SSO 用户无需审批却出现 403 错误

[omarfilip]

WordPress 负责我的用户创建，但今天我有一个待审批的用户：

点击“批准”会导致 403 错误：

我以前从未见过有用户需要审批，所以不确定为什么这个用户与众不同。他在管理员界面中看起来与其他所有用户一样。

也许是昨天更新到 v2.3.0.beta6 +16 引入了一个 bug？

以下是错误日志：

日志

消息

Uncaught [object Object] Url: https://forum.glasair-owners.com/assets/ember_jquery-5dbd79abddf53926275c73f77dbe61e7351258de8d2e886bf2ce86f144368848.js Line: 9 Column: 11652 Window Location: https://forum.glasair-owners.com/review

回溯

环境

hostname gaoa-discourse-app
process_id 3240
application_version f3ed002c30e4b6d7fce76d209202287b1cf85c55
HTTP_HOST forum.glasair-owners.com
REQUEST_URI /logs/report_js_error
REQUEST_METHOD POST
HTTP_USER_AGENT Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36
HTTP_ACCEPT */*
HTTP_REFERER https://forum.glasair-owners.com/review
HTTP_X_FORWARDED_FOR 75.164.xxx.xxx
HTTP_X_REAL_IP 75.164.xxx.xxx
params message Uncaught [object Object] Url: https://forum.glasair-owners.com/assets/ember_jquery-5dbd79abddf5392627
--- --- --- ---
--- ---
url https://forum.glasair-owners.com/assets/ember_jquery-5dbd79abddf53926275c73f77dbe61e7351258de8d2e886b
line 9
column 11652
window_location https://forum.glasair-owners.com/review

[codinghorror (Jeff Atwood)]

@eviltrout is this on your list?

[eviltrout (Robin Ward)]

Could you check the logs again for the server side error? What you’ve included here appears to be a Javascript error which is not the root cause.

[omarfilip]

The error was on March 29, and /logs only goes back to March 30. I didn’t protect it. Can the log be retrieved elsewhere?

Earlier today I tried Approve again and this time it went through without the 403 error.

[eviltrout (Robin Ward)]

Unfortunately not. Do you know if you updated your forum since the error appeared? I’m trying to figure out if it’s something we fixed already.

[omarfilip]

I have not updated - still on the same version that first produced the issue: v2.3.0.beta6 +16.

[omarfilip]

Perhaps completely unrelated, but… my forum started as an import from phpBB, and all my new users show up as “Anonymous user from phpBB3” even though they are not. For example the user from the OP looks like this:

EDIT: One more data point, as mentioned here—my invite only has been enabled since the forum was created.

[eviltrout (Robin Ward)]

Okay now I am wondering if the bug is related to invite only when using SSO, I’m investigating.

[eviltrout (Robin Ward)]

Okay after looking into it slightly, I suspect the problem here is having SSO + Invite Only was always undefined behavior in Discourse. It doesn’t really make sense to have people log in via SSO but also require an invite.

Is disabling invite only an option for you? Why would you need it enabled?

[omarfilip]

Yes - I’ve disabled it already and I can’t recall why it was enabled.

[omarfilip]

This appears to have been fixed by disabling invite only when SSO is in use. I just had a new user sign up and he was not queued for review.

Still on the same version v2.3.0.beta6 +16.

[eviltrout (Robin Ward)]

I’m going to see if I can prevent invite only from being set when using SSO.

[omarfilip]

Also consider this use case:

How to Manually Verify/Add Discourse User from Wordpress Website

I think that’s a bug. You can’t invite users when SSO is enabled, but the invite button is still shown.

[eviltrout (Robin Ward)]

This commit prevents invite only and enable sso at the same time:

FIX: Do not allow `invite_only` and `enable_sso` at the same time

[eviltrout (Robin Ward)]

@omarfilip

Also consider this use case:

I looked into this, and it seems to work now. If enable sso is true, the “Share / Invite” (now consolidated) modal does not allow emails, only usernames.