Problem/Motivation

STR:

  • Install 8.2.x fresh. Do NOT enable update checking.
  • You are logged in as user 1
  • Install update manager module from the UI
  • It shows a message "No update information available. Run cron or check manually."

    • The link path for e.g. cron is:

/admin/reports/status/run-cron?destination=/admin/modules&token=96018d359c9699ebe12498ce963ef86765820ec1
  • Click one of the link - they are both 403
  • Note that the CSRF token is hex not base64!

    • An alternate STR is to delete the values from key_value_expire table and visit the modules page.

    This bug affects user 1 and any administrative user

    Since the cron link works on the status report page, this seems to be major, not critical.

    Proposed resolution

    Remaining tasks

    Comments

    pwolanin created an issue. See original summary.

    pwolanin’s picture

    pwolanin commented
    Issue summary: View changes
    pwolanin’s picture

    pwolanin commented
    Issue summary: View changes
    Issue tags: +MWDS2016
    pwolanin’s picture

    pwolanin commented
    Priority: Critical » Major
    Issue summary: View changes

    Since the same cron route is correctly rendered on the status page, this is very odd.

    pwolanin’s picture

    pwolanin commented
    Issue summary: View changes
    pwolanin’s picture

    pwolanin commented
    Issue summary: View changes
    pwolanin’s picture

    pwolanin commented

    This seems to be a case where redner placeholders are not replaced

    suing sha1 or the palceholder - there is an issue to fix all these to be sha256 also?

    I think the problem boils down to the fact that in update.install the rendered URLs with placeholders are NOT wrapped in a render array, but the system.install version rendering the cron link for the status page is wrapping in a render array.

    The placeholder is generated here and then shows up in the UI:

    \Drupal\Core\Access\RouteProcessorCsrf::processOutbound

          else {
        // Generate a placeholder and a render array to replace it.
        $placeholder = hash('sha1', $path);
        $placeholder_render_array = [
          '#lazy_builder' => ['route_processor_csrf:renderPlaceholderCsrfToken', [$path]],
        ];

        // Instead of setting an actual CSRF token as the query string, we set
        // the placeholder, which will be replaced at the very last moment. This
        // ensures links with CSRF tokens don't break cacheability.
        $parameters['token'] = $placeholder;
        $bubbleable_metadata->addAttachments(['placeholders' => [$placeholder => $placeholder_render_array]]);
      }
    pwolanin’s picture

    pwolanin commented
    Component: routing system » render system
    Issue tags: +Needs tests
    pwolanin’s picture

    pwolanin commented

    We should add a very findable string to all the render placeholders so we can check for them in automated tests

    pwolanin’s picture

    pwolanin commented
    Issue summary: View changes

    It seems the url_generator service gives you a \Drupal\Core\Render\MetadataBubblingUrlGenerator which is why we end up in the else case \Drupal\Core\Access\RouteProcessorCsrf::processOutbound

    dawehner’s picture

    dawehner
    Primary language German
    commented

    This reads like a duplicate of #2630920: _csrf_token is broken due to cacheability metadata integration, results in rendered links without valid CSRF tokens

    yesct’s picture

    yesct commented
    Issue tags: +CSRF, +CSRF Token
    xjm’s picture

    xjm
    she/her
    Primary language English
    commented
    Issue tags: +Triaged core major

    @lauriii, @Cottser, @joelpittet, @alexpott and I discussed this issue awhile back. While the bug is admin-facing and does have a workaround, it can actually prevent people from knowing that they have security updates available. So, based on that, we decided to keep it as major.

    #2630920: _csrf_token is broken due to cacheability metadata integration, results in rendered links without valid CSRF tokens is already triaged as major as well, so if this turns out to indeed be resolved by that fix, then we are set there.

    Version: 8.2.x-dev » 8.3.x-dev

    Drupal 8.2.6 was released on February 1, 2017 and is the final full bugfix release for the Drupal 8.2.x series. Drupal 8.2.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.3.0 on April 5, 2017. (Drupal 8.3.0-alpha1 is available for testing.)

    Bug reports should be targeted against the 8.3.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.4.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

    Version: 8.3.x-dev » 8.4.x-dev

    Drupal 8.3.6 was released on August 2, 2017 and is the final full bugfix release for the Drupal 8.3.x series. Drupal 8.3.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.4.0 on October 4, 2017. (Drupal 8.4.0-alpha1 is available for testing.)

    Bug reports should be targeted against the 8.4.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.5.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

    Version: 8.4.x-dev » 8.5.x-dev

    Drupal 8.4.4 was released on January 3, 2018 and is the final full bugfix release for the Drupal 8.4.x series. Drupal 8.4.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.5.0 on March 7, 2018. (Drupal 8.5.0-alpha1 is available for testing.)

    Bug reports should be targeted against the 8.5.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

    Version: 8.5.x-dev » 8.6.x-dev

    Drupal 8.5.6 was released on August 1, 2018 and is the final bugfix release for the Drupal 8.5.x series. Drupal 8.5.x will not receive any further development aside from security fixes. Sites should prepare to update to 8.6.0 on September 5, 2018. (Drupal 8.6.0-rc1 is available for testing.)

    Bug reports should be targeted against the 8.6.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

    Version: 8.6.x-dev » 8.8.x-dev

    Drupal 8.6.x will not receive any further development aside from security fixes. Bug reports should be targeted against the 8.8.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.9.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

    Version: 8.8.x-dev » 8.9.x-dev

    Drupal 8.8.7 was released on June 3, 2020 and is the final full bugfix release for the Drupal 8.8.x series. Drupal 8.8.x will not receive any further development aside from security fixes. Sites should prepare to update to Drupal 8.9.0 or Drupal 9.0.0 for ongoing support.

    Bug reports should be targeted against the 8.9.x-dev branch from now on, and new development or disruptive changes should be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

    Version: 8.9.x-dev » 9.2.x-dev

    Drupal 8 is end-of-life as of November 17, 2021. There will not be further changes made to Drupal 8. Bugfixes are now made to the 9.3.x and higher branches only. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

    Version: 9.2.x-dev » 9.3.x-dev

    Version: 9.3.x-dev » 9.4.x-dev

    Drupal 9.3.15 was released on June 1st, 2022 and is the final full bugfix release for the Drupal 9.3.x series. Drupal 9.3.x will not receive any further development aside from security fixes. Drupal 9 bug reports should be targeted for the 9.4.x-dev branch from now on, and new development or disruptive changes should be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

    borisson_’s picture

    borisson_
    Primary language Dutch
    Location Mechelen, 🇧🇪
    commented

    Does the comment in #13 mean that this is actually postponed on the other issue?

    catch’s picture

    catch
    he/him
    Primary language English
    commented
    Title: CSRF tokens broken for check updates or run cron for update module are 403 » [PP-1] CSRF tokens broken for check updates or run cron for update module are 403
    Status: Active » Postponed
    Issue tags: +Bug Smash Initiative

    I think so yes, marking postponed.

    Version: 9.4.x-dev » 9.5.x-dev

    Drupal 9.4.9 was released on December 7, 2022 and is the final full bugfix release for the Drupal 9.4.x series. Drupal 9.4.x will not receive any further development aside from security fixes. Drupal 9 bug reports should be targeted for the 9.5.x-dev branch from now on, and new development or disruptive changes should be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

    Version: 9.5.x-dev » 11.x-dev

    Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

    Version: 11.x-dev » main

    Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

    Read more in the announcement.