Login not possible after Upgrade to 22.10 from 22.04

[MikaLaurer]

Hello everyone,

I just upgraded to OpenEMM 22.10. I've been using this Installation of OpenEMM since 19.04 and never had any problems with the upgrades.
After the recent upgrade I suddenly wasn't able to login anymore. Neither my user nor the emm-master user is able to login.

I get a pop-up saying " Permission denied. You do not have sufficient privileges to perform this operation."

I tried resetting the password for emm-master using OMT.sh, as suggested in a post I saw, but that didn't work either.
I reset my user password using the web-ui and after that I was able to login, but I got the same error messages in the ui when clicking any point in the menu. After that I logged out and tried to log-in again, which again didn't work.
I manually reset the rights for emm-master in the database with the sql-scripts provided. No success as well.

There were no error messages in the upgrade logs or the catalina.out

When switching back to fronted version 22.04 everything works as usual. Are there any known issues regarding this topic with frontend version 22.10.000.222?

Thanks for your help
Mika

[maschoff]

Did you use OMT for the update? If so, just run the update again and post any error that is reported here.

Also, check catalina.out at startup time for any error messages.

[MikaLaurer]

Hey Maschoff,

yes I installed via OMT. I ran the update again without success. No error messages during the update or startup.
I created a new database using OMT, didn't solve the problem either.

[maschoff]

We have no idea what went wrong. You could try to upgrade to BETA 23.04. Maybe this would help.

[MikaLaurer]

I managed to get it running.

I upgraded to 23.04. which didn't work in the beginning but gave me an error message in the catalina.out, which lead me to the new db-parameter "csrfProtection.enabled" in config_tbl.

After changing the value to false everything worked again.

I restored a snapshot from before the update to 22.10. and started the update process again. I then changed the value in the db and version 22.10. is now up and running

[maschoff]

Hm, good to hear it works now, but not sure why CSRF protection caused a "Permission denied" error. Do you run OpenEMM in an unusual environment?

[MikaLaurer]

We host it internally behind proxies and firewalls. It seemed like the request wasn't even sent when I got the "Permission denied" Error.
I didn't copy the error message I got when using 23.04. but it was something like "anonymous login not allowed".
When I disabled CSRF protection the error was gone

[maschoff]

OK, good to know and thanks for your feedback. I will add a hint regarding CSRF to the Install & Admin Guide.