XF 1.4 Permissions Problem Uploading

[Hugh Edwards]

Hi.

I just uninstalled an old application that i didn't use anymore (I presume this is the cause) and all of a sudden my permissions are not working for uploading attachments into any forums. I've checked my Attachment options and users are allowed to upload 2 attachments. I've also checked the permissions for the nodes and they seem to be set correctly - I have also analysed the permissions and any permission associated with the word upload is Yes for all users.....but....when I click the upload button I immediately get a popup saying "You do not have access to this page or to perform that action".

Any way I can get the database to rebuild it's permissions, or alternatively can anyone think of a path that will help resolve this?

thanks!

Hugh.

P.s., it was working fine until I removed that app....

 

[Hugh Edwards]

PS this happens on both new and old threads.

 

[Hugh Edwards]

PPS nothing in the error logs.

 

[Hugh Edwards]

PS I don't mind upgrading the forum if that will fix the issue but i can't go to V2 yet as the Xenforo Bridge software hasn't yet been updated to work with v2 yet.....

 

[Mike]

If the upload button appears, it's probably not directly permission related. What did you uninstall?

 

[Hugh Edwards]

It was a custom thing by an old company called Waindigo - linked to Infusionsoft - no longer relevant to us. Is there a way to turn on debugging or sometihng?

 

[Paul B]

Try running the permission clean up in the Tools menu, then toggle a permission off and on to trigger a rebuild.

Does that change anything?

 

[Hugh Edwards]

Hi Brogan.

I could dearly love to run the permission clean up in the Tool menu - but it doesn't look like that's an option in there?

 

[Paul B]

Just noticed you're running 1.4 - that function was likely added later.

Try toggling a permission then to see if it rebuilds correctly.

 

[Mike]

Can you run a query against your database?

SELECT * 
FROM `xf_content_type_field` 
WHERE `field_name` = 'attachment_handler_class'

What does that return?

 

[Hugh Edwards]

Hi Mike,

This:

 

[Hugh Edwards]

Would upgrading to a version that has the permissions builder help? If so, what version did that come in?

 

[Hugh Edwards]

(PS @Brogan - no, changing the permissions to no upload and then saving and then back again didn't fix the problem - I still get the popup )

 

[Mike]

How about this query?

SELECT * 
FROM `xf_content_type` 
WHERE `content_type` = 'post'

Try also going to <url>/install/ and choosing the option to rebuild the master data?

 

[Hugh Edwards]

Here's the result of the second query:



Trying the URL now....

 

[Hugh Edwards]

Aha - when trying to do the rebuild master data I get this:

Server Error
libxml_disable_entity_loader() has been disabled for security reasons

1. XenForo_Application::handlePhpError()
2. libxml_disable_entity_loader() in Zend/Xml/Security.php at line 47
3. Zend_Xml_Security::scan() in Zend/Xml/Security.php at line 99
4. Zend_Xml_Security::scanFile() in XenForo/Helper/DevelopmentXml.php at line 17
5. XenForo_Helper_DevelopmentXml::scanFile() in XenForo/Model/AdminNavigation.php at line 607
6. XenForo_Model_AdminNavigation->importAdminNavigationDevelopmentXml() in XenForo/Deferred/ImportMasterData.php at line 16
7. XenForo_Deferred_ImportMasterData->execute() in XenForo/Deferred/Atomic.php at line 66
8. XenForo_Deferred_Atomic->execute() in XenForo/Model/Deferred.php at line 294
9. XenForo_Model_Deferred->runDeferred() in XenForo/Model/Deferred.php at line 428
10. XenForo_Model_Deferred->_runInternal() in XenForo/Model/Deferred.php at line 354
11. XenForo_Model_Deferred->runByUniqueKey() in XenForo/Install/Controller/Abstract.php at line 34
12. XenForo_Install_Controller_Abstract->_manualDeferredRunner() in XenForo/Install/Controller/Upgrade.php at line 221
13. XenForo_Install_Controller_Upgrade->actionRunDeferred() in XenForo/FrontController.php at line 347
14. XenForo_FrontController->dispatch() in XenForo/FrontController.php at line 134
15. XenForo_FrontController->run() in /www/gravyforthebrain_994/public/xenforo/install/index.php at line 18

Any thoughts on what is disabled on the server?

 

[Mike]

That error is unlikely to be related. However, it's a very odd function to disable. Your host has added that function to disable_functions in php.ini.

The ironic/scary thing is that by disabling that function, they're actually causing a potential security issue. This function is used to prevent a specific sort of attack.

As you presumably don't have php.ini access, you'll need to contact your host to have them enable that function.

 

[Hugh Edwards]

That error is unlikely to be related. However, it's a very odd function to disable. Your host has added that function to disable_functions in php.ini.

The ironic/scary thing is that by disabling that function, they're actually causing a potential security issue. This function is used to prevent a specific sort of attack.

As you presumably don't have php.ini access, you'll need to contact your host to have them enable that function.

Yep - on the case with them. It seems the hosting company has disabled lots of stuff for security purposes - is there a list somewhere of what needs to be enabled, and/or a page which will check that for me?

(The /xenforo/ app was copied from one hosting company to another - and not a fresh install - hence why any installation checks were not done which would have presumeably flagged this!)

 

[Hugh Edwards]

Anything you can advise me on re ^ @Mike ?

 

[Mike]

Unfortunately, there isn't really a definitive list of functions that can't be disabled. Any function can be disabled in PHP, so unfortunately the rule is really "any function we use or may consider using in the future", which is likely 1000s of functions and will change over time. This is the first time I've ever seen this function disabled and I really don't know why it would be disabled.

For the things that we do check, the first page of the upgrade system would normally list any errors or warnings. We do warn on some commonly disabled functions (particularly in XF2).