cherokee/webserver — Issue #14: phpmyadmin app installer broken due to CTK CSRF protection
Author: brianmcdonnell
Created: 2011-12-01 23:10:58+00:00
State: open

The phpmyadmin app installer is broken in cherokee 1.2.101.

The installer configuration screen sequence fails after the user submits the virtual host for the install. The form attempts to submit a POST to:

```javascript
/market/install/target-selection/apply?key=123456abc
```

however it receives a http 404 in return. The 404 can only been seen in the javascript console as this is an ajax call. The installation cannot proceed beyond this point.

This bug happens because of CSRF protection added to CTK appends the get parameter 'key=123456abc' onto the form submission. Note this changeset.
https://github.com/cherokee/CTK/commit/10cd5bfd5a888bb4e430bab2e6c2f43daa883d57#CTK/Submitter.py

Meanwhile the phpmyadmin installer app publishes the following regex to CTK/Server.py

in phpmyadmin app install dir. target.py:293

```javascript
CTK.publish ('^%s$' % (URL_TARGET_APPLY), ...)
```

where

```javascript
URL_TARGET_APPLY='/market/install/target-selection/apply'
```

Note the trailing '$' on the regex will mean that the published url will not match the url submitted by the form due to the addition of the 'key' paramater.