Problem/Motivation
Since the update to 2.1, A custom form submit generate a LogicException
Steps to reproduce
- Having a custom form , with a "managed_file" field if it matters, and upload validators
$form['cv'] = [
'#type' => 'managed_file',
'#title' => 'Votre CV',
'#required' => true,
'#upload_validators' => [
'file_validate_extensions' => ['pdf doc docx odt odf'],
'file_validate_size' => [2048 * 1024],
],
];
-replace the old code to the 2.1
\Drupal::service('honeypot')->addFormProtection($form, $form_state, ['honeypot', 'time_restriction']);
-on form submit, error : field CV is required.
LogicException: The database connection is not serializable. This probably means you are serializing an object that has an indirect reference to the database connection. Adjust your code so that is not necessary. Alternatively, look at DependencySerializationTrait as a temporary solution. in Drupal\Core\Database\Connection->__sleep() (line 1993 of /data-platforms/platforms/drupal9-dev/core/lib/Drupal/Core/Database/Connection.php).
| Comment | File | Size | Author |
|---|---|---|---|
| #27 | 3279917-attempt-to-serialize-27.patch | 3 KB | cmlara |
Comments
Comment #2
matoeil commentedcould it be related to that ?
https://www.drupal.org/project/webform/issues/2879138
Comment #3
matoeil commentedComment #4
Ruedische commentedThe honypot service has a dependency on database but does not use the dependency serialization trait.
In some rare cases the Logic Exception is thrown also on multilingual pages.
Patch attached.
Comment #5
tr commentedComment #6
matoeil commentedThe patch has no effect in my case
Comment #7
othermachines commentedMarking this as major as it has crippled our webforms. We've rolled back to 2.0.2.
Comment #8
tr commented@othermachines: Please contribute to #3279421: Figure out a way forward to be compatible with Honeypot to 2.1.0, which caused a BC break
Comment #9
klemendev commentedThis broke our forms on the website for node posting. File fields no longer work so this update fully crippled our website too. I think this issue is more of critical than major.
So to sum up, it is not only custom forms, but also vanilla forms seem to be affected when covered by honeypot, more specifically in our case: node add form with file filed that brakes when file is uploaded and ajax is executed on the form.
Disabling honeypot on these forms (node add) mitigates the issue.
Comment #10
tr commentedSo did the patch fix it for you?
Comment #11
cmlaraThe patch correctly resolves the serializing of the Database service, however exceptions now occur later. After patching I get:
2022-05-12T23:27:44.691736213Z NOTICE: PHP message: Uncaught PHP Exception Exception: "Serialization of 'Symfony\Component\HttpFoundation\File\UploadedFile' is not allowed" at /var/www/html/web/core/lib/Drupal/Component/Serialization/PhpSerialize.php line 14For some reason there is an attempt to Serialize the file upload field. I'm not sure why that is occurring, but that should at least give more room to track and watch the stack to understand.
Unfortunately debugging serialization bugs can be a bit of a pain. Sometimes its easier to do bisecting of changes, though in this case I'm not sure that would help. Without that it Involves looking at the data fed into PhpSerialize and see where the code is added and how it got there.
Steps to reproduce
Based on information above here are reproducing steps:
Install a fresh Drupal install (using the standard profile)
Grant permissions for the Anonymous user to Add Article Content (this could be for any user that doesn't have the Bypass Honeypot role, but lets just use anonymous for ease of skipping steps of adding more users)
Install and enable Honeypot, enable it for all forms.
As the Anonymous user (private browsing mode) visit the add an article content page and upload a file. Error displays in the server logs.
Comment #12
johnpitcairn commentedA different manifestation, without a file upload field:
I have a slightly custom commerce payment information form that adds an ajax callback to the customer profile to show/hide dependent fields. Honeypot protection added programmatically breaks the ajax callback since 2.1.0, with the same serialization error.
The patch at #4 fixes this issue, with no subsequent form errors.
Comment #13
lesleyfernandes commentedI had the same bug here with an institutional Drupal website. That was not allowing me to add new paragraphs to a page. Patch #4 worked for me.
Comment #14
johnpitcairn commented@matoeil - did you clear caches and rebuild the container after applying the patch?
Comment #15
robertoperuzzoI had the same problem with a custom contact form where there you can upload a file: the ajax call which uploads the file gets the error.
Patch #4 works for me!
Comment #17
tr commentedCommitted the patch to add the DependencySerializationTrait. Leaving this open for a while to see if anyone else has side-effects as reported in #11. I'm not convinced that has anything to do with Honeypot.
Comment #18
tr commentedComment #19
plach#4 was not enough here, since the logger channel cannot be serialized. The attached patch works for me.
Comment #20
plachRerolled on 2.1.x
Comment #21
jeroentI had the same problem as described in #11, which was fixed by the patch in #20.
I created a patch that applies to the current version (2.1.0).
Comment #22
tiagopastor commentedHi all,
#21 solved my problem.
Testing with version 2.1.0.
Comment #23
jday commented#21 solved my issue with a webform and honeypot combination.
Uninstalling honeypot also worked to avoid the error above. Re-installing honeypot and applying the patch in #21 works too, no errors are reported in the log and the webform works as expected.
Comment #24
klemendev commentedComment #25
cmlaraHere is a rather quickly adapted test to work as a proof of #11.
This uses a Drupal Core test extended to enable the Honeypot module. It very likely over-tests and could be shorter to meet our needs.
This test passes on 2.0.x in my lab and fails on 2.1.x in my lab.
Comment #27
cmlaraHere is the patch from #20 combined with the test from #25(+a phpcs fix)
Comment #28
matoeil commented@john-pitcairn rebuild the container ? how to ?
Comment #29
tr commentedJust the test from #27, to confirm it fails without the patch to the service.
Comment #32
tr commented#29 failed as expected.
Committed #27. The test is really useful, thanks.
I'm closing this as "fixed" because this now resolves all the above reports - if anyone has further problems along these lines please open a new issue.