There seems to be a new 'feature' in GL1.5 that prevents anyone who's using Safari (on Mac or Windows) or anyone who blocks the referrer header in any browser, from successfully posting a story. It's like this:

- In Safari, switch on Private Browsing mode. This simply stops websites from knowing which page you have just come from.
- Click Contribute to start a new story. Enter your story and click to save it.

The story is not saved. THe list of stories is displayed, but you don't get the message about the story having been successfully saved (msg 9). You can go back and try again but it won't work.

- Switch off Private Browsing mode.
- Go back to the story and try to submit it again.

It still won't work. You have to copy the text you've entered, and paste it into a text editor, then click Contribute again and re-populate everything from scratch.

This is a definite change from GL <1.5, and it's pretty annoying.

The new security measures to prevent CSRF rely on the referrer.

Switching referrers back on after a save failed won't help because the security token has been used up then (hitting "back" and trying again will use the same, expired, token).

bye, Dirk

Perhaps a message should display if there is no REFERRER so the user doesn't enter their story or other edit when it can't possibly save.