Sinatra app.post gives a 403 - sinatra

I'm trying to get the simple put and get running. Get works perfectly but I seem to get a 404 with a PUT.
Things I've tried:
Wrote up code for a app.get "/users/:id" and localhost:3000/users/400 to print the user's id on the browser -> this works and it's a get
Tried doing the same for a post -> app.post "/users/add" (code below) and did a "localhost:3000/users/add/11" but I get a 404.
My doubts:
How can I test the post on a browser? How should the URL be? Where can I put info to be posted in the URL? Or should it not be specified in the URL? (This is confusing) I am guessing the lack of input data is giving me a 404.
I run this on the Sinatra framework and this what I see on the console:
INFO WEBrick::HTTPServer#start: pid=10137 port=3000
::1 - - [19/Mar/2015:11:36:34 -0700] "GET /users/add HTTP/1.1" 403 - 0.0156
(Wait, shouldn't this be a POST??)
::1 - - [19/Mar/2015:11:36:45 -0700] "GET /users/add/11 HTTP/1.1" 404 688 0.0086
(My question on how I specify the data to be put)
::1 - - [19/Mar/2015:11:43:15 -0700] "GET /users/add/name=11 HTTP/1.1" 404 693 0.0018
My routes users.rb code:
module Routes
module Users
def self.registered(app)
app.post '/users/add' do
reqUserId = params[:id]
"params id #{reqUserId}"
end
end
end
Any help would be great. I'm super open to reading anything too.

Well it looks like you got confused by a few things here.
First of all, put and post are not the same. PUT vs POST in REST Probably you want use post.
What you probably want is something like this:
get "/users/add" do
erb :useradd
end
post "/users/add" do
params[:userId]
#render layout or redirect to a url
end
And your useradd erb template would look like this:
<form action="/users/add" method="post">
<input name="userId" type="text" />
<input type="submit" value="submit" id="submit" />
</form>
So your browser does a GET if you open a url like /users/add which renders your view. And if you press on submit the form with your input fields gets posted.
To test your Post routes you can also use something like curl:
curl --data "param1=value1&param2=value2" http://localhost:3000/users/add

Related

TYPO3: Bingbot creates an ext_form error which get cached

We have a problem whit one of our TYPO3 installations. The Bingbot which visits the site calls a controller of the old ext_form extension without parameters and creates an error.
207.46.13.XXX - - [16/Oct/2018:00:18:48 +0200] "GET example.html?tx_form_form%5Baction%5D=process HTTP/1.1" 200 10256 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
The problem for us is not that this happens but that TYPO3 is caching the site with "Oops, an error occurred! Code: 20181016001848e0153dcf" as content.
Is there a way to say TYPO3 to not cache the site if an error occorres or to send the bot to the 404 site if he calls the site with false parameters.
There are several things you can do:
exclude the page with the parameters in robots.txt (Edit: After consideration this solution is probably unsuitable for the specific problem)
redirect in .htaccess if the page is called without required parameter, a redirect should be recognized by the bot too.
check why the bot is even calling the page without required parameter, perhaps you can avoid it.
bing can be configured for a specific URL, this page can be a starting point for you.
EDIT:
Example for htaccess (not tested):
RewriteCond %{QUERY_STRING} .+
RewriteRule ^example.html?tx_form_form%5Baction%5D=process$ example.html [L,R=301,QSD]
The target example.html can be anything, either a custom 404 page or just the list-view. The code 301 in [L,R=301,QSD] can be adjusted according to HTTP Status Codes (3xx). If it's redirected to a (custom) 4xx page the HTTP status code should be accordingly (404, or perhaps another 4xx-status-message i.e. 400).

AMP form amp_source_origin error cors header

I am getting error in AMP Form
<form class="innler-left" method="post" action-xhr="//mydoma.com/ xxxx/xxx/xxx/send.php" target="_top">
On submit getting below error in console.
Response must contain the AMP-Access-Control-Allow-Source-Origin header
Form submission failed: Error:
Response must contain the AMP-Access-Control-Allow-Source-Origin header​​​ _reported_
Once user submit the form it goes it php file in where I put the following header
header('HTTP/1.1 200 OK');
header("access-control-allow-credentials:true");
header("AMP-Same-Origin: true");
header("Access-Control-Allow-Origin:".$_SERVER['HTTP_ORIGIN']);
header("amp-access-control-allow-source-origin: https://".$_SERVER['HTTP_HOST']);
header("Access-Control-Expose-Headers: AMP-Access-Control-Allow-Source-Origin");
header("access-control-allow-headers:Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token");
header("access-control-allow-methods:POST, GET, OPTIONS");
header("Content-Type: application/json");
I got it working offline on local machine but once i upload files, it not working :(
tried https://github.com/ampproject/amphtml/blob/master/spec/amp-cors-requests.md
POST __amp_source_origin is not matching!
I was also facing the same issue to fix this, make sure your URL start with https. And try to replace the following line in your code :
header("Access-Control-Allow-Origin:".$_SERVER['HTTP_ORIGIN']);
with
header("Access-Control-Allow-Origin: ". str_replace('.', '-','https://www.example.com') .".cdn.ampproject.org");
Note : Replace https://www.example.com with your AMP website URL
Hope it helps.

Server Error in '/' Application after submitting a form

New to coding here... Just got my validation form working, now after submitting the form, I am getting a Server Error in '/' Application after submitting form. This type of page is not displayed.
<form action="ContactUsResults.cshtml" method="POST">
When I change my page type to .htm
<form action="ContactUsResults.htm" method="POST">
Then I get the 405 error message 'Method Not Found'
Ideally, I am just trying to get to a confirmation page after they submit the form.
Thanks!
The web server that is running as part of your WebMatrix environment is not configured to allow the POST method, hence the 405 "Method Not Found" error. You will need to enable the POST method in settings or a configuration file in order for your form action to work.

Facebook can't scrape my site correctly - PHP Site

I am running this website www.miswag.net which is highly dependent on Facbeook. When I share my site on Facebook, I get a "403 Forbidden", here's Facebook's debugger output when I try to scrape my site: https://developers.facebook.com/tools/debug/og/object?q=http%3A%2F%2Fwww.miswag.net
Please help figure this out.. Thanks
Facebook's scraper doesn't need to read the full page, so they only request part of it by sending a Range header. However, your server seems to be responding incorrectly to that request and returning a 403 error code. You need to check your server and make sure it handles the range header correctly.
To see this in action, try this CURL command:
curl -H "Range: bytes=0-524287" http://www.miswag.net
This is the response I got:
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access /
on this server.</p>
<p>Additionally, a 404 Not Found
error was encountered while trying to use an ErrorDocument to handle the request.</p>
</body></html>
Compounding on #Waleed'sanswer, if you want to test right away, use Online CURL
fill in www.wiswag.net
ADD OPTION options, choosing --header (-H)
next to it "Range: bytes=0-524287"
CURL button

cURL post to PayPal succeeds while HTML Form post and RunScope post fail

I'm currently developing an integration with PayPal's Payflow Pro Gateway. I'm sending a request to PayPal to get their "Secure Token" so that I can use that to do the real transaction. A sample I found on SO works via cURL, but the original HTML Form POST and RunScope tests I ran did not work.
Here is the cURL command:
curl https://pilot-payflowpro.paypal.com -kd "PARTNER=PayPal&VENDOR=*****&USER=*****&PWD=*****&TRXTYPE=A&AMT=40&CREATESECURETOKEN=Y&SECURETOKENID=*******&SILENTTRAN=TRUE"
Per the cURL documentation:
The -k option is:
"(SSL) This option explicitly allows curl to perform "insecure" SSL
connections and transfers. All SSL connections are attempted to be
made secure by using the CA certificate bundle installed by default.
This makes all connections considered "insecure" fail unless -k,
--insecure is used."
The -d option is:
"(HTTP) Sends the specified data in a POST request to the HTTP server,
in the same way that a browser does when a user has filled in an HTML
form and presses the submit button. This will cause curl to pass the
data to the server using the content-type
application/x-www-form-urlencoded. Compare to -F, --form."
-d, --data is the same as --data-ascii. To post data purely binary, you should instead use the --data-binary option. To URL-encode the
value of a form field you may use --data-urlencode.
If any of these options is used more than once on the same command
line, the data pieces specified will be merged together with a
separating &-symbol. Thus, using '-d name=daniel -d skill=lousy' would
generate a post chunk that looks like 'name=daniel&skill=lousy'.
If you start the data with the letter #, the rest should be a file
name to read the data from, or - if you want curl to read the data
from stdin. The contents of the file must already be URL-encoded.
Multiple files can also be specified. Posting data from a file named
'foobar' would thus be done with --data #foobar. When --data is told
to read from a file like that, carriage returns and newlines will be
stripped out.
That works great and returns this response:
RESULT=0&SECURETOKEN=*****&SECURETOKENID=*****&RESPMSG=Approved
HTML Form POST
However, what I perceive to be the same request fails in the following HTML form POST:
<input type="hidden" name="TRXTYPE" value="A" />
<input type="hidden" name="SILENTTRAN" value="TRUE" />
<input type="hidden" name="AMT" value="40" />
<input type="hidden" name="CREATESECURETOKEN" value="Y" />
<input type="hidden" name="SECURETOKENID" value="*****" />
<input type="submit" value="Get Secure Token" />
That gives me "The connection was reset" in FireFox.
I also tried using jQuery to POST the data using $.ajax(), but I received a 200 response with no data in it.
Runscope
When I enter the above parameters into RunScope, I get:
RESULT=1&SECURETOKENID=*****&RESPMSG=User authentication failed
Which doesn't make any sense!
I was thinking that PayPal is either doing something with examining the user agent, or request headers, but I don't have any real idea. Can anyone shed some light on this behavior?