10

If you don't have Akeeba Backup installed: Go back to the Joomla Update page Upload and install the Joomla 3.6.1 Update Package using the "Upload & Update" tab Go to Extensions >> Manage >> Database You may see a message that the database is out of date. If so, click on the Fix button in the toolbar. If you have Akeeba Backup ...


8

Details about this issue can now be found in the Joomla Docs: What is the cause? 3.6.1 introduced a CSRF token check to the update component as an extra level of security. 3.6.0 down to 2.5.4 (every version with the update component) will hit the issue with the CSRF token because those versions don't generate the needed code to pass the check. ...


5

I also had the same error message after upgrading 3.6.0 -> 3.6.1: 0 Failed to start the session: already started by PHP ($_SESSION is set). To resolve, you need to use PHP Selector and change from 5.3 (it's a PHP 5.3 issue; will be fixed in Joomla 3.6.2). I change from 5.3 --> 5.6 and am now able to login the administration. Hope helps


4

I finally worked it out. I needed to create a session and assign it to the app before getFormToken would work. So first I use the Joomla session: use Joomla\Session\Session; Then create the session, set it and get the form token: $session = Session::getInstance('none'); $this->app->setSession($session); $token = $this->app->getFormToken(); ...


4

Apparently there area couple of issues with Joomla 3.5.0, one being to do with the session. Joomla 3.5.1 will be released tonight, hopefully fixing your issue. It may be an idea to put your site offline for a couple of hours until the update is released. And in future, I'd recommend taking a backup of your site and testing Joomla updates locally before ...


4

I also sometimes need to refresh the session token to prevent the user from using the back button or resubmitting the page. I do it in my controller with the below method /** * Convenience method to refresh the session token to prevent the back button * * @return void * @since 0.0.2 */ protected function refreshToken() { $session = JFactory::...


4

Playing with the sessions is usually not a very safe thing to do - you could create more problems by trying to find a solution. You can do one (or both) of the following: Increase the Session Lifetime under System, Global Configuration to a higher number, such as 1440 (1 day). This will minimize the problem, but will not eliminate it. Another problem with ...


4

I wanted to answer your earlier question about this yesterday, but someone was already answered this partially for you. So according to me your original Login Form token field should be a bit changed like the following: <form method="post" action="#" id="userForm"> <label for="username">Brugernavn</label> <input type="text" ...


3

One way I can imagine to check the session is before you ignite the above ajax call, you make a previous ajax call to another function in com_contract/controller(task = your new session checking function. so: url:...com_contract/task=checkSession) where you create a function, something like: public function checkSession() { try { $session1 =...


3

If people can't log into the back-end, there is an additional fix on github here: https://github.com/joomla/joomla-cms/pull/11430/files You must change the following lines on libraries/joomla/session/handler/native.php private $started; to private $started=false; and private $closed; to private $closed=false; Add the line $this->closed = true; after ...


3

The token is tied to the current user's session and is unique to that. As soon as that user has logged out then the token is no longer usable. i've never seen an issue with this set up for avoiding spoof attacks on forms, so I'm not sure you really have an issue to fix here. However, to answer your quersion, what you can do to create a new token is: ...


3

The tokens in Joomla are super important from a security perspective in forms to stop people from cross site scripting attacks - see http://en.wikipedia.org/wiki/Cross-site_scripting I strongly strongly advise not removing them under any circumstance. It's not in a controller tho. As for the check itself the check is made in the controller for example here ...


3

FoF has a handy _csrfProtection routine in the controller, with several ways to check the token: JUtility::getToken() (for Joomla 2.5, removed from Joomla 3.x) $session->getToken() $session->getFormToken() or, the _token field in any of the previous instances https://github.com/akeeba/fof/blob/development/fof/controller/controller.php#L3308


3

Curl expects the vars in simple key=> value form, then http encoded. So you need to set: $vars = 'jform[email]='.urlencode($emailadr).'&'.urlencode($token).'=1'; Note, no " for the field value of the token field


3

A few things occur to me: Are you sure you're submitting to a "site" controller, and not an "admin" controller? The token for a site vs. admin form will be different, since the session is different. Are you sure you're submitting via POST? If you are submitting via GET you need to check the token using JSession::checkToken('get') Are you ...


2

To prevent simple CSRF attacks, request tokens are added to forms in the front-end and back-end Joomla! interfaces. http://docs.joomla.org/How_to_add_CSRF_anti-spoofing_to_forms If there's a change in the user session, tokens can be lost or renewed. Examples: When the browsing session ends, session cookie is lost. If you access again, then a new token is ...


2

Is it possible hat you submit your form with the "GET" method? Because JSession::checkToken only validates against "POST" method, you have to use JSession::checkToken('get') or die(); if you like to check the GET requests.


2

First of all this sounds very weird. When opening the page in two browsers, Joomla should generate two different session ids (check the cookies that Joomla generates, they should be different!). This is because of the user agent. Once the token is generated, it is basically saved in the session and the next time you call getFormToken() on the Session ...


2

There have been a lot of known (yet unfixed) issues with the System Cache plugin and Use Browser Caching when trying to login. A lot of people have reported an Invalid Token. There are some other things that could be causing this. So try the following (some may not apply to your specifically) Disable apache's mod_cache Disable the server Memcache feature ...


2

Ok this is not a solution but a way around the problem is to just swap browsers. On Mac I have three browsers open when I am working on my development site (two would be enough) Just swap as the token (i believe) has a time limit and is basically just a login cookie. Then swap back later.


2

Turn off the System - Page Cache The issue is related to the cache.


2

It appears that I have clicked that update button little to fast... again... If I have read official Release News The Joomla! 3.6.1 Update a little bit more carefully, I would have learned following from the third paragraph: Updating from Joomla! 3.6.0 Update the Joomla! Update Component through the Extension Manager. Then use the Joomla! Update component ...


2

By default JSession::checkToken() checks the post request for a value named the token. It can also be set to look for get values in a query string like JSession::checkToken('get'). It doesn't know that a variable you've serialized manually in a structure you built yourself and called 'form' is where to find the token. To test it manually you could do ...


2

Some more ideas: Save a cookie in the user's browser. Get users IP address and store in BD.


2

Solving my issue Well in my case the issue was not related to Joomla core. I had to step away from it for a while and return with clear mind to find out that it was a custom directive inside the htaccess that was causing this issue. It looks like someone wanted to prevent access to the com_users component in the front-end. RewriteCond %{REQUEST_URI} !^/...


2

To get the session state, you can use the following: JFactory::getSession()->getState(); I'm not sure if this script is inline or a separate file. If it's inline then you can simply add the following to your Javascript: var sessionState = '<?php echo JFactory::getSession()->getState(); ?>'; if (sessionState === 'expired') { // redirect to ...


2

well after the valuable help of @Zollie I will post the answer and working code to help others. A sample of the template file : <form action="<?php echo JRoute::_('index.php?option=com_contract&view=contracts'); ?>" id="adminForm" method="post" name="adminForm"> <?php if (!empty($this->items)) { ?> <div class="...


2

JRequest::checkToken() is deprecated. So use if( JSession::checkToken() ==false){ echo "The form was not submitted"; }else{ // Display the view parent::display($tpl); } // Set the document $this->setDocument(); OR better you can even use JSession::getFormToken().


2

I think you could more easily achieve what you're trying to do by displaying the other page as a response to the HTTP POST associated with the form submission, rather than by using a redirect. After a form is submitted the core Joomla components always redirect to another page via a GET, but you don't have to follow that approach. You can provide the other ...


1

You could put both functions in a class in the helper.php file of your component. Include the helper file in the entry point of your component ( in /components/com_yourcomponentname/yourcomponentname.php) and then you could use the methods in all parts of your component.


Only top voted, non community-wiki answers of a minimum length are eligible