Skip to content

Commit 3d262f8

Browse files
bubasumabubasuma
committed
MC-43161: "Invalid security or form key. Please refresh the page" error message after login with custom backend frontname and URL secret key enabled.
1 parent d796127 commit 3d262f8

File tree

4 files changed

+84
-4
lines changed

4 files changed

+84
-4
lines changed

‎app/code/Magento/Backend/App/Action/Plugin/Authentication.php

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -225,10 +225,9 @@ protected function _redirectIfNeededAfterLogin(\Magento\Framework\App\RequestInt
225225

226226
// Checks, whether secret key is required for admin access or request uri is explicitly set
227227
if ($this->_url->useSecretKey()) {
228-
$requestParts = explode('/', trim($request->getRequestUri(), '/'), 3);
229-
$baseUrlPath = trim(parse_url($this->backendUrl->getBaseUrl(), PHP_URL_PATH), '/');
230-
$routeIndex = empty($baseUrlPath) ? 0 : 1;
231-
$requestUri = $this->_url->getUrl($requestParts[$routeIndex]);
228+
// The requested URL has an invalid secret key and therefore redirecting to this URL
229+
// will cause a security vulnerability.
230+
$requestUri = $this->_url->getUrl($this->_url->getStartupPageUrl());
232231
} elseif ($request) {
233232
$requestUri = $request->getRequestUri();
234233
}

‎app/code/Magento/Backend/Test/Mftf/ActionGroup/AdminLoginWithCustomUrlActionGroup.xml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
/**
4+
* Copyright © Magento, Inc. All rights reserved.
5+
* See COPYING.txt for license details.
6+
*/
7+
-->
8+
9+
<actionGroups xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
10+
xsi:noNamespaceSchemaLocation="urn:magento:mftf:Test/etc/actionGroupSchema.xsd">
11+
<actionGroup name="AdminLoginWithCustomUrlActionGroup" extends="AdminLoginActionGroup">
12+
<annotations>
13+
<description>Login to specific backend URL.</description>
14+
</annotations>
15+
<arguments>
16+
<argument name="customUrl" type="string"/>
17+
</arguments>
18+
19+
<amOnPage url="{{customUrl}}" stepKey="navigateToAdmin"/>
20+
</actionGroup>
21+
</actionGroups>

‎app/code/Magento/Backend/Test/Mftf/Section/AdminHeaderSection.xml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,5 +17,6 @@
1717
<element name="pageHeading" type="text" selector=".page-content .page-heading"/>
1818
<!-- Used for page not found error -->
1919
<element name="pageNotFoundTitle" type="text" selector=".page-title span"/>
20+
<element name="signOut" type="button" selector=".page-header .account-signout"/>
2021
</section>
2122
</sections>

‎app/code/Magento/Backend/Test/Mftf/Test/AdminRedirectToStartupPageAfterLoginIfSecretKeyEnabledTest.xml

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
/**
4+
* Copyright © Magento, Inc. All rights reserved.
5+
* See COPYING.txt for license details.
6+
*/
7+
-->
8+
9+
<tests xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
10+
xsi:noNamespaceSchemaLocation="urn:magento:mftf:Test/etc/testSchema.xsd">
11+
<test name="AdminRedirectToStartupPageAfterLoginIfSecretKeyEnabledTest">
12+
<annotations>
13+
<features value="Backend"/>
14+
<stories value="Login on the Admin Backend"/>
15+
<title value="Admin should not be redirected to the requested page after login if secret key is enabled"/>
16+
<description value="Admin should not be redirected to the requested page after login if secret key is enabled"/>
17+
<severity value="AVERAGE"/>
18+
<testCaseId value="AC-1145"/>
19+
<useCaseId value="MC-43161"/>
20+
<group value="backend"/>
21+
</annotations>
22+
<before>
23+
<!-- Add Secret Key to URLs -->
24+
<magentoCLI command="config:set admin/security/use_form_key 1" stepKey="enableUrlSecretKeys"/>
25+
<actionGroup ref="AdminLoginActionGroup" stepKey="loginAsAdmin"/>
26+
</before>
27+
<after>
28+
<magentoCLI command="config:set admin/security/use_form_key 0" stepKey="disableUrlSecretKeys"/>
29+
<actionGroup ref="AdminLogoutActionGroup" stepKey="logoutFromAdmin"/>
30+
</after>
31+
32+
<!-- Assert succesful login without any error message -->
33+
<dontSeeElement selector="{{AdminMessagesSection.error}}" stepKey="dontSeeErrorMessage1"/>
34+
<!-- Assert current page is dashboard -->
35+
<seeCurrentUrlMatches regex="~\/admin\/dashboard\/~" stepKey="seeCurrentUrlMatchesDashboardUrl"/>
36+
<grabFromCurrentUrl stepKey="dashboardUrl"/>
37+
<!-- Navigate to web configuration -->
38+
<actionGroup ref="AdminNavigateMenuActionGroup" stepKey="navigateToFindPartnersAndExtensions">
39+
<argument name="menuUiId" value="magento-backend-stores"/>
40+
<argument name="submenuUiId" value="magento-config-system-config"/>
41+
</actionGroup>
42+
<actionGroup ref="AdminOpenConfigNavItemActionGroup" stepKey="navigateToWebConfig">
43+
<argument name="navItem" value="Web" />
44+
</actionGroup>
45+
<!-- Grab current URL -->
46+
<grabFromCurrentUrl stepKey="webConfigurationUrl"/>
47+
<!-- Logout -->
48+
<grabAttributeFrom selector="{{AdminHeaderSection.signOut}}" userInput="href" stepKey="logoutUrl"/>
49+
<amOnPage url="{$logoutUrl}" stepKey="logout2"/>
50+
<!-- Login with directt url -->
51+
<actionGroup ref="AdminLoginWithCustomUrlActionGroup" stepKey="loginAndRedirectToRequestedPage">
52+
<argument name="customUrl" value="$webConfigurationUrl"/>
53+
</actionGroup>
54+
<!-- Assert succesful login without any error message -->
55+
<dontSeeElement selector="{{AdminMessagesSection.error}}" stepKey="dontSeeErrorMessage2"/>
56+
<!-- Assert current page is dashboard -->
57+
<seeCurrentUrlMatches regex="~\/admin\/dashboard\/~" stepKey="seeCurrentUrlMatchesDashboardUrl2"/>
58+
</test>
59+
</tests>

0 commit comments

Comments
 (0)