cant access acp The submitted form was invalid. Try submitting again.

Get help with installation and running phpBB 3.2.x here. Please do not post bug reports, feature requests, or extension related questions here.
Post Reply
robtig
Registered User
Posts: 28
Joined: Thu May 21, 2015 3:45 pm

cant access acp The submitted form was invalid. Try submitting again.

Post by robtig » Thu May 09, 2019 1:05 pm

I updated from 3.1.9 to 3.2.7 ytesterday. Wasnt having any issues getting into acp but when I went to login this morning to make some fixes it wont let me get into the acp I can log onto the site but when I try acp it says ' The submitted form was invalid. Try submitting again.'

Tried deleting cache via ftp but made no difference. Dont understand why it was working but now is not.

I am willing to pay for help as there are things I will need help on once I get this straightened out and I only have 2 more days off work to get all this done. Kinda looking for someone I can instant message to help me as I come across problems. Site is viragohelp.com/phpbb3/.

.m.
Registered User
Posts: 438
Joined: Wed Nov 04, 2009 8:39 pm

Re: cant access acp The submitted form was invalid. Try submitting again.

Post by .m. » Thu May 09, 2019 1:33 pm

can you try using a different web browser to login ...
[or try using incognito / private mode of browser]

robtig
Registered User
Posts: 28
Joined: Thu May 21, 2015 3:45 pm

Re: cant access acp The submitted form was invalid. Try submitting again.

Post by robtig » Thu May 09, 2019 1:42 pm

just figured it out. used disable all extensions file. uploaded it through ftp then ran it and now I can get in. Must have been an extension I tried putting back that broke it. Still will need more help though I am sure but I figured out this one =)

User avatar
Mick
Support Team Member
Support Team Member
Posts: 21307
Joined: Fri Aug 29, 2008 9:49 am
Location: Watching cricket - definitely

Re: cant access acp The submitted form was invalid. Try submitting again.

Post by Mick » Thu May 09, 2019 2:00 pm

robtig wrote:
Thu May 09, 2019 1:05 pm
I am willing to pay for help
Solicitation isn’t allowed in the regular forums, but we have a new forum called Wanted! where you may ask for paid work.
"The more connected we get the more alone we become" - Kyle Broflovski

omeroon
Registered User
Posts: 22
Joined: Thu Apr 26, 2018 1:39 pm

Re: cant access acp The submitted form was invalid. Try submitting again.

Post by omeroon » Fri May 10, 2019 1:35 pm

You are probably missing the form token in your (extension) templates.

Check: viewtopic.php?f=556&t=2509981

User avatar
EA117
Registered User
Posts: 745
Joined: Wed Aug 15, 2018 3:23 am
Contact:

Re: cant access acp The submitted form was invalid. Try submitting again.

Post by EA117 » Fri May 10, 2019 2:04 pm

omeroon wrote:
Fri May 10, 2019 1:35 pm
You are probably missing the form token in your (extension) templates.
Yes and no; the form token may be what's missing, but not because the template wasn't updated. You are correct that this was directly the issue in phpBB 3.2.6. But phpBB 3.2.7 "forgives" a template which hasn't been updated yet, and inserts the form token anyway.

So you definitely still want to get the templates updated before phpBB ends this "forgiveness" in a future release, but even a phpBB 3.2.5-level template still works for login in phpBB 3.2.7.

An extension which initiates a login form on its own and hasn't been updated to call add_form_token() as part of building the page could cause the "invalid form" result on phpBB 3.2.6 or phpBB 3.2.7, even if the template in use was already updated.

robtig, if you can't find a correlation to a particular extension, also make sure your cookie settings are still correct and maybe even clear your cookies for the site and re-create them. (This is really just the same as .m.'s idea to use a different browser or incognito, though.)

If your hosting service provides any caching similar to CloudFlare, perhaps also make sure this caching isn't trying to act against your phpBB site. Presenting a cached version of the login form that was built for some other session is another reason why the outcome could result in "form invalid" now.

omeroon
Registered User
Posts: 22
Joined: Thu Apr 26, 2018 1:39 pm

Re: cant access acp The submitted form was invalid. Try submitting again.

Post by omeroon » Fri May 10, 2019 3:29 pm

EA117 wrote:
Fri May 10, 2019 2:04 pm
Yes and no; the form token may be what's missing, but not because the template wasn't updated. You are correct that this was directly the issue in phpBB 3.2.6. But phpBB 3.2.7 "forgives" a template which hasn't been updated yet, and inserts the form token anyway.
Unfortunately this doesn't work if your templateset allows you to login from for instance the search page, I think the token is only created on the index and the login (UCP) page itself. The form token marker might be there in your template, but rendered empty.

User avatar
Lumpy Burgertushie
Registered User
Posts: 66471
Joined: Mon May 02, 2005 3:11 am
Contact:

Re: cant access acp The submitted form was invalid. Try submitting again.

Post by Lumpy Burgertushie » Fri May 10, 2019 4:32 pm

edit, I see from your other post the answer to my question.

robert
I'm baaaaaccckkkk. still doing work on donation basis. PM your needs.

Premium phpBB 3.2 Styles by PlanetStyles.net

If a tree falls in the forest and nobody is there, does it make a sound?

User avatar
EA117
Registered User
Posts: 745
Joined: Wed Aug 15, 2018 3:23 am
Contact:

Re: cant access acp The submitted form was invalid. Try submitting again.

Post by EA117 » Fri May 10, 2019 4:48 pm

omeroon wrote:
Fri May 10, 2019 3:29 pm
Unfortunately this doesn't work if your templateset allows you to login from for instance the search page, I think the token is only created on the index and the login (UCP) page itself. The form token marker might be there in your template, but rendered empty.
Agreed; that sounds more like a case where the template was trying to offer a login form in a scenario where phpBB itself wouldn't have already inherently called add_form_token() to generate the needed fields. Those needed fields will come through whether the template has {S_FORM_TOKEN_LOGIN} or not (at least for now, in phpBB 3.2.7); but add_form_token() must have been called in order for those required form fields to even exist at all.

I can't see or claim knowledge on how Metro actually achieves its "pop-up login boxy thingy", since it's not a publicly accessible style. But I suspect it must involve some PHP code that is in need of an add_form_token() call now, in phpBB 3.2.6 and later.

omeroon
Registered User
Posts: 22
Joined: Thu Apr 26, 2018 1:39 pm

Re: cant access acp The submitted form was invalid. Try submitting again.

Post by omeroon » Mon May 13, 2019 11:33 am

Exactly. The add_form_key() function call was only added to pages where phpBB already had login functionality, like on the index page at the bottom or on the login page itself. Other pages (like viewforum.php) don't generate a form token and therefore will render an empty {S_FORM_TOKEN_LOGIN} .

Metro actually uses the fields of the quick login (that is on the bottom of the index page in Prosilver) and puts that in a popup. No PHP involved here, it's only a template and some javascript. But because phpBB doesn't render the form token on other pages besides the ucp.php and index.php it now misses the form key. By adding add_form_key() to all the other pages manually you can probably fix it, but I think I will try to do this using a hook/extension so I don't need to fiddle with the forum code itself.
Last edited by omeroon on Mon May 13, 2019 12:46 pm, edited 2 times in total.

User avatar
EA117
Registered User
Posts: 745
Joined: Wed Aug 15, 2018 3:23 am
Contact:

Re: cant access acp The submitted form was invalid. Try submitting again.

Post by EA117 » Mon May 13, 2019 12:07 pm

omeroon wrote:
Mon May 13, 2019 11:33 am
Other pages (like viewforum.php) don't generate a form token and therefore will render an empty {S_FORM_TOKEN_LOGIN}.
Agreed; phpBB 3.2.6 missed add_form_token() and {S_FORM_TOKEN_LOGIN} on at least two other login forms, which were the subject of https://github.com/phpbb/phpbb/pull/5578/files. The phpBB 3.2.7 release already contains those changes. Potentially still not addressed is ucp_login_link.html in https://tracker.phpbb.com/browse/PHPBB3-16046.

I believe I understand now what you're explaining regarding Metro, though. It hadn't been clear to me that prior to phpBB 3.2.6, it was "possible to login from any page." I was thinking that the even the {S_LOGIN_REDIRECT} field in phpBB 3.2.5 and earlier wasn't being created "except from forms where phpBB expects login to occur." But I see now I was wrong, and {S_LOGIN_REDIRECT} is available for every page.

So I agree with you, nothing in phpBB 3.2.6 or phpBB 3.2.7 would help a style which had been offering login via template changes alone on pages that phpBB itself doesn't offer login. Those other pages where login was offered by the style templates alone will now fail.

omeroon
Registered User
Posts: 22
Joined: Thu Apr 26, 2018 1:39 pm

Re: cant access acp The submitted form was invalid. Try submitting again.

Post by omeroon » Mon May 13, 2019 12:45 pm

You understand correctly, that is indeed exactly the problem.

Other templatesets may face the same issue. A quick fix is to remove any popup and just link to the login page.

Or hope the phpBB core team will add it in every page in 3.2.8. :mrgreen:

User avatar
EA117
Registered User
Posts: 745
Joined: Wed Aug 15, 2018 3:23 am
Contact:

Re: cant access acp The submitted form was invalid. Try submitting again.

Post by EA117 » Mon May 13, 2019 12:57 pm

omeroon wrote:
Mon May 13, 2019 12:45 pm
Or hope the phpBB core team will add it in every page in 3.2.8.
Agreed. Will be a small bit of additional overhead to create the hashed data "for every single page now", but that's the only thing that matches the prior capability of "you could login from any page if the template wanted to" while still addressing the security issue phpBB 3.2.6 and later intended to address.

edit: Also now https://tracker.phpbb.com/browse/PHPBB3-16054.

If you were interesting in solving Metro now in phpBB 3.2.7, what I would try is adding an add_form_key() call at line 4442 in the page_header() function in /includes/functions.php, such that instead of just:

Code: Select all

	$s_login_redirect = build_hidden_fields(array('redirect' => $phpbb_path_helper->remove_web_root_path(build_url())));
the code would now read:

Code: Select all

	// Add form token for login in case page wants to offer login
	add_form_key('login', '_LOGIN');

	$s_login_redirect = build_hidden_fields(array('redirect' => $phpbb_path_helper->remove_web_root_path(build_url())));
That's not "the complete change" desired for phpBB 3.2.8, since the add_form_key() calls added elsewhere could be reverted back out. And slightly inefficient, since add_form_key() will still be called twice in some cases. But it should be what allows S_FORM_TOKEN_LOGIN to exist "everywhere"; to the same extent that S_LOGIN_REDIRECT did, anyway. I can only confirm that the standard proSilver logins continue to work with this change; I don't have "Metro" to confirm the expected success there.

Note I was mis-speaking earlier with "add_form_token()", and did of course mean "add_form_key()".

Pre-edited /includes/functions.php for phpBB 3.2.7 attached, for anyone who wants to try this change, and has a style template which was offering a login form that standard proSilver does not offer, and this login form does not work in phpBB 3.2.6 and later:
functions.php
(157.29 KiB) Downloaded 8 times

omeroon
Registered User
Posts: 22
Joined: Thu Apr 26, 2018 1:39 pm

Re: cant access acp The submitted form was invalid. Try submitting again.

Post by omeroon » Mon May 13, 2019 2:20 pm

Nice, awesome work! Also for the bugreport, super!!!

I fixed it using an extension. We are running a bit of a complex forum setup, containing 1 installation for multiple forums. To be able to update quickly I keep all core forum files "as is" and do all my modifications in a couple of custom extensions.

One of those extensions extracts the header / footer of the main website and uses this as the header/footer of the forum too, to integrate the forum seamlessly into the site (so changes to the menu flow directly into the forum as well). This extension is loaded on every page, so I just added the add_form_key there and I was done. :mrgreen:

If a future version does support it again I just need to remove 1 line of code.

Anyway, thanx for bearing with me on this one and getting to the bottom of it. :)

Post Reply

Return to “[3.2.x] Support Forum”