Repository: oppia/oppia

Issue:
CSRF tokens are not generated in 404-error pages
<!--
  - Thanks for taking the time to report a bug in the Oppia project.
  - Before filing a new issue, please do a quick search to check that it hasn't
  - already been filed on the [issue tracker](https://github.com/oppia/oppia/issues)._
  -->

**Describe the bug**

Unable to create Exploration from 404-error page because CSRF tokens are not generated in 404-error pages

**To Reproduce**

Steps to reproduce the behaviour:
 1. Go to '/error'
 2. Click on 'create'
 3. See error

![1](https://user-images.githubusercontent.com/41017303/54055134-1b842380-4212-11e9-8404-f916059755ed.png)

Also, See the sourcecode of 404-error page.
you'll find  CSRF in GLOBALS is null, Line:57


![2](https://user-images.githubusercontent.com/41017303/54055319-aebd5900-4212-11e9-8b95-0df24f411170.png)





Discussion:
Could you please add a screenshot of the error?
Hi @seanlip ,
I've updated the comment.
Thanks
Thanks!

Would this be solved by generating the CSRF token via AJAX? If so this might intersect with some of what @vojtechjelinek is looking into.
Hi,

I believe this can be solved by setting REQUIRE_PAYLOAD_CSRF_CHECK as True for Error404Handler class.
 
That is possible, but if you wanted to go with that I suggest figuring out (use git blame and/or the code commit history) why it was set to False in the first place. There may be a reason, so at least identify the PR which did it and then we can see.
Exactly! this must have set to false for a reason, i'll  figure it out.
Further need @vojtechjelinek 's views on this.

Thanks
I think `csfr_roken` is one of the more complicated GLOBALS to handle if setting `REQUIRE_PAYLOAD_CSRF_CHECK` as True is a possibility I would go that way for now. @abhaygupta97 Could you take a look, please?
REQUIRE_PAYLOAD_CSRF_CHECK was initialized as False during the Error404Handler class creation by @seanlip  and not yet changed.  [Blame History Here](https://github.com/oppia/oppia/commit/11f9f20a25cf9f1a27bcf495105777b85eda43d6)
OK, thanks! It looks like this happened 4.5 years ago. I cannot remember why we did it then, but one thought that comes to mind was -- what if the error was happening due to the CSRF generation itself? That would result in an error when showing the error pages. So I think we skipped it.

That said, I think the CSRF generation has been working robustly for quite a while now, so I would be happy to flip the flag.
sure :) , 
i'll raise a PR for this and will work on optimizing `csrf_token `for GLOBALS Thanks !


Resolving patch:
diff --git a/core/controllers/base.py b/core/controllers/base.py
--- a/core/controllers/base.py
+++ b/core/controllers/base.py
@@ -513,7 +513,7 @@ def handle_exception(self, exception, unused_debug_mode):
 class Error404Handler(BaseHandler):
     """Handles 404 errors."""
 
-    REQUIRE_PAYLOAD_CSRF_CHECK = False
+    pass
 
 
 class CsrfTokenManager(object):


Test patch:
diff --git a/core/controllers/base_test.py b/core/controllers/base_test.py
--- a/core/controllers/base_test.py
+++ b/core/controllers/base_test.py
@@ -107,6 +107,8 @@ def test_that_no_get_results_in_500_error(self):
 
     def test_requests_for_invalid_paths(self):
         """Test that requests for invalid paths result in a 404 error."""
+        user_id = user_services.get_user_id_from_username('learneruser')
+        csrf_token = base.CsrfTokenManager.create_csrf_token(user_id)
 
         self.get_html_response(
             '/library/extra', expected_status_int=404)
@@ -115,10 +117,12 @@ def test_requests_for_invalid_paths(self):
             '/library/data/extra', expected_status_int=404)
 
         self.post_json(
-            '/library/extra', payload={}, expected_status_int=404)
+            '/library/extra', payload={}, csrf_token=csrf_token,
+            expected_status_int=404)
 
         self.put_json(
-            '/library/extra', payload={}, expected_status_int=404)
+            '/library/extra', payload={}, csrf_token=csrf_token,
+            expected_status_int=404)
 
     def test_redirect_in_logged_out_states(self):
         """Test for a redirect in logged out state on '/'."""