1

My Wordpress \ConfigAndLog\Civicrm.xx...xx.log is full of this error. 100s of MB of them. I understand that this is due to anonymous users not passing a valid contactID to the UserDashBoard.

This looks the same as the issue posted here Anonymous user can't view CiviCRM user dashboard in WordPress

Apr 28 13:27:57  [error]
$Fatal Error Details = array:3 [
  "message" => "You must be logged in to view this page."
  "code" => null
  "exception" => CRM_Core_Exception {#17563
    -errorData: array:1 [
      "error_code" => 0
    ]
    #cause: null
    -_trace: null
    #message: "You must be logged in to view this page."
    #code: 0
    #file: "/home/xxxxx/public_html/wp-content/plugins/civicrm/civicrm/CRM/Contact/Page/View/UserDashBoard.php"
    #line: 80
    trace: {
      /home/xxxxx/public_html/wp-content/plugins/civicrm/civicrm/CRM/Contact/Page/View/UserDashBoard.php:80 {
        › if (!$this->_contactId) {
        ›   throw new CRM_Core_Exception(ts('You must be logged in to view this page.'));
        › }
      }
      /home/xxxxx/public_html/wp-content/plugins/civicrm/civicrm/CRM/Contact/Page/View/UserDashBoard.php:193 { …}
      /home/xxxxx/public_html/wp-content/plugins/civicrm/civicrm/CRM/Core/Invoke.php:319 { …}
      /home/xxxxx/public_html/wp-content/plugins/civicrm/civicrm/CRM/Core/Invoke.php:69 { …}
      /home/xxxxx/public_html/wp-content/plugins/civicrm/civicrm/CRM/Core/Invoke.php:36 { …}
      /home/xxxxx/public_html/wp-content/plugins/civicrm/civicrm.php:1199 { …}
      /home/xxxxx/public_html/wp-content/plugins/civicrm/includes/civicrm.shortcodes.php:380 { …}
      /home/xxxxx/public_html/wp-includes/shortcodes.php:356 { …}
      do_shortcode_tag() {}
      /home/xxxxx/public_html/wp-includes/shortcodes.php:228 { …}
      /home/xxxxx/public_html/wp-content/plugins/civicrm/includes/civicrm.shortcodes.php:227 { …}
      /home/xxxxx/public_html/wp-includes/class-wp-hook.php:307 { …}
      /home/xxxxx/public_html/wp-includes/class-wp-hook.php:331 { …}
      /home/xxxxx/public_html/wp-includes/plugin.php:522 { …}
      /home/xxxxx/public_html/wp-includes/class-wp.php:771 { …}
      /home/xxxxx/public_html/wp-includes/functions.php:1310 { …}
      /home/xxxxx/public_html/wp-blog-header.php:16 { …}
      /home/xxxxx/public_html/index.php:17 { …}
    }
  }
]

Apr 28 13:26:48  [debug] $backTrace = #0 /home/xxxxx/public_html/wp-content/plugins/civicrm/civicrm/CRM/Core/Error.php(433): CRM_Core_Error::backtrace("backTrace", TRUE)
    #1 /home/xxxxx/public_html/wp-content/plugins/civicrm/civicrm/CRM/Core/Invoke.php(39): CRM_Core_Error::handleUnhandledException(Object(CRM_Core_Exception))
    #2 /home/xxxxx/public_html/wp-content/plugins/civicrm/civicrm.php(1199): CRM_Core_Invoke::invoke((Array:2))
    #3 /home/xxxxx/public_html/wp-content/plugins/civicrm/includes/civicrm.shortcodes.php(380): CiviCRM_For_WordPress->invoke()
    #4 /home/xxxxx/public_html/wp-includes/shortcodes.php(356): CiviCRM_For_WordPress_Shortcodes->render_single((Array:5), "", "civicrm")
    #5 [internal function](): do_shortcode_tag((Array:7))
    #6 /home/xxxxx/public_html/wp-includes/shortcodes.php(228): preg_replace_callback("/\[(\[?)(civicrm)(?![\w-])([^\]\/]*(?:\/(?!\])[^\]\/]*)*?)(?:(\/)\]|\](?:([^\...", "do_shortcode_tag", "[civicrm component=\"user-dashboard\" gid=\"20\" action=\"info\" mode=\"view\...")
    #7 /home/xxxxx/public_html/wp-content/plugins/civicrm/includes/civicrm.shortcodes.php(227): do_shortcode("[civicrm component=\"user-dashboard\" gid=\"20\" action=\"info\" mode=\"view\...")
    #8 /home/xxxxx/public_html/wp-includes/class-wp-hook.php(307): CiviCRM_For_WordPress_Shortcodes->prerender(Object(WP))
    #9 /home/xxxxx/public_html/wp-includes/class-wp-hook.php(331): WP_Hook->apply_filters(NULL, (Array:1))
    #10 /home/xxxxx/public_html/wp-includes/plugin.php(522): WP_Hook->do_action((Array:1))
    #11 /home/xxxxx/public_html/wp-includes/class-wp.php(771): do_action_ref_array("wp", (Array:1))
    #12 /home/xxxxx/public_html/wp-includes/functions.php(1310): WP->main("")
    #13 /home/xxxxx/public_html/wp-blog-header.php(16): wp()
    #14 /home/xxxxx/public_html/index.php(17): require("/home/xxxxx/public_html/wp-blog-header.php")
    #15 {main}

I can confirm that the Wordpress ACL is set to grant access for anon users to the Contact Dashboard however it still throws the error. My belief is that all the hits are from bots probing the site and are not real users. Even if they are the neatest solution would surely be to chuck them back at the home page rather than just filling the logs with errors.

To achieve this I changed /wp-content/plugins/civicrm/civicrm/CRM/Contact/Page/View/UserDashBoard.php

From enter image description here

To

  /**
   * Heart of the viewing process.
   *
   * The runner gets all the meta data for the contact and calls the appropriate type of page to view.
   */
  public function preProcess() {
      if (!$this->_contactId) {
         header("Location: https://my-domain.com/login/");
         exit();
         //throw new CRM_Core_Exception(ts('You must be logged in to view this page. - '));
    }

Shouldn't this be the default behaviour? I've purged almost a GB in logs from the last couple of months for this alone.

Or I have I committed a sin and there is a better way to get around this?

1 Answer 1

0

The "correct" behavior probably depends on your personal preference. In my case, I would want the default behavior - this can indicate a misconfiguration I caused - but I see why you would want this.

The only "sin" is that you've modified a core file - so every time you upgrade you'll need to put your modification back in. Or you could use PHP overrides, but that's not long-term maintainable.

Here are some ways I would consider handling this:

  • I would check my web server logs to verify that this is bot behavior. If it is, I would block those bots (with robots.txt, mod_security, fail2ban, and/or Apache configuration).
  • You could use the mod_rewrite Apache module to block anyone attempting to access this page without a contact ID in the URL and with no cookie indicating they're logged in.
  • There are more advanced approaches, like sending your logs to a tool like Logstash where you can filter out garbage, but that's a lot of work just for this. CiviCRM implements the PSR-3 logging interface, so there's a lot of software you could use as an alternative to writing to the Civi log.

Personally I like the fail2ban option, but that presumes you have access to fail2ban.

1
  • Many thanks for this insight. I'm not keen on editing a core file either but the alternative is to keep deleting the bloated log files. The other alternatives look interesting and I'll investigate those too.
    – Speleo
    Commented Apr 28, 2022 at 21:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.