Hello,
After updating VirtueMart and the vmadmin template to version 4.8.2, I encountered an "Invalid Token" error when trying to delete log files in the VirtueMart administration.
Error message:
Invalid Token, in view=log task=delete
The log files could not be deleted.
Cause:
After investigating the issue, I found that the delete link in the vmadmin template does not include a security token.
The affected file is:
administrator/templates/vmadmin/html/com_virtuemart/log/default.php
The original code generates a GET request:
echo '<a href="'.JRoute::_('index.php?option=com_virtuemart&view=log&task=delete&logfile='.$logFile).'"><span class="" uk-icon="icon: trash; ratio: 1"></span></a>';
However, the delete controller in:
administrator/components/com_virtuemart/controllers/log.php
requires a valid token through:
vRequest::vmCheckToken();
Solution:
I replaced the original delete link with a POST form containing the Joomla security token:
<td align="left">
<form method="post"
action="<?php echo JRoute::_('index.php?option=com_virtuemart&view=log&task=delete'); ?>"
style="margin:0;">
<input type="hidden"
name="logfile"
value="<?php echo htmlspecialchars($logFile, ENT_QUOTES, 'UTF-8'); ?>">
<?php echo JHtml::_('form.token'); ?>
<button type="submit"
title="Delete log file"
style="background:none;border:none;cursor:pointer;padding:0;">
<span uk-icon="icon: trash; ratio: 1"></span>
</button>
</form>
</td>
After this modification, deleting log files works correctly with vRequest::vmCheckToken() enabled.
Both VirtueMart and vmadmin were updated together to version 4.8.2.
It appears that the delete link in the vmadmin template needs to be updated to comply with the token validation.
Hopefully, this can be corrected in a future release.
Best regards,
Slavomir