SID-01329: AUTOINC not counting up until "refresh" is pressed.

Status:	Answered	TWiki version:	5.1.0	Perl version:
Category:	CategoryTemplates	Server OS:		Last update:	14 years ago

I am creating new topics via the AUTOINC function, which basically works.

<input type="text" name="topic" value="CillerTopicIDAUTOINC0000" size="50" />
<input type="hidden" name="templatetopic" value="CillerTopicTemplate" />
<input type="hidden" name="topicparent" value="%TOPIC%" />
<input type="hidden" name="onlywikiname" value="on" />
<input type="hidden" name="onlynewtopic" value="on" />
<input type="submit" class="twikiSubmit" value="Create" />

As a result, I get an error message:

Invalid Crypt Token
Attention
Content update is rejected due to an invalid crypt token. Possible reasons: Expired edit session, pressing browser back button after a successful save, or an attempted CSRF (cross-site request forgery).
A TWiki administrator can enable/disable the crypt token based CSRF protection with the {CryptToken}{Enable} configure setting.
To save your changes, press the browser back button, copy all content into the clipboard, cancel edit, edit again, and replace content with clipboard content. Whew ... nothing lost!
OK

When Ok is pressed, the wrong template is use (or i guess none).

A workaround is as follows:

• Create a new topic with the script above (it has the wrong name)
• Press F5 to refresh the page (still has the wrong name)
• Edit page and save
• The topic is stored under the correct name.

Its working, but not really satisfying, because if someone doenst know to refresh the page its frustrating.

Thank you.

-- WernerPoetzelberger - 2011-11-14

Discussion and Answer

TWiki guards against Wikipedia:CSRF exploits with crypt tokens. With this enabled you can use a form only once because there is a one time use crypt token embedded in the form. That is, if you create a new page via a button, then go back in the browser, you will get an error message.

It is not obvious from your post, do you use the edit script or the save script in your form action?

To fix your issue you have options:

1. Turn off {CryptToken}{Enable} in configure. Your TWiki will no longer be protected against CSRF attacks, which might or might not be OK in your environment.

2. In your form, add a hidden field to tell the save script to redirect back to the originating page. That way the page with the form is reloaded and gets a new crypt token. This assumes you use the save script. Details in TWikiScripts.

-- PeterThoeny - 2011-11-14

Thak you for the answer (and the editing of the post). I missed the first line, here it is:

<form name="new" action="%SCRIPTURLPATH{edit}%/Main/"> New Graphics Card Topic :

-- WernerPoetzelberger - 2011-11-15

Why not ask for all data upfront in the form and use the save script instead of the edit script? This is for option 2.

-- PeterThoeny - 2011-11-15

If you answer a question - or someone answered one of your questions - please remember to edit the page and set the status to answered. The status selector is below the edit box.