Problem/Motivation

Since the update to 2.1, A custom form submit generate a LogicException

Steps to reproduce

- Having a custom form , with a "managed_file" field if it matters, and upload validators
$form['cv'] = [
'#type' => 'managed_file',
'#title' => 'Votre CV',
'#required' => true,
'#upload_validators' => [
'file_validate_extensions' => ['pdf doc docx odt odf'],
'file_validate_size' => [2048 * 1024],
],
];

-replace the old code to the 2.1
\Drupal::service('honeypot')->addFormProtection($form, $form_state, ['honeypot', 'time_restriction']);

-on form submit, error : field CV is required.

LogicException: The database connection is not serializable. This probably means you are serializing an object that has an indirect reference to the database connection. Adjust your code so that is not necessary. Alternatively, look at DependencySerializationTrait as a temporary solution. in Drupal\Core\Database\Connection->__sleep() (line 1993 of /data-platforms/platforms/drupal9-dev/core/lib/Drupal/Core/Database/Connection.php).

Comments

matoeil created an issue. See original summary.

matoeil’s picture

matoeil’s picture

Issue summary: View changes
Ruedische’s picture

The honypot service has a dependency on database but does not use the dependency serialization trait.
In some rare cases the Logic Exception is thrown also on multilingual pages.
Patch attached.

tr’s picture

Status: Active » Needs review
matoeil’s picture

Status: Needs review » Needs work

The patch has no effect in my case

othermachines’s picture

Priority: Normal » Major

Marking this as major as it has crippled our webforms. We've rolled back to 2.0.2.

tr’s picture

klemendev’s picture

This broke our forms on the website for node posting. File fields no longer work so this update fully crippled our website too. I think this issue is more of critical than major.

So to sum up, it is not only custom forms, but also vanilla forms seem to be affected when covered by honeypot, more specifically in our case: node add form with file filed that brakes when file is uploaded and ajax is executed on the form.

Disabling honeypot on these forms (node add) mitigates the issue.

tr’s picture

So did the patch fix it for you?

cmlara’s picture

The patch correctly resolves the serializing of the Database service, however exceptions now occur later. After patching I get:

2022-05-12T23:27:44.691736213Z NOTICE: PHP message: Uncaught PHP Exception Exception: "Serialization of 'Symfony\Component\HttpFoundation\File\UploadedFile' is not allowed" at /var/www/html/web/core/lib/Drupal/Component/Serialization/PhpSerialize.php line 14

For some reason there is an attempt to Serialize the file upload field. I'm not sure why that is occurring, but that should at least give more room to track and watch the stack to understand.

Unfortunately debugging serialization bugs can be a bit of a pain. Sometimes its easier to do bisecting of changes, though in this case I'm not sure that would help. Without that it Involves looking at the data fed into PhpSerialize and see where the code is added and how it got there.

Steps to reproduce

Based on information above here are reproducing steps:

Install a fresh Drupal install (using the standard profile)
Grant permissions for the Anonymous user to Add Article Content (this could be for any user that doesn't have the Bypass Honeypot role, but lets just use anonymous for ease of skipping steps of adding more users)
Install and enable Honeypot, enable it for all forms.
As the Anonymous user (private browsing mode) visit the add an article content page and upload a file. Error displays in the server logs.

johnpitcairn’s picture

A different manifestation, without a file upload field:

I have a slightly custom commerce payment information form that adds an ajax callback to the customer profile to show/hide dependent fields. Honeypot protection added programmatically breaks the ajax callback since 2.1.0, with the same serialization error.

The patch at #4 fixes this issue, with no subsequent form errors.

lesleyfernandes’s picture

I had the same bug here with an institutional Drupal website. That was not allowing me to add new paragraphs to a page. Patch #4 worked for me.

johnpitcairn’s picture

@matoeil - did you clear caches and rebuild the container after applying the patch?

robertoperuzzo’s picture

I had the same problem with a custom contact form where there you can upload a file: the ajax call which uploads the file gets the error.
Patch #4 works for me!

  • TR committed ff6aa0f on 2.1.x authored by Ruedische
    Issue #3279917 by Ruedische: LogicException: The database connection is...
tr’s picture

Status: Needs work » Active

Committed the patch to add the DependencySerializationTrait. Leaving this open for a while to see if anyone else has side-effects as reported in #11. I'm not convinced that has anything to do with Honeypot.

tr’s picture

Version: 2.1.0 » 2.1.x-dev
plach’s picture

Status: Active » Needs review
StatusFileSize
new2.17 KB

#4 was not enough here, since the logger channel cannot be serialized. The attached patch works for me.

plach’s picture

Rerolled on 2.1.x

jeroent’s picture

StatusFileSize
new2.17 KB

I had the same problem as described in #11, which was fixed by the patch in #20.

I created a patch that applies to the current version (2.1.0).

tiagopastor’s picture

Hi all,
#21 solved my problem.
Testing with version 2.1.0.

jday’s picture

#21 solved my issue with a webform and honeypot combination.

Uncaught PHP Exception LogicException: "The database connection is not serializable. This probably means you are serializing an object that has an indirect reference to the database connection. Adjust your code so that is not necessary. Alternatively, look at DependencySerializationTrait as a temporary solution." at /mnt/www/html/datahealthcarestg/docroot/core/lib/Drupal/Core/Database/Connection.php line 1993 request_id="v-401c8bac-ddf9-11ec-ba09-4f21b420e512"

Uninstalling honeypot also worked to avoid the error above. Re-installing honeypot and applying the patch in #21 works too, no errors are reported in the log and the webform works as expected.

klemendev’s picture

Status: Needs review » Reviewed & tested by the community
cmlara’s picture

StatusFileSize
new1.25 KB

Here is a rather quickly adapted test to work as a proof of #11.

This uses a Drupal Core test extended to enable the Honeypot module. It very likely over-tests and could be shorter to meet our needs.

This test passes on 2.0.x in my lab and fails on 2.1.x in my lab.

Status: Reviewed & tested by the community » Needs work

The last submitted patch, 25: 3279917-attempt-to-serialize-25.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

cmlara’s picture

Status: Needs work » Needs review
StatusFileSize
new3 KB

Here is the patch from #20 combined with the test from #25(+a phpcs fix)

matoeil’s picture

@john-pitcairn rebuild the container ? how to ?

tr’s picture

Just the test from #27, to confirm it fails without the patch to the service.

Status: Needs review » Needs work

The last submitted patch, 29: 3279917-attempt-to-serialize-27-test-only.patch, failed testing. View results

  • TR committed 5e5d871 on 2.1.x authored by cmlara
    Issue #3279917 by plach, cmlara: LogicException: The database connection...
tr’s picture

#29 failed as expected.

Committed #27. The test is really useful, thanks.

I'm closing this as "fixed" because this now resolves all the above reports - if anyone has further problems along these lines please open a new issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.