Invalid Request error woes.

[KProvance]

Script URL: http://www.suncoastcomputerguy.com/helpdesk
Version of script: 2.5.2
Hosting company: Bluehost
URL of phpinfo.php: http://www.suncoastcomputerguy.com/x.php
URL of session_test.php: http://www.suncoastcomputerguy.com/help ... n_test.php
What terms did you try when SEARCHING for a solution: "invalid request" hesk"

Write your message below:

Well, I installed and modified this script specifically for computer repair earlier this year and it worked great for a while. Somewhere along the way, when attempting to update information for clients, or change their status, I keep getting "Error: Invalid request". Even if I attempt to change a setting, when I click Save Settings, I get the same message.

I've been doing PHP for a number of years, so under the hesk_token_check function, I added

Code: Select all

echo 'token:' . $my_token;
echo 'session:' . $_SESSION['token'];

The result are never the same. The are always different.

I try to log out, but upon clicking Logout, it does not. It kicks me back to the home page where tickets are listed. I've tried clearing the cookies for my site, which gets me back to the admin logon prompt. But, after I logon, the same problem comes right back. Invalid request errors, and the inability to logout. I installed the exact same script in a XAMPP setup on my local hard drive, and the problem does NOT occur, so I have to figure something on my web server is not set properly, but I have no idea where to look. The only thing I change in the last few months was the upgrade to PHP 5.4 from 5.2. Could that be the culprit?

Thanks for the kind attention.

- Kevin

[Klemen]

Do you get any new error messages if you turn Debug mode to ON in HESK settings?

If you make a clean HESK installation (original unmodified files) in a test folder, does it work OK there?



My guess is something is breaking the sessions.

The first thing I would check is to make sure all modified files are saved in UTF-8 *WITHOUT* BOM (byte order mark).

I don't know what editor you use, but see if it has option to save in UTF-8 without BOM.

If not, use a more powerful editor, such as this one:
http://notepad-plus-plus.org/

You can manually confirm the issue and remove the extra bytes also by following these steps:
viewtopic.php?t=2713
Username: php
Password: php

Or you can try a tool to detect and remove BOM:
https://github.com/emrahgunduz/BomCleaner

[KProvance]

Hi Klemen,

I use Netbeans 7.4. Typically I make changes locally on XAMPP, test them, and then push them onto my web server. I've also written a theme a several plug-in for Wordpress this way without any BOM issues. But, Murphy's law being what it is, I will check each page anyway. If I *must* edit directly on the server, I use CPanel's crappy file manager, which Bluehost swears respects the BOM issue (we went through that a couple years back when I moved my site there off a Windows server)

I checked the PHP error log, and there is nothing specific to HESK. There are some Notices regarding the Wordpress integration (Undefined constants, mostly), but that was never a problem as far as functionality went...at least I didn't think so. Like I said, the XAMPP install works perfectly, even with the PHP Notices from the Avada theme.

Anyways, I'll execute your suggestions and report what happens.

Thanks, mate.

- Kevin

[KProvance]

Ran the BOM check (nice tool, BTW) and there were no offending files. Went ahead and did a clean test install, which seemed to work fine. It is pointing to the same MySQL database the other install is using. I did this to see if the database was the culprit.

I went back into the previous install. It let me in, but now whenever I try to do *anything*, it kicks me back out to the logon screen with the "Your session has expired, please login using the form below." I try to login again, and it kicks me back to the same error message.

The only way to get a successful login is to select "Log me on automatically each visit", but then I get all those "Invalid request" messages, and cannot logout without clearing cookies.

I'm at a loss. I used the Netbeans Diff feature between my modded install and a clean install, and the only changes are 1) the addition of the wordpress call

Code: Select all

require('../wp-load.php');

where required, and the addition of the wordpress header and footer called in the header and footer inc files, and 2) the hard coded addition of 6 new input fields which all piggy back the ones already in the code. I wanted to see if any code in relation to the tokenizing was changed.

I'm wondering if maybe the Wordpress integration is doing it. They did release the 3.7 version in the last month. Thoughts?

As I said, this all worked fine for several months, until the switch to php 5.4. Now it's a mess.

[KProvance]

I was looking in the wrong place. It had nothing to do with the switch to PHP 5.4. It was the upgrade to Wordpress 3.7 that messed everything up.

I backed out all the WP integration code and all the problems went away. I can only surmise by this that the session handler for WP was messing with HESK's. This sucks, because now the helpdesk and the site are not uniform in appearance, but I do understand this is not a HESK issue, so I won't bother you with it. I can always go with an iFrame until I can go through the diff changes in WP and see what they changed, and if it's even possible to integrate again, although I am not hopeful, as it's not worth hacking either code base to the extent I believe will be necessary.

It's odd, because my clients were reporting no problems from their end. It only seemed to be an issue in the admin panel(s). Perhaps the integration only needs to happen for the front end, and not the back end?

Anyways, I appreciate the assistance. On a personal note, I am curious: Why do you favour the whitespace heavy curly bracket style? Example:

Code: Select all

If ($foo == $bar)
{
    do_something();
}

versus

Code: Select all

if ($foo == $bar){
    do_something();
}

Cheers

- Kev

[Klemen]

Glad to hear you figured it out.

Regarding the whitespace heavy curly bracket style it's just a personal preference - I prefer it this way as I find it more readable.