Phpservermon: Issue with CSRF key on ajax call of saveLayout

[amelhorn]

On the latest develop branch of 3.2.0 I am getting an "unauthorized" (from the custom 401) response on the ajax call made when switching between flow and list layouts on the Status page. Thus it does not save my current page when the auto-refresh happens (always switching back to flow).

I traced it back, and as far as I can tell there is no CSRF key set in StatusController.php (as there are in the other controller files). When tracing I got a return of '' for my session's CRSF key.

I tried to fix but could not.

Edit* Two thoughts ran together there at the end

[sadortun]

@vus520 Any ideas ?

[vus520]

sorry about not tested CRSF.
I will fix today. ;)

[amelhorn]

Not a problem - thank you!

[vus520]

I have some progress now.
I tested develop branch and i'm sure the AJAX refresh will send a GET request.

As i know the CSRF check will only require for POST request.
https://github.com/phpservermon/phpservermon/blob/develop/src/psm/Router.php#L159

I'm not sure i have tested the right way or you have some other code changes.
I would greatly appreciate you provide some test methods or provide some more infomation.

[amelhorn]

You can test if it is working depending on the response from the AJAX call made when you switch from flow to list layout. If the ajax call returns the correct JSON, and not "Unauthorized".
In the current develop branch it sends it as POST - https://github.com/phpservermon/phpservermon/blob/develop/static/js/scripts.js#L140

[vus520]

thanks to @amelhorn I fixed this bug.
Now you can test on my develop branch, I will send a pr if you can pass test.

https://github.com/nutsteam/phpservermon/tree/ajax_auto_refresh

[sadortun]

@vus520 great, feel free to submit a PR when the fix has been tested.

[amelhorn]

@vus520 Yep - just copied your changes to my local and it all worked perfectly; Thank you for fixing!