Request Denied When Uploading Using Web Interface

[Aljawaid]

🎯Description of the issue

On Chevereto Free, uploading images through the web interface was fine and dandy. On the latest Chevereto Paid version, I have a random issue. Uploading through the web interface is fine except when I keep my browser tab open for around an hour with no activity, then try to upload one or more images (drop down upload box), I get a 'Request Denied' error. The error doesn't seem to show anywhere (error level 3 is set), or even in the server logs.

However, if I simply reload the page and try to upload the same files again, it works successfully. The key thing to remember is that I am not asked to sign in again, it is just a page refresh.

I would assume that my idle time on the page is timing out, but then I would expect it to ask me to sign in again, not just allow a page refresh.

Does anybody have any pointers or tips?

▶🚶‍Reproduction steps

1. Sign in as admin, keep browser tab page idle for around an hour with no activity.
2. Upload one or more random images. Spinning circle is shown but no progress.

😢Unexpected result

Error - request denied

📃Error log message

None

 

[Rodolfo]

Most likely sessions aren't working properly in that server, you can tell that if the auth_token changes in every request.

Open the web browser console and enter this:

PF.obj.config.auth_token

Take note on the value, refresh the page. Repeat the process and compare the results. If same, then sessions are OK.

When you start a brand-new session (php) the system sets an auth_token which is used in all sensitive forms and requests to verify that the request originated from your website. It is the most basic and elemental anti CSRF system.

If PHP sessions aren't working properly then the system described above won't work. It will also fail if the client (web browser) refuses to set cookies.

Check if your browser is accepting cookies and if sessions are working properly.

 

[Aljawaid]

Thanks for that explanation, it made so much more sense.

I confirm, the issue seems to lie with php sessions as the value changed on that console test.

The hosting company restarted php-fpm and the value seemed to have stayed.

Because of the way I use Chevereto, there is no way of measuring my idle time so I will monitor over the next few days to see if a simple retsart of the service was the solution.