Invalid CSRF Token on 3.0.1

Two steps forward, one step back…

That’s not true. I was able to replicate “Invalid CSRF Token” error by downloading InfiniteWP.

it threw a fatal error (red box at the top of Plugins admin page)

– Could you post the error message?
– Could you post the PHP error logs in your server?
– Could you post the error logs in developer tools?

JQMIGRATE: Migrate is installed, version 1.4.1

This is not an error message. It’s a warning message. You can ignore it.

Thanks

Hey Guys,

So yeah @furkan811 figured out the root cause to this yesterday. Here is what happens:

For non GET requests we get the body of the request like this:

$body = file_get_contents('php://input');

Unfortunately php://input can only be read once, so if another plugin reads it before us then our request body won’t exist when our code goes to look for it. The requests with CSRF tokens are sent from our plugin and intended to be consumed by our plugin so any 3rd party WordPress plugins that modify these requests will have to be updated to limit the scope of requests they modify or put the input stream back after they use it. There is nothing we can do to fix this issue.

Thanks,
John

I hope so, i would love the cloudflare plugin, but i am not willing to give up infinite wp for it. 🙁

Hi Guys,

Just wanted to update you – I’ve contacted @infinitewp on twitter to see if they’ll push a fix. With infinitewp specifically the problem code is line 97.

global $HTTP_RAW_POST_DATA, $iwp_mmb_activities_log;
		$HTTP_RAW_POST_DATA_LOCAL = NULL;
		$HTTP_RAW_POST_DATA_LOCAL = file_get_contents('php://input');
		if(empty($HTTP_RAW_POST_DATA_LOCAL)){
			if (isset($HTTP_RAW_POST_DATA)) {
				$HTTP_RAW_POST_DATA_LOCAL = $HTTP_RAW_POST_DATA;
			}
		}

To ensure php://input can be read more than once an approach like this can be used:

$stream = fopen('php://temp', 'w+');
stream_copy_to_stream(fopen('php://input', 'r'), $stream);
rewind($stream);

echo("first: ". stream_get_contents($stream) . "\n");
echo("second: ". file_get_contents('php://input') . "\n");

Your last post on this topic was nearly three weeks ago. Are there any updates on this?

Thank you!

Hi @synthman,@edgemarketing, @burquidi

InfiniteWP has released a new version of their WordPress plugin. Downloading InfiniteWP- Client, Version 1.6.1.1 should fix the issue.

Let me know if you have any questions.

Thanks.

Maybe the update just hasn’t hit the wordpress plugin library yet.