VirtueMart 4.8.2 – Invalid Token error when deleting log files (vmadmin templat

[Slavomir]

Hello,

After updating VirtueMart and the vmadmin template to version 4.8.2, I encountered an "Invalid Token" error when trying to delete log files in the VirtueMart administration.

Error message:
Invalid Token, in view=log task=delete

The log files could not be deleted.

Cause:

After investigating the issue, I found that the delete link in the vmadmin template does not include a security token.

The affected file is:

administrator/templates/vmadmin/html/com_virtuemart/log/default.php

The original code generates a GET request:

echo '<a href="'.JRoute::_('index.php?option=com_virtuemart&view=log&task=delete&logfile='.$logFile).'"><span class="" uk-icon="icon: trash; ratio: 1"></span></a>';

However, the delete controller in:

administrator/components/com_virtuemart/controllers/log.php

requires a valid token through:

vRequest::vmCheckToken();

Solution:

I replaced the original delete link with a POST form containing the Joomla security token:

<td align="left">
    <form method="post"
          action="<?php echo JRoute::_('index.php?option=com_virtuemart&view=log&task=delete'); ?>"
          style="margin:0;">

        <input type="hidden"
               name="logfile"
               value="<?php echo htmlspecialchars($logFile, ENT_QUOTES, 'UTF-8'); ?>">

        <?php echo JHtml::_('form.token'); ?>

        <button type="submit"
                title="Delete log file"
                style="background:none;border:none;cursor:pointer;padding:0;">
            <span uk-icon="icon: trash; ratio: 1"></span>
        </button>
    </form>
</td>

After this modification, deleting log files works correctly with vRequest::vmCheckToken() enabled.

Both VirtueMart and vmadmin were updated together to version 4.8.2.

It appears that the delete link in the vmadmin template needs to be updated to comply with the token validation.

Hopefully, this can be corrected in a future release.

Best regards,
Slavomir

[Milbo]

Thank you very much for this report. I fixed it by adding the token to the link. VM can handle that. Committed for both versions.