Author Topic: New mailing - page won't load in 4.6.alpha4 - overzealous AJAX security [FIXED] (Read 902 times)

ken · February 02, 2015, 02:14:19 pm

When I attempt to create a new mailing in 4.6.alpha4 I get a message saying "Initializing ...". When I refresh the browser that message goes away but the screen remains empty. This is not a WSOD but an empty CiviCRM page.

Perhaps an AJAX call is not completing?

ken · February 02, 2015, 09:16:40 pm

The AJAX call via https://example.com/civicrm/ajax/rest?entity=Attachment&action=get&json=%7B%22entity_table%22%3A%22civicrm_mailing%22%2C%22entity_id%22%3A%223816%22%7D returns the response ...

Quote

{"error_code":"unauthorized","entity":"Attachment","action":"get","is_error":1,"error_message":"API permission check failed for Attachment\/get call; insufficient permission: require access CiviCRM and access AJAX API"}

Adding the 'access AJAX API' permission solves that problem. However this is a defect.

The API security documentation says the API checks "The user has ‘access AJAX API’ (that could be granted to anonymous) OR 'access CiviCRM'". This piece of code checks for both. See http://wiki.civicrm.org/confluence/display/CRMDOC/API+Security

totten · February 24, 2015, 10:36:39 am

I believe that this and other permission issues where addressed in 4.6.alpha6. https://github.com/civicrm/civicrm-core/commit/f8be71a63eb6de24055edf499b561388d28646c3 It would be great to re-test when beta1 ships.

ken · February 27, 2015, 11:33:35 pm

@totten, this is fixed in 4.6beta1. Thanks!

joelcomit · April 20, 2015, 10:48:38 am

I'm having this issue on version 4.6.2 on WordPress 4.1.1.

joelcomit · April 20, 2015, 11:32:25 am

I refreshed...and now the page loads.

CiviCRM Community Forums (archive)

News:

Author Topic: New mailing - page won't load in 4.6.alpha4 - overzealous AJAX security [FIXED] (Read 902 times)

ken

New mailing - page won't load in 4.6.alpha4 - overzealous AJAX security [FIXED]

ken

Re: New mailing - page won't load in 4.6.alpha4

totten

Re: New mailing - page won't load in 4.6.alpha4 - overzealous AJAX security

ken

Re: New mailing - page won't load in 4.6.alpha4 - overzealous AJAX security

joelcomit

Re: New mailing - page won't load in 4.6.alpha4 - overzealous AJAX security [FIXED]

joelcomit

Re: New mailing - page won't load in 4.6.alpha4 - overzealous AJAX security [FIXED]