Summary: Front page editors can't create new media folders using the media manager.

Component: SP Page Builder (front-end editor)

Environment: Joomla 6.1.2, SP Page Builder 6.7.1, Trove Template 1.0.2, PHP 8.4

Description:

Three media manager AJAX calls in engine.js do not include the X-CSRF-Token header, while other media calls (upload_media, renameMedia, delete_media) do. This causes a 403 Forbidden response from SppagebuilderControllerMedia because the constructor calls Session::checkToken('post') at line 41 of controllers/media.php, which checks the X-CSRF-Token header first, then the POST body for the token. Since neither is present, the request is rejected before the controller method executes.

Affected calls in engine.js:

media.create_folder — jQuery AJAX POST with data:{folder:n}, no headers media.delete_folder — jQuery AJAX POST with data:{folder:n,deleteItem:"multiple"}, no headers media.rename_folder — jQuery AJAX POST with data:{currentfolder:n,newfolder:t,renameItem:"single"}, no headers

Working calls (for comparison):

media.upload_media — includes headers:{"X-CSRF-Token":Joomla.getOptions("csrf.token")} media.renameMedia — uses fetch() with headers:{"Content-Type":"application/json","X-CSRF-Token":Joomla.getOptions("csrf.token")} media.delete_media — uses fetch() with headers:{"Content-Type":"application/json","X-CSRF-Token":Joomla.getOptions("csrf.token")} Steps to reproduce:

Log in to the front-end as a user with editing permissions. Open a page in the SP Page Builder front-end editor. Open the Media Manager. Attempt to create a new folder. Observe 403 Forbidden in the browser console: POST index.php?option=com_sppagebuilder&task=media.create_folder 403 (Forbidden) The same occurs when deleting or renaming a folder. Expected behavior: Folder creation, deletion, and renaming should succeed without a 403 error.

Actual behavior: The request is rejected with 403 because the CSRF token is not sent.

Suggested fix:

Add headers:{"X-CSRF-Token":Joomla.getOptions("csrf.token")} to the jQuery AJAX options for all three calls in engine.js, consistent with how upload_media already handles it.

For create_folder:

ajax({
  type: "POST",
  url: pagebuilder_base + "index.php?option=com_sppagebuilder&task=media.create_folder",
  headers: {"X-CSRF-Token": Joomla.getOptions("csrf.token")},
  data: {folder: n},
  cache: !1,
  async: !1,
  success: function(e) { ... }
})

The same headers addition should be applied to the delete_folder and rename_folder AJAX calls.

Workaround (applied by user): Added a jQuery.ajaxPrefilter in the editor template (edit.php) to inject the CSRF token header for all POST requests to com_sppagebuilder that don't already include it:

$doc->addScriptDeclaration('jQuery.ajaxPrefilter(function(o){if("POST"===o.type&&o.url&&-1!==o.url.indexOf("com_sppagebuilder")){o.headers=o.headers||{},o.headers["X-CSRF-Token"]||(o.headers["X-CSRF-Token"]=Joomla.getOptions("csrf.token"))}});');

This is a temporary workaround that will need to be re-applied after each SP Page Builder update until the issue is fixed upstream.