[
https://issues.apache.org/jira/browse/OFBIZ-11306?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17007970#comment-17007970
]
Jacques Le Roux commented on OFBIZ-11306:
-----------------------------------------
h6. ecommerce
When quick checking out, at the end of the process I get
bq. https://localhost:8443/ecomseo/processorder?checkoutpage=quick
{noformat}
ERROR in error page, (infinite loop or error page not found with name
[/error/error.jsp]
Original error detected, maybe it would be helps you : Invalid or missing CSRF
token to path '/processorder'. Click here to continue.
{noformat}
{noformat}
2020-01-04 11:21:36,151 |jsse-nio-8443-exec-3 |SeoContextFilter
|I| Can NOT forward this url: /ecomseo/processorder?checkoutpage=quick
2020-01-04 11:21:36,191 |jsse-nio-8443-exec-3 |ConfigXMLReader
|I| controller loaded: 0.01s, 286 requests, 95 views in
file:/C:/projectsASF/Git/ofbiz-framework/plugins/ecommerce/webapp/ecommerce/WEB-INF/controller.xml
2020-01-04 11:21:36,191 |jsse-nio-8443-exec-3 |ConfigXMLReader
|I| controller loaded: 0.02s, 1 requests, 0 views in
file:/C:/projectsASF/Git/ofbiz-framework/plugins/ecommerce/webapp/ecomseo/WEB-INF/controller.xml
2020-01-04 11:21:36,191 |jsse-nio-8443-exec-3 |ControlServlet
|T| [[[ecomseo::processorder (Domain:https://localhost)] Request Begun,
encoding=[UTF-8]- total:0.0,since last(Begin):0.0]]
2020-01-04 11:21:36,191 |jsse-nio-8443-exec-3 |ControlServlet
|I| Going to external page: /processorder
2020-01-04 11:21:36,191 |jsse-nio-8443-exec-3 |ControlServlet
|E| An error occurred, going to the errorPage: /error/error.jsp
2020-01-04 11:21:36,191 |jsse-nio-8443-exec-3 |ControlServlet
|E| Including errorPage: /error/error.jsp
2020-01-04 11:21:36,191 |jsse-nio-8443-exec-3 |ControlServlet
|T| [[[ecomseo::processorder (Domain:https://localhost)] Request Begun,
encoding=[UTF-8]- total:0.0,since last(Begin):0.0]]
2020-01-04 11:21:36,191 |jsse-nio-8443-exec-3 |ControlServlet
|I| Going to external page: /processorder
2020-01-04 11:21:36,191 |jsse-nio-8443-exec-3 |ControlServlet
|E| An error occurred, going to the errorPage: /error/error.jsp
2020-01-04 11:21:36,191 |jsse-nio-8443-exec-3 |ServerHitBin
|I| Visit delegatorName=default, ServerHitBin delegatorName=default
2020-01-04 11:21:36,191 |jsse-nio-8443-exec-3 |ControlServlet
|T| [[[ecomseo::processorder (Domain:https://localhost)] Request Done-
total:0.0,since last([ecomseo::process...):0.0]]
2020-01-04 11:21:36,191 |jsse-nio-8443-exec-3 |ServerHitBin
|I| Visit delegatorName=default, ServerHitBin delegatorName=default
2020-01-04 11:21:36,201 |jsse-nio-8443-exec-3 |TransactionUtil
|W| Calling transaction setRollbackOnly; this stack trace shows where this is
happening:
java.lang.Exception: rollback called in Entity Engine SQLProcessor
at
org.apache.ofbiz.entity.transaction.TransactionUtil.setRollbackOnly(TransactionUtil.java:358)
[main/:?]
at
org.apache.ofbiz.entity.jdbc.SQLProcessor.rollback(SQLProcessor.java:185)
[main/:?]
at
org.apache.ofbiz.entity.datasource.GenericDAO.insert(GenericDAO.java:112)
[main/:?]
at
org.apache.ofbiz.entity.datasource.GenericHelperDAO.create(GenericHelperDAO.java:67)
[main/:?]
at
org.apache.ofbiz.entity.GenericDelegator.create(GenericDelegator.java:855)
[main/:?]
at org.apache.ofbiz.entity.GenericValue.create(GenericValue.java:76)
[main/:?]
at
org.apache.ofbiz.webapp.stats.ServerHitBin.saveHit(ServerHitBin.java:530)
[main/:?]
at
org.apache.ofbiz.webapp.stats.ServerHitBin.countHit(ServerHitBin.java:247)
[main/:?]
at
org.apache.ofbiz.webapp.stats.ServerHitBin.countHit(ServerHitBin.java:97)
[main/:?]
at
org.apache.ofbiz.webapp.stats.ServerHitBin.countRequest(ServerHitBin.java:75)
[main/:?]
at
org.apache.ofbiz.webapp.control.ControlServlet.handle(ControlServlet.java:368)
[main/:?]
at
org.apache.ofbiz.webapp.control.ControlServlet.doGet(ControlServlet.java:96)
[main/:?]
at
org.apache.ofbiz.product.category.SeoControlServlet.doGet(SeoControlServlet.java:88)
[main/:?]
{noformat}
Generating the CSRF token (clicking on "here" in the error screen) does not
help: the order is not generated
> POC for CSRF Token
> ------------------
>
> Key: OFBIZ-11306
> URL: https://issues.apache.org/jira/browse/OFBIZ-11306
> Project: OFBiz
> Issue Type: Improvement
> Components: ALL APPLICATIONS
> Affects Versions: Upcoming Branch
> Reporter: James Yong
> Assignee: Jacques Le Roux
> Priority: Minor
> Labels: CSRF
> Fix For: Upcoming Branch
>
> Attachments: OFBIZ-11306-v2.patch, OFBIZ-11306.patch,
> OFBIZ-11306.patch, OFBIZ-11306.patch, OFBIZ-11306.patch, OFBIZ-11306.patch,
> OFBIZ-11306.patch, OFBIZ-11306.patch, OFBIZ-11306.patch
>
>
> CRSF tokens are generated using CSRF Guard library and used in:
> 1) In widget form where a hidden token field is auto-generated.
> 2) In FTL form where a <@csrfTokenField> macro is used to generate the csrf
> token field.
> 3) In Ajax call where a <@csrfTokenAjax> macro is used to assign csrf token
> to X-CSRF-Token in request header.
> CSRF tokens are stored in the user sessions, and verified during POST request.
> A new attribute i.e. csrf-token is added to the security tag to exempt CSRF
> token check.
> Certain request path, like LookupPartyName, can be exempt from CSRF token
> check during Ajax POST call.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
