Valid CSRF Token Required

heywood

Upon trying to reset passwords using the email secret link, I get this message when clicking on the link. I thought it was fixed in the previous versions??

KevinTheJedi

heywood

Well did you have an invalid CSRF that wasn't cleared in the browser? Make sure you clear all cache/cookies/sessions and retest.

If you are having session timeout issues then you should look into reverting this patch (which will be done next release):

https://github.com/osTicket/osTicket/pull/6766/commits/416b548bd812188fec62c89fe8bfb0a3128731a1

Cheers.

heywood

KevinTheJedi

Before i tried doing your suggestion, i did try it with substituting the hostname in the address with the IP and it works, just not with the hostname.

KevinTheJedi

heywood

Then it sounds like you have an issue with your server/network.

Cheers.

KevinTheJedi

heywood

Then, again, it sounds like you have an issue with your webserver or network. All osTicket really cares about is if you have the right host name added in the system settings so it can be used for the links that get sent out.

Cheers.

heywood

KevinTheJedi

Ok here's a new one. If, on the agent tab, i select "--Use Any available backend --" for Authentication Backend, I can reset the password (substituting with IP) but if I select Local Authentication, it does nothing but forward me to an endless pwreset.php where it cannot login. (email address section only available).

KevinTheJedi

heywood

Post a screenshot of Admin Panel > Dashboard > Information.

Cheers.

heywood

if i still use the hostname, it says "Session timed out due to inactivity" but with IP it allows me to change the password

KevinTheJedi

heywood

Yes that means you need to completely clear all cache/cookies/sessions and hard reload the browser. You should also do what I mentioned above and revert the changes made in the patch I linked.

Cheers.