6.0.0-beta1
8/12/25

[#6857] Error loging out. Required secret is invalid - potentially malicious request.
Summary Error loging out. Required secret is invalid - potentially malicious request.
Queue Horde Groupware Webmail Edition
Queue Version 1.1
Type Bug
State Not A Bug
Priority 1. Low
Owners
Requester k11h12anh (at) gmail (dot) com
Created 06/06/2008 (6276 days ago)
Due
Updated 07/13/2008 (6239 days ago)
Assigned 06/06/2008 (6276 days ago)
Resolved 07/13/2008 (6239 days ago)
Github Issue Link
Github Pull Request
Milestone
Patch No

History
07/13/2008 09:15:02 AM Jan Schneider Comment #9
State ⇒ Not A Bug
Reply to this comment
No developer is able to reproduce this. So unless you can track this 
down yourself we can't do anything about that issue.
06/24/2008 10:00:25 PM k11h12anh (at) gmail (dot) com Comment #8 Reply to this comment
I don't think so
Any chance that this is a duplicate of bug #6673 and fixed with the
patch linked from that ticket?
Did you try logging out AFTER you clicked the AddressBook? All 
operations work fine but when you are in the Turba pages and try to 
logout, you get the error.
For my Horde Groupware Webmail config it's enough to login (auth by
imap) and logout and do nothing between this two actions to provoke
this token-error. I'm using MySQL for storage, sessions and tokens,
too. I think the problem is, that only sessionhandler-table is set to
InnoDB engine, and so there are row-lock problems. The token-table
uses MyIsam, so I changed it to InnoDB (ALTER TABLE horde_tokens
ENGINE=InnoDB;) and it seems to works. By the way I've applied this
engine to all tables.
06/24/2008 09:53:32 PM Jan Schneider Comment #7 Reply to this comment
Any chance that this is a duplicate of bug #6673 and fixed with the 
patch linked from that ticket?
06/22/2008 03:03:21 PM support (at) pwv-shops (dot) de Comment #6 Reply to this comment
For my Horde Groupware Webmail config it's enough to login (auth by 
imap) and logout and do nothing between this two actions to provoke 
this token-error. I'm using MySQL for storage, sessions and tokens, 
too. I think the problem is, that only sessionhandler-table is set to 
InnoDB engine, and so there are row-lock problems. The token-table 
uses MyIsam, so I changed it to InnoDB (ALTER TABLE horde_tokens 
ENGINE=InnoDB;) and it seems to works. By the way I've applied this 
engine to all tables.
06/12/2008 12:02:30 AM k11h12anh (at) gmail (dot) com Comment #5 Reply to this comment
I have figured out exactly what is wrong, but I don't know how to fix 
it. Here is how you get to the error:



On Horde's Custom Session Handler setup tab, choose the MySQL session 
handlers then save the config. This setting causes the error. I also 
noticed the check for enabling row-level locking. Disabling this gets 
rid of the error but then you get a different error and your Address 
Book disappears and you cannot create a new one.
06/11/2008 09:23:54 PM k11h12anh (at) gmail (dot) com Comment #4 Reply to this comment
upon further investigation, I found that Address Book functionality 
doesn't work either. For example, adding a contact gives the same 
error message. I also found these errors in httpd log:



[Wed Jun 11 14:17:44 2008] [error] [client 192.168.110.33] PHP 
Warning:  mysql_error(): 18 is not a valid MySQL-Link resource in 
/var/www/html/horde/lib/Horde/SessionHandler/mysql.php on line 173, 
referer: 
https://pop.domainname.com/horde/index.php?url=https%3A%2F%2Fpop.domainname.com%2Fhorde%2Fimp%2Fmailbox.php%3Fmailbox%3DINBOX%26mailbox_token%3D851e7112c2ee85c092533ebed502b569

[Wed Jun 11 14:17:46 2008] [error] [client 192.168.110.33] PHP 
Warning:  mysql_error(): 18 is not a valid MySQL-Link resource in 
/var/www/html/horde/lib/Horde/SessionHandler/mysql.php on line 173, 
referer: 
https://pop.domainname.com/horde/imp/mailbox.php?mailbox=INBOX&mailbox_token=851e7112c2ee85c092533ebed502b569&frameset_loaded=1

[Wed Jun 11 14:18:06 2008] [error] [client 192.168.110.13] PHP 
Warning:  mysql_error(): 18 is not a valid MySQL-Link resource in 
/var/www/html/horde/lib/Horde/SessionHandler/mysql.php on line 173, 
referer: https://pop.domainname.com/horde/services/portal/sidebar.php


06/09/2008 06:25:04 PM k11h12anh (at) gmail (dot) com Comment #3 Reply to this comment
I was using SQL token but tried the filesystem token and even 
disabling it but logout still didn't work. Log file didn't show 
anything because I think this isn't really an error, it's something 
that just doesn't work. Are you using the stable Horde Groupware 
Webmail Edition 1.1 with MySQL?
Works fine here, no matter which token driver I configure in Horde.
Try looking for errors in the log files and try to configure a
different Token driver.
06/06/2008 08:41:02 PM Jan Schneider Comment #2
State ⇒ Feedback
Reply to this comment
Works fine here, no matter which token driver I configure in Horde. 
Try looking for errors in the log files and try to configure a 
different Token driver.
06/06/2008 07:04:11 PM k11h12anh (at) gmail (dot) com Comment #1
Milestone ⇒
State ⇒ Unconfirmed
Patch ⇒ No
Queue ⇒ Horde Groupware Webmail Edition
Summary ⇒ Error loging out. Required secret is invalid - potentially malicious request.
Type ⇒ Bug
Priority ⇒ 1. Low
Reply to this comment
Clicking on the "Log Out" button from any Address Book option screen 
gives an error "Required secret is invalid - potentially malicious 
request."



Steps to error:



1. Click Address Book

2. Click Options

3. choose and click one of the Options for Address Book

4. click the Log Out button

Saved Queries