Delete conversation message missing token

Permalink February 09, 2019 at 12:11 AM

Using C5 8.4.4 I cannot seem to delete a conversation message in the dashboard. When I select a message and click its delete link in the flyout menu I get the error 'Invalid conversation post token.'

Clicking the link posts to concrete/tools/conversations/delete_message.php with a payload containing the conversation message id. That file on line 10 is checking for a delete_conversation_message token.

The jquery sending the post is in concrete/single_pages/dashboard/conversations/messages.php ln: 168

data: {
                'cnvMessageID': $(this).attr('data-message-id')
            },

which I changed to:

data: {
                'cnvMessageID': $(this).attr('data-message-id')
               ,'token': "<?=Core::make('token')->generate('delete_conversation_message');?>"
            },

which fixes the problem but I don't like changing the core files and seems odd since I couldn't find anyone else complaining about this. Is this a real bug or does this work for others?