{"action":"created","issue":{"url":"https://api.github.com/repos/SSilence/selfoss/issues/822","repository_url":"https://api.github.com/repos/SSilence/selfoss","labels_url":"https://api.github.com/repos/SSilence/selfoss/issues/822/labels{/name}","comments_url":"https://api.github.com/repos/SSilence/selfoss/issues/822/comments","events_url":"https://api.github.com/repos/SSilence/selfoss/issues/822/events","html_url":"https://github.com/SSilence/selfoss/issues/822","id":194663544,"number":822,"title":"Unable to mark items as read","user":{"login":"tgrosinger","id":597386,"avatar_url":"https://avatars.githubusercontent.com/u/597386?v=3","gravatar_id":"","url":"https://api.github.com/users/tgrosinger","html_url":"https://github.com/tgrosinger","followers_url":"https://api.github.com/users/tgrosinger/followers","following_url":"https://api.github.com/users/tgrosinger/following{/other_user}","gists_url":"https://api.github.com/users/tgrosinger/gists{/gist_id}","starred_url":"https://api.github.com/users/tgrosinger/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tgrosinger/subscriptions","organizations_url":"https://api.github.com/users/tgrosinger/orgs","repos_url":"https://api.github.com/users/tgrosinger/repos","events_url":"https://api.github.com/users/tgrosinger/events{/privacy}","received_events_url":"https://api.github.com/users/tgrosinger/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":17,"created_at":"2016-12-09T18:22:41Z","updated_at":"2016-12-19T19:50:12Z","closed_at":null,"body":"I am no longer able to mark items as read. I am not sure what changed to prompt this to break, but I tried upgrading to latest but the problem did not go away.\r\n\r\nVersions\r\n------------\r\nSelfoss Version: bfb2b206674768868b2ef35326dcdc8f1f6b0474 (latest commit)\r\nUbuntu 16.04 LTS\r\nPHP 7.0.8-0ubuntu0.16.04.3\r\nApache/2.4.18\r\n\r\nDetails\r\n---------\r\n\r\nAdding new articles is still working properly, and the articles are listed and displayed correctly, so this does not seem to be a database issue.\r\n\r\nWhen I click to open an article and mark it read, I get this response from the webserver (shown in the network tab of Chrome dev tools)\r\n\r\n```\r\nHTTP/1.1 403 Forbidden\r\nDate: Fri, 09 Dec 2016 18:19:53 GMT\r\nServer: Apache/2.4.18 (Ubuntu)\r\nStrict-Transport-Security: max-age=15768000; includeSubDomains; preload\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-Powered-By: Fat-Free Framework\r\nX-XSS-Protection: 1; mode=block\r\nContent-Length: 16\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=UTF-8\r\n\r\nan error occured\r\n```\r\n\r\nThe Apache logs show simply:\r\n\r\n```\r\n[Fri Dec 09 10:19:53.552986 2016] [:error] [pid 10621] [client 10.8.0.6:41531] HTTP 403 (POST /mark/5041)\r\n```\r\n\r\nAnd the Selfoss logs show:\r\n\r\n```\r\n12-09-16 10:19:53 Error HTTP 403 (POST /mark/5041)\r\n```\r\n\r\nAny idea what is causing this or what I can do to fix it? Thank you."},"comment":{"url":"https://api.github.com/repos/SSilence/selfoss/issues/comments/268060516","html_url":"https://github.com/SSilence/selfoss/issues/822#issuecomment-268060516","issue_url":"https://api.github.com/repos/SSilence/selfoss/issues/822","id":268060516,"user":{"login":"niol","id":2470916,"avatar_url":"https://avatars.githubusercontent.com/u/2470916?v=3","gravatar_id":"","url":"https://api.github.com/users/niol","html_url":"https://github.com/niol","followers_url":"https://api.github.com/users/niol/followers","following_url":"https://api.github.com/users/niol/following{/other_user}","gists_url":"https://api.github.com/users/niol/gists{/gist_id}","starred_url":"https://api.github.com/users/niol/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/niol/subscriptions","organizations_url":"https://api.github.com/users/niol/orgs","repos_url":"https://api.github.com/users/niol/repos","events_url":"https://api.github.com/users/niol/events{/privacy}","received_events_url":"https://api.github.com/users/niol/received_events","type":"User","site_admin":false},"created_at":"2016-12-19T19:50:12Z","updated_at":"2016-12-19T19:50:12Z","body":"Then, my guess is that the following happened:\r\n\r\n1. You were logged in and using selfoss.\r\n2. Your session expired or you cleared your cookies.\r\n3. While you continued using selfoss, you marked an item read, which sent a `/mark/<itemid>` request, which created a new session as the old one was expired or deleted, which set a cookie in the `/mark` path. You got a `403 Forbidden` error.\r\n4. You logged back in with a new session cookie with the `/` path, but the `/mark` was still there and does not contain a valid session. However, it gets used for all requests to `/mark` and below, and thus the bug you were experiencing.\r\n\r\nMy patch prevents this from happening again as all cookies use the app root path.\r\n\r\nHowever, to get rid of your cookie in the `/mark` path, I would suggest navigating to `/mark/42` (random number). You should see both cookies (hopefully) and be able to clear them."}}
{"actor":{"display_login":"niol"}}