Invalid CSRF Token at first login on Ubuntu 22.04 LTS

waldigexh

I've read the support forum with no luck. I'm having trouble installing Providence on my Linode server. I want to be able to provide this software to several local museums in our very rural area, so I'm hoping you can help!

My hunch is I've either got a permissions problem or I've missed a package because the instructions weren't explicit for Ubuntu 22.04 and I haven't brought up a LAMP stack in a long time. All packages on my system are totally up-to-date.

Ubuntu 22.04 LTS
Apache/2.4.52 (Ubuntu)
MySql 8.0.36-0ubuntu0.22.04.1
PHP 7.4.33 (cli) (built: Sep 2 2023 08:03:46)

I used git clone https://github.com/collectiveaccess/providence.git public_html and updated the setup.php file. I've created a MySQL database called collacc_npwh with a user_npwh who has all privileges. I've reset Apache and also rebooted. I tried it with 'redis' and with 'file' in CA_CACHE_BACKEND.

I did have to manually set permissions on a bunch of the created folders, chowned absolutely everything to username:www-data and even tried chmod -R 777.

The sitename.org/install works great. The tables are created as you would expect. I save my given user 'administrator' and a password. I've tried this with Testing (and the other created users/passwords) and with ISAD(G). When I open sitename.org, I see the login page along with an empty box where the image should be but is not. When I enter credentials, whether correct (administrator/givenpassword) or incorrect (random/random), I get a "CSRF token is not valid" error.

My file at /etc/php/7.4/cli/php.ini has the following vars:

upload_max_filesize = 250M
post_max_size = 250M
memory_limit = 512M
display_errors = On

This is the recent Apache error log:

[Sun Mar 24 18:13:12.176283 2024] [php7:error] [pid 7994] [client 2600:3c01::f03c:93ff:fe2f:51f8:52816] PHP Parse error:  syntax error, unexpected ''YToxMTY6e3M6MzI6IjJmNjZkMTk5M' (T_ENCAPSED_AND_WHITESPACE) in /var/www/sitename.org/public_html/app/tmp/collacc_npwhCache/0fea6a13c52b4d47/25368f24b045ca84/38a865804f8fdcb6/57cd99682e939275/efd02694d21a801f/598ce1b6114171fe/c21f969b5f03d33d/43e04f8f136e7682/e92d1ceb7caccf1b/c14ac4c40a5783fd.php on line 14
[Sun Mar 24 18:13:12.235989 2024] [php7:error] [pid 8035] [client 2600:3c01::f03c:93ff:fe2f:51f8:52826] PHP Parse error:  syntax error, unexpected ''YToxMTY6e3M6MzI6IjJmNjZkMTk5M' (T_ENCAPSED_AND_WHITESPACE) in /var/www/sitename.org/public_html/app/tmp/collacc_npwhCache/0fea6a13c52b4d47/25368f24b045ca84/38a865804f8fdcb6/57cd99682e939275/efd02694d21a801f/598ce1b6114171fe/c21f969b5f03d33d/43e04f8f136e7682/e92d1ceb7caccf1b/c14ac4c40a5783fd.php on line 14
[Sun Mar 24 18:13:12.246102 2024] [php7:error] [pid 7969] [client 50.37.202.131:47374] PHP Parse error:  syntax error, unexpected ''YToxMTY6e3M6MzI6IjJmNjZkMTk5M' (T_ENCAPSED_AND_WHITESPACE) in /var/www/sitename.org/public_html/app/tmp/collacc_npwhCache/0fea6a13c52b4d47/25368f24b045ca84/38a865804f8fdcb6/57cd99682e939275/efd02694d21a801f/598ce1b6114171fe/c21f969b5f03d33d/43e04f8f136e7682/e92d1ceb7caccf1b/c14ac4c40a5783fd.php on line 14, referer: https://www.sitename.org/index.php/system/Auth/DoLogin
[Sun Mar 24 18:13:12.247997 2024] [php7:error] [pid 7995] [client 50.37.202.131:47392] PHP Parse error:  syntax error, unexpected ''YToxMTY6e3M6MzI6IjJmNjZkMTk5M' (T_ENCAPSED_AND_WHITESPACE) in /var/www/sitename.org/public_html/app/tmp/collacc_npwhCache/0fea6a13c52b4d47/25368f24b045ca84/38a865804f8fdcb6/57cd99682e939275/efd02694d21a801f/598ce1b6114171fe/c21f969b5f03d33d/43e04f8f136e7682/e92d1ceb7caccf1b/c14ac4c40a5783fd.php on line 14, referer: https://www.sitename.org/index.php/system/Auth/DoLogin
[Sun Mar 24 18:13:12.494078 2024] [php7:error] [pid 8531] [client 2600:3c01::f03c:93ff:fe2f:51f8:52830] PHP Parse error:  syntax error, unexpected ''YToxMTk6e3M6MzI6IjJmNjZkMTk5M' (T_ENCAPSED_AND_WHITESPACE) in /var/www/sitename.org/public_html/app/tmp/collacc_npwhCache/0fea6a13c52b4d47/25368f24b045ca84/38a865804f8fdcb6/57cd99682e939275/efd02694d21a801f/598ce1b6114171fe/c21f969b5f03d33d/43e04f8f136e7682/e92d1ceb7caccf1b/c14ac4c40a5783fd.php on line 14
[Sun Mar 24 18:13:12.534126 2024] [php7:error] [pid 7994] [client 2600:3c01::f03c:93ff:fe2f:51f8:52834] PHP Parse error:  syntax error, unexpected ''YToxMTk6e3M6MzI6IjJmNjZkMTk5M' (T_ENCAPSED_AND_WHITESPACE) in /var/www/sitename.org/public_html/app/tmp/collacc_npwhCache/0fea6a13c52b4d47/25368f24b045ca84/38a865804f8fdcb6/57cd99682e939275/efd02694d21a801f/598ce1b6114171fe/c21f969b5f03d33d/43e04f8f136e7682/e92d1ceb7caccf1b/c14ac4c40a5783fd.php on line 14
[Sun Mar 24 18:13:14.608020 2024] [access_compat:error] [pid 922] [client 50.37.202.131:47418] AH01797: client denied by server configuration: /var/www/sitename.org/public_html/index.cgi
[Sun Mar 24 18:13:14.608088 2024] [access_compat:error] [pid 922] [client 50.37.202.131:47418] AH01797: client denied by server configuration: /var/www/sitename.org/public_html/index.pl

monica

Looks like you need to clear out the app/tmp directory. If you run the caUtils command (found at support/bin/caUtils) with clear-caches, this will do it for you safely.
support/bin/caUtils clear-caches

waldigexh

monica

Thanks for the quick reply! I ran the sudo support/bin/caUtils clear-caches command and it reported success, but then I encountered the same problem when I loaded the website. I got this error:

Issues with your system configuration have been detected. General installation instructions can be found here. For more specific hints on the existing issues please have a look at the messages below. It looks like the cache directory is not writable by the webserver. Please change the permissions of /var/www/sitename.org/public_html/app/tmp/collacc_npwhCache and enable the user which runs the webserver to write to this directory.

I ran sudo chmod -R 777 . in the root public_html folder and found myself back at the same issue as before, the site login page loads but the image does not, and when I enter a username and password it gives me the CSRF token is not valid error and doesn't log in.

I haven't been able to log in at all yet.

monica

There is a caUtils fix-permissions for when those messages come up. The directory it complains about is if you have file caching on (I believe), if you have redis installed, change it to that. Then do clear-caches again and clear your browser cache too.
Ensure the /app/TMP directory is empty before you load the page.

waldigexh

monica

Okay, so I'm not sure I was clear enough in my initial post. I already changed everything to 777. I also already tried with redis, as I said in my first post. This CSRF is happening whether I have it set to "redis" or "file" or not. I've cleared all the caches. There is no change in results for any of the above. I've started from a fresh install twice. I'm going to try this on Ubuntu 20.04 explicitly following the instructions, but now that's costing me as I have to set up another virtual machine.

The only issue I have is the CSRF token error. Can you explain what's actually going wrong that you think the permissions script will fix? Can you address the Apache errors? What is the root cause of the CSRF token issue? What do you think is exactly going wrong? I have quite a bit of experience on a Linux server so I'd be more helpful to try and fix it if I understand the root cause.

waldigexh

monica

I appreciate learning about the caUtils permissions tool but the issue I have is the CSRF token issue.

I created a new virtual machine running Ubuntu 20.04 LTS and used the walkthrough on this page: https://manual.collectiveaccess.org/providence/user/setup/install/Ubuntu_20.04.html#install-ubuntu-20-04

Everything works fine. So there's some issue with my Ubuntu 22.04 server. Is it possible this is an Apache settings issue?

monica

CSRF token is used to protect from cross site attacks. It will be stored in your browser as cache/cookies and compared with what it expects on the server. The error is because they don't match. So the cache on the server and your browser are causing it. If you have installed multiple times, then everything is conflicting.

As a separate, the error you got in regards to the permission on app/tmp/collacc_* is from using file caching, instead of redis caching, when you cleared the caches, it most likely deleted this directory and then it created a new one as the root user instead of the web user.
Running 'fix-permissions' will chown and chmod the files which need it to be owned by www-data (if ubuntu) and set the right permissions. As someone with experience with Linux, you would know that setting chmod 777 is highly dangerous and shouldn't be done, which is why I point this command out to you.

So my instructions still stand. Change to redis caching, clear all caches, both server and browser, ensuring the app/tmp directory is empty. Then load the page. If it give any error about permissions, run the fix-permissions script.

Monica

waldigexh

I think we're talking at cross purposes. I'll stick with 20.04 until the documentation is updated to cover 22.04. Thanks for the help.