CSRF Error on unpublishing

[cjx2240]

Hi

I've just inherited a ProcessWire site built by someone else and I'm hitting an error when unpublishing a page. (The error appears like a js alert with "undefined" as the message)

In logs, I get the following:

URL: /login/page/?action=unpub&id=3769&render=json

Text: CSRF token does not match (in D:\sites\***\public_html\wire\modules\Process\ProcessPageList\ProcessPageList.module line 434)

Does anyone have any ideas? This happens locally and on the production server. I'm also hitting a lot of "Session appears to be forged" issues. Site is on ProcessWire 3.0.142

Thanks

[flydev]

after a backup, I would delete session files in site/assets/sessions and clean entries in the db, table `session_login_throttle` before going further.

[cjx2240]

Hi @flydev ?? - thanks for the suggestions.

Actually this site is using Session Handler Database module but this pointed me towards that at least.

Removing that module fixes it (had to manually remove it because I got the "forged" CSRF exception when trying to uninstall it)

Not sure exactly why it was giving me grief with this particular site. I found another thread saying to change the sessions "data" column to mediumtext might solve this but it already was...