Skip to content

Conversation

kodeFant
Copy link
Contributor

@kodeFant kodeFant commented Oct 5, 2023

When using respondHtml, rendering partial hsx functions will fail if trying to use fromFrozenContext and related utilities like currentUser.

This makes patching a view with html partials less convenient, for example for htmx users.

With renderHtmlPartial this will work.

@kodeFant kodeFant marked this pull request as ready for review October 5, 2023 09:14
@kodeFant
Copy link
Contributor Author

kodeFant commented Oct 10, 2023

I noticed an issue with this on a production server, but not in development mode.

I tried to manually run a partial endpoint with a missing required parameter.

This resulted in 502 Bad Gateway and looks like the server panics globally for 2 seconds and also errors globally on the site, then it recovers works fine again.

The expected response should be the IHP error response.

So that seems to be a little risk factor if an attacker would feel like bringing a site down.

I would guess it's the same issue as this one: #1028

@kodeFant
Copy link
Contributor Author

kodeFant commented Oct 10, 2023

Here are some error logs from the server:

Oct 10 13:50:42 kompak-prototype RunProdServer[215109]: ParamNotFoundException {name = "framework"}
Oct 10 13:50:42 kompak-prototype nginx[215099]: 2023/10/10 13:50:42 [error] 215099#215099: *22448 upstream prematurely closed connection while reading response header from upstream, client: 84.234.224.78, server: kompak.ai, request: "GET /GetFrameworkHelpTextPartial HTTP/2.0", upstream: "http://127.0.0.1:8000/GetFrameworkHelpTextPartial", host: "kompak.ai"
Oct 10 13:50:42 kompak-prototype nginx[215099]: 2023/10/10 13:50:42 [error] 215099#215099: *22448 connect() failed (111: Connection refused) while connecting to upstream, client: 84.234.224.78, server: kompak.ai, request: "GET /GetFrameworkHelpTextPartial HTTP/2.0", upstream: "http://[::1]:8000/GetFrameworkHelpTextPartial", host: "kompak.ai"

Update: The same happens with respondHtml directly, so then it's likely a more underlying issue

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant