<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Segoe UI Light";
panose-1:2 11 5 2 4 2 4 2 2 3;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-AU" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Slight update, I tried in a private session, same results… however…
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">I tired logging in for the second attempt and I logged in to the main page of the BO interface, then I changed the tab back to the WHMCS tab and tried again, this time when the login went through
it was successful showing the site management tab of the BO interface, but there was another tab open and logged in already… I tried in a normal session and it did the same as before.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">So to recap…<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">From WHMCS, select to open the BO gui, upon entering the credentials, it fails with a CSRF message<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Click on the address bar, hit enter, log in, all ok, and loads up normal start page of the BO gui.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">The same happens in a private browser session… however<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">I log in to the BO gui (in the private browser session),
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">flip back to the WHMCS gui’s tab (in the private browser session),
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">select to open the BO gui from WHMCS (note there is still the original BO login open on a tab in the private browser session)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">log in to the newly opened tab opened from the WHMCS action and can log in, it takes me to the Site Management tab of BO gui.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">It would seem like the CSRF issue is being caused somehow by the link being opened trying to access the Site Management tab on login. As it only fails the login if it is being opened from WHMCS.
The only really weird bit is the private browser session, if there is a tab logged in already it will log in when a new tab is opened by WHMCS to log in, which I thought CSRF would be blocking…<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Regards<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Brian<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p></o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Blueonyx <blueonyx-bounces@mail.blueonyx.it> on behalf of Fungal Style <wayin@hotmail.com><br>
<b>Reply to: </b>Blueonyx mailing list <blueonyx@mail.blueonyx.it><br>
<b>Date: </b>Thursday, 22 April 2021 at 9:07 pm<br>
<b>To: </b>Blueonyx mailing list <blueonyx@mail.blueonyx.it><br>
<b>Subject: </b>[BlueOnyx:24925] 5210r AlmaLinux and API CSRF issue<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">Here is a weird one. I have checked the time and it is pointing to the ESXI as a time server (which is sync'd over the internet, but it means all machines are based on the ESXI to avoid drift),
the time also matches my Windows desktop machine and my mobile phone time also (so it is pretty close to correct well as much as you can expect).<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><a href="https://ior.ad/7xKa?iframeHash=trysteps-1">https://ior.ad/7xKa?iframeHash=trysteps-1</a><o:p></o:p></span></p>
</div>
<div>
<div style="margin-top:12.0pt;margin-bottom:12.0pt;min-width: 424px" id="LPBorder_GTaHR0cHM6Ly9pb3IuYWQvN3hLYT9pZnJhbWVIYXNoPXRyeXN0ZXBzLTE.">
<table class="MsoNormalTable" border="1" cellpadding="0" width="100%" style="width:100.0%;border:solid #C8C8C8 1.0pt">
<tbody>
<tr>
<td valign="top" style="border:none;padding:9.0pt 27.0pt 9.0pt 9.0pt">
<div style="margin-right:9.0pt;overflow:hidden" id="LPImageContainer886225">
<p class="MsoNormal"><a href="https://ior.ad/7xKa?iframeHash=trysteps-1" target="_blank"><span style="color:windowtext;text-decoration:none"><span style="color:blue"><img border="0" width="240" height="126" style="width:2.5in;height:1.3125in" id="LPThumbnailImageId886225" src="https://www.iorad.com/api/tutorial/sharingScreenshot?tutorial_id=1798010&sharing_type=default&cache=1619088240000"></span></span></a><o:p></o:p></p>
</div>
</td>
<td width="100%" valign="top" style="width:100.0%;border:none;padding:9.0pt 27.0pt 9.0pt 9.0pt">
<div style="margin-right:6.0pt;margin-bottom:9.0pt" id="LPTitle886225">
<p class="MsoNormal"><span style="font-size:16.0pt;font-family:"Segoe UI Light",sans-serif"><a href="https://ior.ad/7xKa?iframeHash=trysteps-1" target="_blank"><span style="text-decoration:none">Console - How to untitled task name</span></a><o:p></o:p></span></p>
</div>
<div style="margin-right:6.0pt;margin-bottom:9.0pt;max-height: 100px;overflow:hidden" id="LPDescription886225">
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#666666">Check out this tutorial on iorad.com<o:p></o:p></span></p>
</div>
<div id="LPMetadata886225">
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#A6A6A6">ior.ad<o:p></o:p></span></p>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">I try to open the BlueOnyx gui from WHMCS and it brings the login page as expected, but when entering the username and password it then provides a CSRF message, but when I click on the address
bar, press enter to reload the page, I can log in manually. I turn off CSRF and there are no issues with the initial attempt (which would be as expected) unlike in the screen grab where it fails with CSRF enabled and I have to reload the page manually and
log in is then successful.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">Any specific logs I can provide to help with this?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">Regards<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">Brian<o:p></o:p></span></p>
</div>
</div>
</body>
</html>