Uniform - no validation

Well, this is definitely one of the strangest bugs I’ve ever seen :smile: I’ll answer you publicly here because this might affect other Uniform users as well.

In your header snippet you generate the URL for a background image dynamically using PHP and set it as inline CSS. In your example site the PHP output for the background image is always empty (because there is no image), resulting in HTML like this:

<header style="background-image:url();">

Note the empty url()

What happens when the browser encounters an empty url() in the CSS, we can observe in the request log:

The page /eventregistration/ is fetched twice! When encountering an empty url() in the CSS, the browser requests the same URL of the page again and actually expects the server to respond with an image this time! Theoretically this is possible because the second request asks for an image MIME type as response but who would do such a thing?

As far as Uniform is concerned this second request is a very legitimate one (it doesn’t care what MIME type is requested) and it re-generates the CSRF token (the token of the submit button), invalidating the old token that was served with the first request on the way. Now if you try to submit the form, you will use the old invalid token and Uniform simply ignores the request.

To fix this, change the inline CSS to background-image:none instead of background-image:url() if there is no URL.

2 Likes