{"action":"created","issue":{"url":"https://api.github.com/repos/alexandregz/twofactor_gauthenticator/issues/24","labels_url":"https://api.github.com/repos/alexandregz/twofactor_gauthenticator/issues/24/labels{/name}","comments_url":"https://api.github.com/repos/alexandregz/twofactor_gauthenticator/issues/24/comments","events_url":"https://api.github.com/repos/alexandregz/twofactor_gauthenticator/issues/24/events","html_url":"https://github.com/alexandregz/twofactor_gauthenticator/issues/24","id":57638650,"number":24,"title":"apparently CSRF detected","user":{"login":"cjeanneret","id":82490,"avatar_url":"https://avatars.githubusercontent.com/u/82490?v=3","gravatar_id":"","url":"https://api.github.com/users/cjeanneret","html_url":"https://github.com/cjeanneret","followers_url":"https://api.github.com/users/cjeanneret/followers","following_url":"https://api.github.com/users/cjeanneret/following{/other_user}","gists_url":"https://api.github.com/users/cjeanneret/gists{/gist_id}","starred_url":"https://api.github.com/users/cjeanneret/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cjeanneret/subscriptions","organizations_url":"https://api.github.com/users/cjeanneret/orgs","repos_url":"https://api.github.com/users/cjeanneret/repos","events_url":"https://api.github.com/users/cjeanneret/events{/privacy}","received_events_url":"https://api.github.com/users/cjeanneret/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":16,"created_at":"2015-02-13T18:55:17Z","updated_at":"2015-06-22T16:25:49Z","closed_at":null,"body":"Hello,\r\n\r\nI just installed the plugin on my roundcube 1.1.0 (latest release for now), and I get a weird error:\r\n* I can enter my username + password\r\n* I get the OTP field\r\n* When I fill it and send the form, roundcube raises the following errors:\r\n\r\n```PHP\r\nPHP Error: Request security check failed\r\n\r\nWarning: Cannot modify header information - headers already sent in […]/roundcubemail-1.1.0/plugins/twofactor_gauthenticator/twofactor_gauthenticator.php on line 325\r\n```\r\n\r\nAfter a quick check, it seems the first error (PHP Error: Request security check failed) is raised by function \"check_request\", defined in program/include/rcmail.php, line 871.\r\nIts description is \"CSRF attack prevention code\", and it seems to check for a security token\r\n\r\nThe second error is due to the fact the twofactor_gauthenticator tries to send a header and, of course, this fails due to the presence of a string already sent to the browser.\r\n\r\nHence, I'm pretty sure the form allowing to enter the gauth code is missing some token in order to ensure there is no CSRF. Maybe it's new for 1.1.0 — dunno, I just migrated today and decided to enable a two-step thing for security improvement…\r\n\r\nInfo: if I go back on the page (F6 + enter), I'm authenticated and can access my mails as usual…\r\nThis means the session is created as expected — not really sure this is a good thing though.\r\n\r\nCheers,\r\n\r\nC."},"comment":{"url":"https://api.github.com/repos/alexandregz/twofactor_gauthenticator/issues/comments/114170988","html_url":"https://github.com/alexandregz/twofactor_gauthenticator/issues/24#issuecomment-114170988","issue_url":"https://api.github.com/repos/alexandregz/twofactor_gauthenticator/issues/24","id":114170988,"user":{"login":"alexandregz","id":1374718,"avatar_url":"https://avatars.githubusercontent.com/u/1374718?v=3","gravatar_id":"","url":"https://api.github.com/users/alexandregz","html_url":"https://github.com/alexandregz","followers_url":"https://api.github.com/users/alexandregz/followers","following_url":"https://api.github.com/users/alexandregz/following{/other_user}","gists_url":"https://api.github.com/users/alexandregz/gists{/gist_id}","starred_url":"https://api.github.com/users/alexandregz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexandregz/subscriptions","organizations_url":"https://api.github.com/users/alexandregz/orgs","repos_url":"https://api.github.com/users/alexandregz/repos","events_url":"https://api.github.com/users/alexandregz/events{/privacy}","received_events_url":"https://api.github.com/users/alexandregz/received_events","type":"User","site_admin":false},"created_at":"2015-06-22T16:25:49Z","updated_at":"2015-06-22T16:25:49Z","body":"Hiya:\r\n\r\nI create https://github.com/alexandregz/twofactor_gauthenticator/tree/skip-csrf branch, to explicit skip CSRF check, using authenticate hook from RC.\r\n\r\nCan anyone check this? Now, I can't reproduce error.\r\n\r\nThx all!"}}