Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

API Request working only in Postman and not in JavaScript code - giving NO PERMISSION error #1266

Open
jompeterson opened this issue Mar 4, 2023 · 1 comment
Open

API Request working only in Postman and not in JavaScript code - giving NO PERMISSION error #1266

jompeterson opened this issue Mar 4, 2023 · 1 comment

Comments

@jompeterson
Copy link

I'm currently writing a script to get access to the API of OpenSupport. The following is a simple page I'm using for testing:

<html>
  <head>

  </head>
  <body>
    <form method="post" action="http://localhost/support/api/staff/get-new-tickets">
        <input type="hidden" value="1" name="csrf_userid">
        <input type="hidden" value="f0540bc4ec04c7033d62d1317d411189" name="csrf_token">
        <input type="submit" value="Submit" >
    </form>
  </body>
</html>

I've tried it through doing a fetch request with the form-data Content-Type as well. It keeps giving a NO PERMISSION error. However, if I do it in Postman it seems to work without issue.

I'm using OpenSupport 4.8 for this along with PHP 7.4 and Apache 2.4.
@jompeterson
Copy link
Author

To add onto this, I went to #56 and added the following to line 18 before the $this.validate(); function call

throw new Exception(Controller::request('csrf_token'));

I did it for both csrf_token and csrf_userid. Both are returning fine.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@jompeterson