Joomla 3.6.0 to 3.6.1 results in a "invalid security token" error

Question

I've just tried to update my site from Joomla 3.6.0 to 3.6.1 and I get the following error message:

The most recent request was denied because it contained an invalid security token. Please refresh the page and try again.

How can I successfully install the update?

Answer 1

If you don't have Akeeba Backup installed:

• Go back to the Joomla Update page
• Upload and install the Joomla 3.6.1 Update Package using the "Upload & Update" tab
• Go to Extensions >> Manage >> Database
• You may see a message that the database is out of date. If so, click on the Fix button in the toolbar.

---

If you have Akeeba Backup installed:

• Go to the Plugin Manager
• Disable the System - Backup on upgrade plugin
• Go back to the Joomla Update page
• Upload and install the Joomla 3.6.1 Update Package using the "Upload & Update" tab
• Go to Extensions >> Manage >> Database
• You may see a message that the database is out of date. If so, click on the Fix button in the toolbar.

Answer 2

Details about this issue can now be found in the Joomla Docs:

What is the cause?
3.6.1 introduced a CSRF token check to the update component as an extra level of security. 3.6.0 down to 2.5.4 (every version with the update component) will hit the issue with the CSRF token because those versions don't generate the needed code to pass the check. Future updates will work correctly

Lodder's solutions works perfectly. Using third-party update services like MyJoomla or Watchful.li should not cause any issues

Answer 3

I also had the same error message after upgrading 3.6.0 -> 3.6.1: 0 Failed to start the session: already started by PHP ($_SESSION is set).

To resolve, you need to use PHP Selector and change from 5.3 (it's a PHP 5.3 issue; will be fixed in Joomla 3.6.2). I change from 5.3 --> 5.6 and am now able to login the administration.

Hope helps

Answer 4

If people can't log into the back-end, there is an additional fix on github here: https://github.com/joomla/joomla-cms/pull/11430/files

You must change the following lines on libraries/joomla/session/handler/native.php

private $started; to private $started=false; and private $closed; to private $closed=false;

Add the line $this->closed = true; after session_write_close(); (line 153)

From the sites I have patched today, this seems to be a PHP 5.3 issue.

Answer 5

It appears that I have clicked that update button little to fast... again...

If I have read official Release News The Joomla! 3.6.1 Update a little bit more carefully, I would have learned following from the third paragraph:

Updating from Joomla! 3.6.0

Update the Joomla! Update Component through the Extension Manager. Then use the Joomla! Update component to update to the latest 3.6.x version.

So I have tested this statement on second test site, and sure enough: After I clicked on extensions Updates are available! quickicon in control panel, among other updates there was that important one: Joomla! Update Component Update 3.6.1

I have updated that one first, and then went back to Joomla Update component and clicked on that blue button 'Install the update', this time without any problems or error messages.

Later on I have seen few tweets from Joomla PLT members, referring to official Joomla Github Release Joomla 3.6.1 which helps a little bit further:

IMPORTANT! Due to a security update in this release please upgrade to Joomla 3.6.0 first then install this new version of the Joomla Update Component through Extension Manager before continuing upgrading Joomla as normal**

There are also download links to all important packages in questions, even to that Joomla Update Component update itself com_joomlaupdate-3.6.1.zip, just in case that for some reason that update doesn't appear in your Extensions Update component on your site.

Moral of the story: RTFM!

EDIT: The good folks from JoomlaShack (ex-Alledia) just published What to Know About Updating to Joomla 3.6.2