CakePHP API Blackhole - validatePost disable not working? - php

Question

We have recently shifted our application from http to https due to plain password logins via the API.
However, since doing so we are having real issues with Blackholes. Cake seems to black hole any 'POST' to the API function within our controller, despite
$this->Security->validatePost = false;
being set in AppController.php
We are using CakePHP version 2.1.3
Example of the code is as follows:
AppController.php:
function beforeFilter()
{
$this->Security->validatePost = false;
$this->Security->requireSecure();
}
SaleOrderController.php:
function beforeFilter()
{
parent::beforeFilter();
$this->Auth->allow('addApi'); // Allow access to the API without logging in.
}
POSTing to this URL gives back the following message:
"The request has been black-holed"
Once we can get this working (without being blackholed) we will adjust it so that only certain actions may be performed with validatePost = false. However, for now we just want to get the system working.
Note: 'GET' requests to the action work fine (are not blackholed).
Am I missing some simple configuration here or is there some deeper issue at work? The security module seems a little scant on documentation and from my google searches it looks like most people have avoided blackholing by performing the same steps I have.

Answer 1

Turns out the following has no effect in CakePHP 2.X:
$this->Security->enabled = false;
To disable components you need to follow this doc:
http://book.cakephp.org/2.0/en/core-libraries/components/security-component.html
My issue was related to CSRF protection which I believe may be new in CakePHP 2.X?
Anyway, All I needed to do was add the following line within my SaleOrderController beforeFilter function:
$this->Security->csrfCheck = false;
My whole BeforeFilter function is now:
function beforeFilter()
{
parent::beforeFilter();
$this->Auth->allow('addApi'); // Allow access to the API without logging in.
if (isset($this->Security) && $this->action == 'addApi') {
$this->Security->csrfCheck = false;
$this->Security->validatePost = false;
}
}

Answer 2

See below URL
CakePHP: Disable Security Component site wide
Disabling input elements in a CakePHP form that uses Security component and jQuery
http://life.mysiteonline.org/archives/175-Disable-the-Security-Component-in-CakePHP-only-for-Certain-Actions.html
http://book.cakephp.org/2.0/en/core-libraries/components/security-component.html
http://api.cakephp.org/class/security-component
Or try it:-
Even if you disable it in your app_controller your individual controller may have that security enabled.As my wild guess says this is what you want to do.If not let me know more about it
function beforeFilter(){
parent::beforeFilter();
if(isset($this->Security) && $this->RequestHandler->isAjax() && $this->action = 'add'){
$this->Security->enabled = false;
}
}