/2.0/en/appendices/2-10-migration-guide.html#components

SecurityComponent will blackhole post requests that have no request data now. This change helps protect actions that create records using database defaults alone.

And the /import JS sends an empty POST request to trigger the import process. I'll try to fix it as soon as possible.

[MightyCreak]

Thanks! ;)