BUGFIX: Configurable uriPathSuffix in EventSourcedFrontendNodeRoutePa… #5189
Conversation
|
for the sake of completeness, we talked about this in the neos-general Slack channel https://neos-project.slack.com/archives/C050C8FEK/p1722245234573379 |
| @@ -117,7 +117,7 @@ class NodeController extends ActionController | |||
| * @Flow\SkipCsrfProtection We need to skip CSRF protection here because this action could be called | |||
| * with unsafe requests from widgets or plugins that are rendered on the node | |||
| * - For those the CSRF token is validated on the sub-request, so it is safe to be skipped here | |||
| */ | |||
| */ | |||
| * - For those the CSRF token is validated on the sub-request, so it is safe to be skipped here | ||
| * We need to skip CSRF protection here because this action could be called with unsafe requests from widgets or plugins that are rendered on the node - For those the CSRF token is validated on the sub-request, so it is safe to be skipped here | ||
| * @Flow\SkipCsrfProtection | ||
| * @Flow\IgnoreValidation("node") |
There was a problem hiding this comment.
I don't understand why this should be needed – IIRC IngoreValidation should be only needed for object arguments!? What happens if you omit this?
There was a problem hiding this comment.
If I submit a form which redirects to a node (e.g. via Neos.Form or a Neos.Form:Builder rendered form) without this change, the request ends in a 404 and I get the error in the logs CSRF: token was empty but a valid token is required for Neos\Neos\Controller\Frontend\NodeController::showAction().
There was a problem hiding this comment.
That should be solved by the SkipCsrfProtection, the IgnoreValidation is also necessary and gives you the same error otherwise?
There was a problem hiding this comment.
Yes, exactly @kitsunet. Without the IgnoreValidation, I get the mentioned error.
There was a problem hiding this comment.
i wonder if the problem here is in any way possibly related to #4909 ? ill have to experiment with this myself
There was a problem hiding this comment.
@bwaidelich and @kitsunet i guess this is related to our misconception that the NodeController is infact part of the backend authentication?
But then this part should be a 8.3 bugfix?
|
The core change (the uri path options thing) will be fixed with #5224. For the other changes we can keep this pr and its discussion open :) |
Only for Neos 9.
Author & Contributor @sjsone
With this PR it is possible to use a different uriPathSuffix than the one configured in
Neos.Neos.sitePresets.The Routes.yaml config has to be "dynamic", e.g.
So
uriPattern: '{node}instead ofuriPattern: '{node}.json'.Checklist
FEATURE|TASK|BUGFIX!!!and have upgrade-instructions