Summary: Front page editors can't create new media folders using the media manager.
Component: SP Page Builder (front-end editor)
Environment: Joomla 6.1.2, SP Page Builder 6.7.1, Trove Template 1.0.2, PHP 8.4
Description:
Three media manager AJAX calls in engine.js do not include the X-CSRF-Token header, while other media calls (upload_media, renameMedia, delete_media) do. This causes a 403 Forbidden response from SppagebuilderControllerMedia because the constructor calls Session::checkToken('post') at line 41 of controllers/media.php, which checks the X-CSRF-Token header first, then the POST body for the token. Since neither is present, the request is rejected before the controller method executes.
Affected calls in engine.js:
media.create_folder — jQuery AJAX POST with data:{folder:n}, no headers
media.delete_folder — jQuery AJAX POST with data:{folder:n,deleteItem:"multiple"}, no headers
media.rename_folder — jQuery AJAX POST with data:{currentfolder:n,newfolder:t,renameItem:"single"}, no headers
Working calls (for comparison):
media.upload_media — includes headers:{"X-CSRF-Token":Joomla.getOptions("csrf.token")}
media.renameMedia — uses fetch() with headers:{"Content-Type":"application/json","X-CSRF-Token":Joomla.getOptions("csrf.token")}
media.delete_media — uses fetch() with headers:{"Content-Type":"application/json","X-CSRF-Token":Joomla.getOptions("csrf.token")}
Steps to reproduce:
Log in to the front-end as a user with editing permissions.
Open a page in the SP Page Builder front-end editor.
Open the Media Manager.
Attempt to create a new folder.
Observe 403 Forbidden in the browser console: POST index.php?option=com_sppagebuilder&task=media.create_folder 403 (Forbidden)
The same occurs when deleting or renaming a folder.
Expected behavior: Folder creation, deletion, and renaming should succeed without a 403 error.
Actual behavior: The request is rejected with 403 because the CSRF token is not sent.
Suggested fix:
Add headers:{"X-CSRF-Token":Joomla.getOptions("csrf.token")} to the jQuery AJAX options for all three calls in engine.js, consistent with how upload_media already handles it.
For create_folder:
ajax({
type: "POST",
url: pagebuilder_base + "index.php?option=com_sppagebuilder&task=media.create_folder",
headers: {"X-CSRF-Token": Joomla.getOptions("csrf.token")},
data: {folder: n},
cache: !1,
async: !1,
success: function(e) { ... }
})The same headers addition should be applied to the delete_folder and rename_folder AJAX calls.
Workaround (applied by user):
Added a jQuery.ajaxPrefilter in the editor template (edit.php) to inject the CSRF token header for all POST requests to com_sppagebuilder that don't already include it:
$doc->addScriptDeclaration('jQuery.ajaxPrefilter(function(o){if("POST"===o.type&&o.url&&-1!==o.url.indexOf("com_sppagebuilder")){o.headers=o.headers||{},o.headers["X-CSRF-Token"]||(o.headers["X-CSRF-Token"]=Joomla.getOptions("csrf.token"))}});');