[5.x]: Axios call to /actions/matrix/create-entry failing with 400

[jonnykates]

What happened?

Description

Attempting to add a Matrix 'block' to an entry is resulting in an Axios call to /actions/matrix/create-entry failing with a 400 error, with the message 'Invalid Matrix field ID: x'. This is only causing an issue when I deploy the site to a hosting plan with shared host Krystal.uk - I'm unable to recreate locally with DDEV. This would obviously suggest that there is some kind of dependency or security shortcoming on the Krystal server, but the payload to the endpoint also potentially suggests that the Matrix field ID is perhaps being sent as a string rather than an int (see Craft web log output below).

Steps to reproduce

To speed run seeing the error first hand, you can;

1. Login to https://craft5matrixbug.jonnykates.com/admin/ with username admin and password password123.
2. Go to create a new entry in the section 'My first section'
3. Attempt to add a block/entry to the field 'A matrix 'field''
4. The Craft draft will be 'dirty' but the block hasn't instantiated on the page
5. The browser console will show you that an ajax call failed

You can clone the Craft config deployed above here. As I say, I can't recreate it locally; but I'm stumped. Obviously you can see the Craft system report page here and I can put that environment into allow admin changes if needed.

Expected behavior

An empty instance of the matrix block/field should be populated into the editor.

Actual behavior

The block doesn't appear.

Craft web log

2024-03-18 10:52:36 [web.INFO] [application] Request context:
$_GET = [
    'p' => 'admin/actions/matrix/create-entry'
    'v' => '1710784358227'
]

$_FILES = []

$_COOKIE = [
    '52374585177501565b605938acf58a53_username' => '8621a89a146acb6c38c9fec50869451f9f9a72259f9a7220e4fd0e9b0d2c57cea:2:{i:0;s:41:\"52374585177501565b605938acf58a53_username\";i:1;s:5:\"admin\";}'
    'Craft-5d075037-bb75-4d88-a5e3-a84e6274060b:sidebar' => 'expanded'
    'wschkid' => '6797899a72c25c78bcc06ed814a4360216c8fb63.1710869452.1'
    'CraftSessionId' => '797qk4l7br15u58bq0saa62cup'
    '52374585177501565b605938acf58a53_identity' => 'e0a53397f652fa6a09ee0df8b26ac8672627cf19996bccece3041bd0ee29110fa:2:{i:0;s:41:\"52374585177501565b605938acf58a53_identity\";i:1;s:159:\"[1,\"[\\\"T0jsM7uCBHzR-XEl7ToJvGXBZZxnIt4ZCM4YN_SZDSI_X9BAPzT4riu2td1P33n7zvCfHeBjVr38EcRrlvne4CsuLGxXZd-MV36p\\\",null,\\\"dd78878bebc0e6afff80be96516511d7\\\"]\",3600]\";}'
    'CRAFT_CSRF_TOKEN' => '••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••'
]

$_SESSION = [
    'e9e4afc1d10fa5eba531d8c56742ebde__flash' => []
    'e9e4afc1d10fa5eba531d8c56742ebde__auth_access' => [
        0 => 'previewDraft:1'
        1 => 'previewDraft:2'
    ]
    '52374585177501565b605938acf58a53__token' => '••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••'
    '52374585177501565b605938acf58a53__id' => 1
    '__authKey' => '••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••'
    '52374585177501565b605938acf58a53__expire' => 1710787956
    '__duration' => 3600
    '__elevated_timeout' => 1710783359
]

$_SERVER = [
    'PATH' => '/usr/local/bin:/bin:/usr/bin'
    'HTTP_ACCEPT' => 'application/json, text/plain, */*'
    'HTTP_ACCEPT_ENCODING' => 'gzip, deflate, br, zstd'
    'HTTP_ACCEPT_LANGUAGE' => 'en-GB,en;q=0.9'
    'CONTENT_TYPE' => 'application/json'
    'CONTENT_LENGTH' => '119'
    'HTTP_COOKIE' => '52374585177501565b605938acf58a53_username=8621a89a146acb6c38c9fec50869451f9f9a72259f9a7220e4fd0e9b0d2c57cea%3A2%3A%7Bi%3A0%3Bs%3A41%3A%2252374585177501565b605938acf58a53_username%22%3Bi%3A1%3Bs%3A5%3A%22admin%22%3B%7D; Craft-5d075037-bb75-4d88-a5e3-a84e6274060b:sidebar=expanded; wschkid=6797899a72c25c78bcc06ed814a4360216c8fb63.1710869452.1; CraftSessionId=797qk4l7br15u58bq0saa62cup; 52374585177501565b605938acf58a53_identity=e0a53397f652fa6a09ee0df8b26ac8672627cf19996bccece3041bd0ee29110fa%3A2%3A%7Bi%3A0%3Bs%3A41%3A%2252374585177501565b605938acf58a53_identity%22%3Bi%3A1%3Bs%3A159%3A%22%5B1%2C%22%5B%5C%22T0jsM7uCBHzR-XEl7ToJvGXBZZxnIt4ZCM4YN_SZDSI_X9BAPzT4riu2td1P33n7zvCfHeBjVr38EcRrlvne4CsuLGxXZd-MV36p%5C%22%2Cnull%2C%5C%22dd78878bebc0e6afff80be96516511d7%5C%22%5D%22%2C3600%5D%22%3B%7D; CRAFT_CSRF_TOKEN=1feb04fb6002711ac830acf9038518dfaf5748039bc1cbbf755da32d430dd120a%3A2%3A%7Bi%3A0%3Bs%3A16%3A%22CRAFT_CSRF_TOKEN%22%3Bi%3A1%3Bs%3A147%3A%22LC9hYV1IF6mWs1cLc4KWHorzAeFWimjNf-wRAbCD%7C531f061cc18b920fc9d5dc32b6f8f8eb8cacaa1b8c8fd5ee252b684b442c015eLC9hYV1IF6mWs1cLc4KWHorzAeFWimjNf-wRAbCD%7C1%22%3B%7D'
    'HTTP_HOST' => 'craft5matrixbug.jonnykates.com'
    'HTTP_PRAGMA' => 'no-cache'
    'HTTP_REFERER' => 'https://craft5matrixbug.jonnykates.com/admin/entries/myFirstSection/3?draftId=2'
    'HTTP_USER_AGENT' => 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36'
    'HTTP_CACHE_CONTROL' => 'no-cache'
    'HTTP_SEC_CH_UA' => '\"Chromium\";v=\"122\", \"Not(A:Brand\";v=\"24\", \"Google Chrome\";v=\"122\"'
    'HTTP_DNT' => '1'
    'HTTP_X_CSRF_TOKEN' => '••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••'
    'HTTP_SEC_CH_UA_MOBILE' => '?0'
    'HTTP_X_REGISTERED_ASSET_BUNDLES' => '92d8701,22e517a2,aee7f8dc,e505ffd6,6b4d7555,e5e48399,bb2f10a0,815d39ea,fc0bc163,1ccab40d,1e21896b,54698ee0,b842675b,1c3c9add,4b1fd285,d8d08e47,8f00ce04,8768f48b,cf3018d6,15a36a51'
    'HTTP_X_REGISTERED_JS_FILES' => ''
    'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest'
    'HTTP_SEC_CH_UA_PLATFORM' => '\"macOS\"'
    'HTTP_ORIGIN' => 'https://craft5matrixbug.jonnykates.com'
    'HTTP_SEC_FETCH_SITE' => 'same-origin'
    'HTTP_SEC_FETCH_MODE' => 'cors'
    'HTTP_SEC_FETCH_DEST' => 'empty'
    'HTTP_X_HTTPS' => '1'
    'DOCUMENT_ROOT' => '/home/cabcbesi/craft-5-matrix-bug/web'
    'REMOTE_ADDR' => '185.61.158.95'
    'REMOTE_PORT' => '60504'
    'SERVER_ADDR' => '77.72.2.85'
    'SERVER_NAME' => 'craft5matrixbug.jonnykates.com'
    'SERVER_ADMIN' => 'webmaster@craft5matrixbug.jonnykates.com.199ca18b81324176615c01507b1684e8-14451.sites.k-hosting.co.uk'
    'SERVER_PORT' => '443'
    'REQUEST_SCHEME' => 'https'
    'REQUEST_URI' => '/index.php?p=admin%2Factions%2Fmatrix%2Fcreate-entry&v=1710784358227'
    'HTTPS' => 'on'
    'WP_UPDATE_PHP_URL' => 'https://help.krystal.uk/cpanel/changing-your-php-version-extensions-functions-options'
    'CRAWLER_USLEEP' => '1000'
    'CRAWLER_LOAD_LIMIT' => '20'
    'X_SPDY' => 'HTTP3'
    'SSL_PROTOCOL' => 'QUIC'
    'SSL_CIPHER' => 'TLS_AES_128_GCM_SHA256'
    'SSL_CIPHER_USEKEYSIZE' => '128'
    'SSL_CIPHER_ALGKEYSIZE' => '128'
    'SCRIPT_FILENAME' => '/home/cabcbesi/craft-5-matrix-bug/web/index.php'
    'QUERY_STRING' => 'p=admin%2Factions%2Fmatrix%2Fcreate-entry&v=1710784358227'
    'SCRIPT_URI' => 'https://craft5matrixbug.jonnykates.com/index.php'
    'SCRIPT_URL' => '/index.php'
    'SCRIPT_NAME' => '/index.php'
    'SERVER_PROTOCOL' => 'HTTP/1.1'
    'SERVER_SOFTWARE' => 'LiteSpeed'
    'REQUEST_METHOD' => 'POST'
    'X-LSCACHE' => 'on,crawler'
    'PHP_SELF' => '/index.php'
    'REQUEST_TIME_FLOAT' => 1710784356.7187
    'REQUEST_TIME' => 1710784356
    'CRAFT_APP_ID' => 'CraftCMS--2584dd08-94b3-41fe-8b78-2beebc9a82ec'
    'CRAFT_ENVIRONMENT' => 'staging'
    'CRAFT_DB_DRIVER' => 'mysql'
    'CRAFT_DB_SERVER' => '127.0.0.1'
    'CRAFT_DB_PORT' => '3306'
    'CRAFT_DB_DATABASE' => 'cabcbesi_craft-5-matrix-bug'
    'CRAFT_DB_USER' => 'cabcbesi_craft-5-matrix-bug-user'
    'CRAFT_DB_PASSWORD' => '••••••••••••'
    'CRAFT_DB_SCHEMA' => 'public'
    'CRAFT_DB_TABLE_PREFIX' => ''
    'CRAFT_SECURITY_KEY' => '••••••••••••••••••••••••••••••••'
    'CRAFT_DEV_MODE' => 'true'
    'CRAFT_ALLOW_ADMIN_CHANGES' => 'false'
    'CRAFT_DISALLOW_ROBOTS' => 'true'
    'PRIMARY_SITE_URL' => 'https://craft5matrixbug.jonnykates.com'
] {"environment":"staging","userId":1,"sessionId":"797qk4l7br15u58bq0saa62cup","body":"{\"fieldId\":\"1\",\"entryTypeId\":1,\"ownerId\":3,\"ownerElementType\":\"craft\\\\elements\\\\Entry\",\"siteId\":1,\"namespace\":\"fields\"}"}

Craft CMS version

Craft Solo 5.0.0-beta.9

PHP version

8.2.16

Operating system and version

Linux 4.18.0-477.21.1.lve.1.el8.x86_64

Database type and version

MariaDB 10.6.17

Image driver and version

Imagick 3.7.0 (ImageMagick 7.1.1-19)

Installed plugins and versions

[brandonkelly]

This was a known issue in 5.0.0-beta.8 which was fixed in 5.0.0-beta.9. Just verified it’s working on my end.

Maybe the 5.0.0-beta.9 update wasn’t applied successfully. Can you try deleting your vendor/ folder and running composer update?

[jonnykates]

That hasn't resolved the issue. Attaching a zip of /vendor/craftcms.

In my local logs, I can see that the request body to /actions/matrix/create-entry is sending the fieldId param over as an int:

"{\"fieldId\":2,\"entryTypeId\":2,\"ownerId\":6,\"ownerElementType\":\"craft\\\\elements\\\\Entry\",\"siteId\":1,\"namespace\":\"fields\"}"

However when deployed to the Krystal host, the fieldId param is a string:

"{\"fieldId\":\"1\",\"entryTypeId\":1,\"ownerId\":3,\"ownerElementType\":\"craft\\\\elements\\\\Entry\",\"siteId\":1,\"namespace\":\"fields\"}"

The remote server is using Linux 4.18.0-477.21.1.lve.1.el8.x86_64 where as DDEV is locally using Linux 6.6.16-linuxkit if that could make a difference.

Very much appreciate that this could be a hosting provider rather than a Craft CMS issue - but thought it was enough of a quirk to raise.

[jonnykates]

Attaching a zip of /vendor/craftcms.

https://drive.google.com/file/d/13z3A_6PiLdmT3c8B0F3ON60kQvM5jwFb/view?usp=sharing

[brandonkelly]

Which environment is having the issue, Krystal?

What are the PHP versions being used on each of those environments?

[brandonkelly]

Also, I take back that this is the same bug fixed in 5.0.0-beta.9. That had nothing to do with fieldId.

[jonnykates]

Which environment is having the issue, Krystal?

What are the PHP versions being used on each of those environments?

Correct, it falls over when it's deployed on Krystal (so, where the fieldId is seemingly being sent as a string). That's using PHP 8.2.16.

[brandonkelly]

I think the fact that fieldId is a string is a red herring. Just forced it to be cast to a string locally and that didn’t break anything.

Can you make sure that the full create-entry request URL is correct? Another possibility is that your @web alias is misconfigured, and the request is just going to the wrong Craft installation. (If you’re manually setting your @web alias, it should be set to the exact base URL of the current Craft request – up to but not including index.php.)

[jonnykates]

I think the fact that fieldId is a string is a red herring. Just forced it to be cast to a string locally and that didn’t break anything.

OK good to know.

Can you make sure that the full create-entry request URL is correct? Another possibility is that your @web alias is misconfigured, and the request is just going to the wrong Craft installation. (If you’re manually setting your @web alias, it should be set to the exact base URL of the current Craft request – up to but not including index.php.)

Everything looks correct to me. On the deployed example at https://craft5matrixbug.jonnykates.com/ I've now explicitly set the @web alias to an env var, "https://craft5matrixbug.jonnykates.com". In this browser network devtools you can see that other ajax calls to other controller endpoints (such as /actions/elements/save-draft) seem to work fine:

Wondering whether there could be any kind of security protocol enforced by the host that, for whatever reason, has a problem with that one specific ajax request. I might spin up a fresh Krystal host package and see if I can replicate it elsewhere. I would just abandon Krystal and look at hosting the site elsewhere, except the client has an existing Krystal plan and wants to host there.

[brandonkelly]

Is there any chance we can get access to the server? If so you can send access credentials over to [email protected].

[jonnykates]

Absolutely, I've emailed over some credentials.

[jonnykates]

I think I've figured it out. I deployed my little test install to another server that we have with Krystal and it worked as expected. So I then went through and compared the various configurations between the two boxes and noticed that in cPanel's 'PHP Selector' area, the host that was working was using the extension nd_pdo_mysql where as the one that was broken, was using pdo_mysql.

Out of my depth, but a quick google suggests that the pdo_mysql extension uses the libmysql driver, which returns numeric types as strings; whereas nd_pdo_mysql uses mysqlnd, which returns numeric types as ints.

Interestingly that GUI in cPanel has a big 'reset to default' button above the extension configurations, which will default back to using pdo_mysql rather than nd_pdo_mysql. Craft won't yell because there is a PDO MySQL extension present.

Might be an edge case, but that was 100% what the issue was. If I switch back to using pdo_mysql I can't add Matrix blocks/enties to a page.

[brandonkelly]

Ah interesting! We’ll see if we can reproduce and whether there’s anything we can do about it.

[theAdhocracy]

@jonnykates thank you for posting your solution! I've been tearing my hair out trying to fix this issue – also on Krystal hosting – and I can confirm that switching to nd_pdo_mysql solves it for me as well!

[sunnylawn]

Also just hit this issue (using Krystal). Thanks for the fix!

[splendidrob]

Thanks so much for posting this solution - just had the same issue (not on krystal servers) - changed to nd_pdo_mysql and all good

[phillmorgan28]

I can confirm this issue. The environment was a cPanel/Cloudlinux server with pdo_mysql enabled. Switching to nd_pdo_mysql fixes the error.

[davidwebca]

Not as a way to pile on, but to add info for others facing this : I had this with whc.ca's hosting and going in the PHP version's extensions and switch to nd_pdo_mysql instead of pdo_mysql did the trick.

[phillmorgan28]

Can we get the docs updated to reflect this requirement? @brandonkelly
https://craftcms.com/docs/5.x/requirements.html

[brandonkelly]

I’ve been running Craft 5 with pdo_mysql locally without this issue, so I’m not sure it’s as simple as that. Maybe there’s a particular buggy version of pdo_mysql?

[brandonkelly]

I’m still unable to reproduce this even when explicitly typecasting fieldId to a string in the matrix/create-entry post data. So this is a shot in the dark, but I just improved Craft’s typecasting support for int|string properties like Field::$id, so that numeric strings will get converted to integers, which just might fix this.

The change was made for Craft 5.1. It would be great if any of you could give it a test with pdo_mysql installed, and see if it works. To test, change your craftcms/cms requirement in composer.json to "5.1.x-dev as 5.1.0-alpha", and run composer update.

[brandonkelly]

Craft 5.1 is out with that fix.

[theAdhocracy]

Just a warning: we've upgraded to 5.1 and not only is the issue not fixed, but it seems that any content with inline-editable Matrix fields is now throwing errors across our site. Lots of Invalid field layout element UUID in the logs.

We're basically no longer able to access these entries at all. Even attempting to perform a database backup is throwing an internal server error.

EDIT: Just to say if you are also in this situation, changing those Matrix fields to card view seems to remove the errors.

We're tried with both pdo_mysql and nd_pdo_mysql; both appear to now be broken.

EDIT: Okay, not quite so simple 😅 Reverting to card Matrix blocks has allowed us to access specific entries again, but we still cannot export database backups or make any edits to those entries. New entries seem possible to make, though we're running into caveats there as well.

FINAL EDIT: Just to say that I've just rolled us back to 5.0.6 and all of the issues have gone away. We'll do some more testing locally as and when we can, but for now we're considering the 5.1 upgrade incompatible with something (our host? our field config?).

What I can say in the interim is that the original issue raised in this post did not appear to be fixed. Before rolling back, we were able to create new content entries that included inline editable fields (obviously without any content). Switching back to pdy_mysql and then trying to create a new Matrix block behaved exactly the same as it did on 5.0.x for us: no block created. Only when we flipped back to nd_pdo_mysql did we see the block created... at which point the new errors broke the entry entirely. Whether the two are related is unclear, though it's possible, given that both seem to be affected by whether fields have inline editable Matrix blocks or not.

[brandonkelly]

Sorry, as I said it was a shot in the dark, as we’re unable to reproduce. I’m guessing whatever the underlying issue is, the 5.1 change is just exacerbating it further.

The invalid field layout element UUID warnings are probably unrelated – that happens if you delete a custom field, but some field layouts are still referencing it, and the warnings go away after you run craft project-config/rebuild (or end up saving the individual offending field layouts over time).

And the backup issue is also unrelated, and fixed for the next release (#14928).

Could you write into [email protected] with server credentials, so we can dive in and see what’s going on?

[theAdhocracy]

Okay, we've spent some time debugging and have now upgraded to 5.1.1. @brandonkelly was correct in that none of the new issues were related to this bug ticket. For anyone wondering:

• The invalid UUID errors were caused by some conditional field logic. We have a few fields with the same label (as a result of the Craft 5 upgrade) and somehow the wrong field was being chosen by the conditional logic (e.g. we have three "Rating" fields now, and in various places these are used in conditional rules, but in 5.1 they were all pointing at the original "Rating" field, so anywhere using the other two was throwing an error). Not sure how/why that changed during the upgrade, as the rules were working fine before hand and only one "Rating" field was selectable in 5.0.x for those conditions 🤷
• The database backup issue was due to our web host blocking use of the escapeshellarg() function. Updating our PHP settings removed this issue. Anyone else on Krystal hosting may also want to check their config (@jonnykates)

Now that those are all cleared, we've confirmed that the issue with pdo_mysql persists on version 5.1.1.

I'll see about providing direct access to the server, not sure how comfortable I feel about that. If there are any other logs or files, I should now have time to submit those, though, next week.

[brandonkelly]

Someone sent in server creds and we finally got to the bottom of this! I was on the right track with 74dc2ab after all, but there was a minor bug in the commit that prevented it from actually helping in this case.

So it’s now fixed for the next release.

If you’re experiencing this and want to get the fix early, change your craftcms/cms requirement to 5.x-dev as 5.1.5 and run composer update.

[brandonkelly]

Craft 5.1.6 is out now with that fix. Thanks everyone!