validTokenProvided [#3014029]

Having this warning when I clear the cache.

Warning: hash_equals(): Expected user_string to be a string, null given in Drupal\Component\Utility\Crypt::hashEquals() (line 126 of core/lib/Drupal/Component/Utility/Crypt.php).
Drupal\Component\Utility\Crypt::hashEquals('2C83gsjbW0D2se61UOgXvzmc-giagWfV6mcQPh2ipxY', NULL) (Line: 90)
Drupal\Core\Access\CsrfTokenGenerator->validate(NULL, 'focal_point_preview') (Line: 239)
Drupal\focal_point\Plugin\Field\FieldWidget\FocalPointImageWidget::validatePreviewToken(NULL) (Line: 204)
Drupal\focal_point\Controller\FocalPointPreviewController->validTokenProvided() (Line: 122)
Drupal\focal_point\Controller\FocalPointPreviewController->access(Object, '531')
call_user_func_array(Array, Array) (Line: 68)
Drupal\Core\Access\CustomAccessCheck->access(Object, Object, Object)
call_user_func_array(Array, Array) (Line: 159)
Drupal\Core\Access\AccessManager->performCheck('access_check.custom', Object) (Line: 135)
Drupal\Core\Access\AccessManager->check(Object, Object, Object, 1) (Line: 112)
Drupal\Core\Access\AccessManager->checkRequest(Object, Object, 1) (Line: 107)
Drupal\Core\Routing\AccessAwareRouter->checkAccess(Object) (Line: 92)
Drupal\Core\Routing\AccessAwareRouter->matchRequest(Object) (Line: 115)
Symfony\Component\HttpKernel\EventListener\RouterListener->onKernelRequest(Object, 'kernel.request', Object)
call_user_func(Array, Object, 'kernel.request', Object) (Line: 111)
Drupal\Component\EventDispatcher\ContainerAwareEventDispatcher->dispatch('kernel.request', Object) (Line: 127)
Symfony\Component\HttpKernel\HttpKernel->handleRaw(Object, 1) (Line: 68)
Symfony\Component\HttpKernel\HttpKernel->handle(Object, 1, 1) (Line: 57)
Drupal\Core\StackMiddleware\Session->handle(Object, 1, 1) (Line: 47)
Drupal\Core\StackMiddleware\KernelPreHandle->handle(Object, 1, 1) (Line: 99)
Drupal\page_cache\StackMiddleware\PageCache->pass(Object, 1, 1) (Line: 78)
Drupal\page_cache\StackMiddleware\PageCache->handle(Object, 1, 1) (Line: 47)
Drupal\Core\StackMiddleware\ReverseProxyMiddleware->handle(Object, 1, 1) (Line: 52)
Drupal\Core\StackMiddleware\NegotiationMiddleware->handle(Object, 1, 1) (Line: 23)
Stack\StackedHttpKernel->handle(Object, 1, 1) (Line: 666)
Drupal\Core\DrupalKernel->handle(Object) (Line: 19)

I have a fix. I will post a patch here.

Comment	File	Size	Author
#15	beta-6.png	37.92 KB	esod
#4	validTokenProvided-warning-no-param-2881280-3.patch	857 bytes	Nikolay Borisov
#4
#2	validTokenProvided-warning-no-param-2881280-1.patch	0 bytes	Nikolay Borisov
#2

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

15 November 2018 at 16:43

flesheater created an issue. See original summary.

Comment #2

Nikolay Borisov CreditAttribution: Nikolay Borisov commented 15 November 2018 at 17:00

File	Size
validTokenProvided-warning-no-param-2881280-1.patch	0 bytes

Comment #3

Nikolay Borisov CreditAttribution: Nikolay Borisov commented 15 November 2018 at 17:03

Ups. This one should work :)

File	Size
validTokenProvided-warning-no-param-2881280-3.patch	857 bytes

Comment #5

bleen CreditAttribution: bleen at NBCUniversal commented 15 November 2018 at 18:47

This looks fine to me ... but I'm curious as to the steps to reproduce. Under what circumstance does this happen exactly?

Comment #6

Nikolay Borisov CreditAttribution: Nikolay Borisov commented 16 November 2018 at 08:45

I tried to reproduce it on a freshly installed Drupal instance but was not quite able to reproduce it. On my setup with quite some modules - it is showing the warning every time I clear the cache and is also filling the Drupal logs.

Not quite sure why because the warning appears when I clear the cache. It registers the route for the preview and since there is no focal_point_token parameter - it tries to verify it without it being present, which results in the warning.

Cheers and thanks for the response!

Comment #7

bleen CreditAttribution: bleen at NBCUniversal commented 16 November 2018 at 14:18

It's especially strange because the tokens are only checked as part of the access checks to the preview page. That said ... this is an entirely valid improvement to the validTokenProvided method.

My biggest hesitation is that (ideally) the drupal request object could be passed in using dependency injection... thoughts?

Comment #8

Nikolay Borisov CreditAttribution: Nikolay Borisov commented 16 November 2018 at 14:16

Ooh, I found out ... someone had a shortcut to a preview page of a focal point.

Something like this:
http://domain/en/admin/focal_point/preview/FID/FOCAL_POINT_VALUE

And it was without the parameter. But the patch still makes sense if someone removes the parameter and opens the page.

Cheers!

Comment #9

bleen CreditAttribution: bleen at NBCUniversal commented 16 November 2018 at 14:19

Status:

Active

» Needs work

Comment #10

26 November 2018 at 21:38

bleen committed 974dc23 on 8.x-1.x authored by Nikolay Borisov
```
Issue #3014029 by Nikolay Borisov: validTokenProvided
```

Comment #11

bleen CreditAttribution: bleen at NBCUniversal commented 26 November 2018 at 21:38

Status:

Needs work

» Fixed

Its a pretty edge-y edge case, but it makes sense

Comment #12

10 December 2018 at 21:39

Status:

Fixed

» Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

Comment #13

esod CreditAttribution: esod at Memorial Sloan Kettering Cancer Center commented 30 January 2019 at 20:18

We are seeing what looks like the same error on every page load:

Warning: hash_equals(): Expected user_string to be a string, null given in Drupal\Component\Utility\Crypt::hashEquals() (line 126 of core/lib/Drupal/Component/Utility/Crypt.php).
Drupal\Component\Utility\Crypt::hashEquals('UMB-yYQYrgtR7xVHEV3_JtSTCdfUSK16e7ZX06sXnQ8', NULL) (Line: 90)
Drupal\Core\Access\CsrfTokenGenerator->validate(NULL, 'focal_point_preview') (Line: 239)
Drupal\focal_point\Plugin\Field\FieldWidget\FocalPointImageWidget::validatePreviewToken(NULL) (Line: 204)
Drupal\focal_point\Controller\FocalPointPreviewController->validTokenProvided() (Line: 122)
Drupal\focal_point\Controller\FocalPointPreviewController->access(Object, '4')
call_user_func_array(Array, Array) (Line: 75)
Drupal\Core\Access\CustomAccessCheck->access(Object, Object, Object)
call_user_func_array(Array, Array) (Line: 159)
Drupal\Core\Access\AccessManager->performCheck('access_check.custom', Object) (Line: 135)
Drupal\Core\Access\AccessManager->check(Object, Object, NULL, ) (Line: 92)
Drupal\Core\Access\AccessManager->checkNamedRoute('focal_point.preview', Array, NULL) (Line: 809)
Drupal\Core\Url->access() (Line: 269)
shortcut_renderable_links() (Line: 392)
shortcut_toolbar()
call_user_func_array('shortcut_toolbar', Array) (Line: 403)
Drupal\Core\Extension\ModuleHandler->invokeAll('toolbar') (Line: 81)
Drupal\toolbar\Element\Toolbar::preRenderToolbar(Array)
call_user_func(Array, Array) (Line: 378)
Drupal\Core\Render\Renderer->doRender(Array) (Line: 450)
Drupal\Core\Render\Renderer->doRender(Array, ) (Line: 195)
Drupal\Core\Render\Renderer->render(Array) (Line: 490)
Drupal\Core\Template\TwigExtension->escapeFilter(Object, Array, 'html', NULL, 1) (Line: 84)
__TwigTemplate_48acc268f67695731fb27550492174f187f471d0b3c1f7e5d5af87e53db88e0f->doDisplay(Array, Array) (Line: 428)
Twig_Template->displayWithErrorHandling(Array, Array) (Line: 399)
Twig_Template->display(Array) (Line: 407)
Twig_Template->render(Array) (Line: 64)
twig_render_template('themes/mskcc/templates/html.html.twig', Array) (Line: 384)
Drupal\Core\Theme\ThemeManager->render('html', Array) (Line: 437)
Drupal\Core\Render\Renderer->doRender(Array, ) (Line: 195)
Drupal\Core\Render\Renderer->render(Array) (Line: 147)
Drupal\Core\Render\MainContent\HtmlRenderer->Drupal\Core\Render\MainContent\{closure}() (Line: 582)
Drupal\Core\Render\Renderer->executeInRenderContext(Object, Object) (Line: 148)
Drupal\Core\Render\MainContent\HtmlRenderer->renderResponse(Array, Object, Object) (Line: 90)
Drupal\Core\EventSubscriber\MainContentViewSubscriber->onViewRenderArray(Object, 'kernel.view', Object)
call_user_func(Array, Object, 'kernel.view', Object) (Line: 111)
Drupal\Component\EventDispatcher\ContainerAwareEventDispatcher->dispatch('kernel.view', Object) (Line: 156)
Symfony\Component\HttpKernel\HttpKernel->handleRaw(Object, 1) (Line: 68)
Symfony\Component\HttpKernel\HttpKernel->handle(Object, 1, 1) (Line: 57)
Drupal\Core\StackMiddleware\Session->handle(Object, 1, 1) (Line: 47)
Drupal\Core\StackMiddleware\KernelPreHandle->handle(Object, 1, 1) (Line: 49)
Asm89\Stack\Cors->handle(Object, 1, 1) (Line: 50)
Drupal\ban\BanMiddleware->handle(Object, 1, 1) (Line: 47)
Drupal\Core\StackMiddleware\ReverseProxyMiddleware->handle(Object, 1, 1) (Line: 52)
Drupal\Core\StackMiddleware\NegotiationMiddleware->handle(Object, 1, 1) (Line: 23)
Stack\StackedHttpKernel->handle(Object, 1, 1) (Line: 693)
Drupal\Core\DrupalKernel->handle(Object) (Line: 19)

The patch fixes it.