upload AJAX field won't upload when page is cached

  • Posts: 507
  • Thank you received: 21
  • Hikashop Business
1 year 8 months ago #350311

-- HikaShop version -- : 4.7.1
-- Joomla version -- : 4.2.9
-- PHP version -- : 8.0
-- Error-message(debug-mod must be tuned on) -- : upload bar turn red

Hi,

I'm struggling with a problem for some time now. I use the JCH Optimize plugin for fast loading of the website. On a lot of productpages I have a Ajax upload field where customers can upload their photo/logo/file. When these pages are cached, the upload field fails and the uploadbar turns red. When you give the page a refresh (ctrl-f5) the upload is working again.

I reported this to the developer of the JCH plugin and he really tried to solve this but at the end this was his conclusion:
"The solution would have to come from the developer of the hikashop extension. Let them know whenever the page is cached the upload doesn't work. I can only implement a caching mechanism, but if a third-party component doesn't work when cached, the fix has to come from the developer. What I can offer, are options to exclude the offending component so that other pages can be cached.

Another thing you can try is to exclude the actual URL that the Ajax requests are sent to. Excluding the com_ajax component won't work, as only modules and plugins need to use this. I tried to find it but I couldn't, so again, you'd need to contact the developer for this. Exclude the Hikashop component from the cache may be a workaround until they can come up with a proper fix."

Is there a way you can fix this?

Thanks, Michel P.

Attachments:

Please Log in or Create an account to join the conversation.

  • Posts: 83007
  • Thank you received: 13400
  • MODERATOR
1 year 8 months ago #350314

Hi,

If I look at the AJAX request when I upload an image on your page, I get a fatal error message:
i.imgur.com/KKNLPAd.png
And CTRL+F5 doesn't fix the problem on my end.
This looks like a PHP error caused by the update of PHP to a newer version.
You should activate the "debug" setting of the Joomla configuration and reproduce the error and look at the AJAX request with the network tab of the developer tools of your browser (like I did in my screenshot) and that should display the full error message which will be necessary to understand what's wrong.
An alternative is to look at the PHP error log of your server. It should contain the full fatal error message.

Please Log in or Create an account to join the conversation.

  • Posts: 507
  • Thank you received: 21
  • Hikashop Business
1 year 8 months ago #350326

Hi,

Thanks. I activated the debug and have set error reporting to max. But it only shows "Error" access denied, see screenshot. I don't see any error in the log file.

jouwnaambord.nl/rvs-look-bewegwijzering-zelfklevend

Attachments:
Last edit: 1 year 8 months ago by michelpouli.

Please Log in or Create an account to join the conversation.

  • Posts: 83007
  • Thank you received: 13400
  • MODERATOR
1 year 8 months ago #350328

Hi,

That's strange. It's a completely different error. And I can also see the same thing as you now.

And if you turn off the debug, do you then get the error I had in my screenshot ?

Regarding the error "Toegang verboden", I spent some time, tracking it's origin, and it apparently is not "access denied" but "access forbidden" and uses the translation key JLIB_APPLICATION_ERROR_ACCESS_FORBIDDEN
Looking in HikaShop's code for this, I can see that this error message will appear if someone try to use a task of a controller which changes things, without providing the access token generated by Joomla and stored in the user session.
Caching would definitely be a problem for this since this would mean that you would provide the access token of someone else who generated the page in the past, and not yours in your user session, and thus it would block the action with that error message.
This is a security mechanism to prevent XSS attacks so that malicious scripts can't change things on the website from the browser of someone logged in.

The best would be to not have caching on all the pages where you have upload fields. So basically, all the product details pages.

Alternatively, I think we could lower the checks there without it being a problem for the security.
Try removing the line:

var $modify = array('upload');
in the file components/com_hikashop/controllers/upload.php
If you still have the issue with the error message "Invalid Token", try also removing the line:
JSession::checkToken() || die('Invalid Token');
This will allow the upload to work regardless of the token. There will still be all the other checks on upload enforced (like for example, the checks on the filename extensions allowed, etc), so it shouldn't be a problem.

Please let us know how this goes.

Please Log in or Create an account to join the conversation.

  • Posts: 507
  • Thank you received: 21
  • Hikashop Business
1 year 8 months ago #350342

Hi Nicolas,

Yes you're right, I translated wrong, sorry about that. When the debug turned off I get the same error as you.

Thanks for your suggestion, I first disabled the "var $modify = array('upload');" line, but that didn't change anything. After removing the second suggested line, I get a new error: Invalid Token, see screenshot.

Attachments:

Please Log in or Create an account to join the conversation.

  • Posts: 83007
  • Thank you received: 13400
  • MODERATOR
1 year 8 months ago #350345

Hi,

It might come from the same line:

JSession::checkToken() || die('Invalid Token');
in the process function of administrator/components/com_hikashop/helpers/upload.php
Please try removing this one too.

Please Log in or Create an account to join the conversation.

  • Posts: 507
  • Thank you received: 21
  • Hikashop Business
1 year 8 months ago #350358

Hi Nicolas,

Thanks again for your great support. It looks like the problem is solved, the upload worked on several different tests without errors.

You're the best!

Please Log in or Create an account to join the conversation.

  • Posts: 507
  • Thank you received: 21
  • Hikashop Business
1 year 7 months ago #351306

Hi Nicolas,

I updated to the latest version of Hikashop, but this issue is back (obviously). I made the same changes to the suggested files, but this is of course no ideal solution. Is there another permanent way to solve this without a security risk (and so I don't have to change the files every time on a update)? I guess there must be other JCH optimize users with the same problem?

Please Log in or Create an account to join the conversation.

  • Posts: 507
  • Thank you received: 21
  • Hikashop Business
1 year 5 months ago #352726

Hi,

I just updated to version 4.7.4 because I saw in the changelog "The AJAX upload system can now work even on pages where JCH Optimize is configured to cache the javascript."

But the field still turns red when trying to upload? (so now I made the changes to the upload.php again to make it work)

Please Log in or Create an account to join the conversation.

Time to create page: 0.051 seconds
Powered by Kunena Forum