Oh, no problem. I just think that it is a bigger issue than some people think.  I think it makes our Elgg web-sites end up looking pretty lame, when it throws this token mismatch error in a user's face.

The token error on login/logout can be modified by an admin. This is open source software after all. See /engine/lib/actions.php - the exceptions array in action().

The ticket on future enhancements on this is here: http://trac.elgg.org/elgg/ticket/1509

At a minimum, you could override the language string on the error message to say "So you thought you were going to log out, didn't you? Better luck next time."

So far this beta is going very well. Thanks for testing with us.

I am getting the token error when trying to confirm email upon a second registration. Gives error and wont complete the confirm. Anyone else get this? Fix?

1.7b fresh install

Looking at the code, this should be impossible. The confirmation email gives you a link that takes you to a page rather than to an action. Only actions require tokens. I'm also not able to reproduce this.

Cash click this link, this the generated link to confirm a new user account.

http://localpeeps.net/action/email/confirm?u=37&c=b4750ba362dde4ea6c7e59aaf5601b04

If you further interested, you can try setting a user account at one of my test 1.7b sites.

mypaintersplace.com

localpeeps.net

yep.. he flunks.. i can see that your token error is also possible --> takes you straight to the grasps of the action_handler.php ;-( you might have uncovered another 'bug'

1.7 doesn't send you to that address. I'd guess that you are running a 3rd party plugin.

@Cash,

I just read the 1.7b core code !!

--->

http://localpeeps.net/action/email/confirm?u=37&c=b4750ba362dde4ea6c7e59aaf5601b04

--->

RewriteRule ^action\/([A-Za-z0-9\_\-\/]+)$ engine/handlers/action_handler.php?action=$1

--->

define('externalpage',true);
require_once("../start.php");
$action = get_input("action");
action($action);

--->

        function action($action, $forwarder = "") {
           
            global $CONFIG;
           
           
            $query = parse_url($_SERVER['REQUEST_URI']);
            if (isset($query['query'])) {
                $query = $query['query'];
                $query = rawurldecode($query);
                $query = explode('&',$query);
                if (sizeof($query) > 0) {
                    foreach($query as $queryelement) {
                        $vals = explode('=',$queryelement, 2);
                        if (sizeof($vals) > 1) {
                            set_input(trim($vals[0]),trim($vals[1]));
                        }
                    }
                }
            }
           
            $forwarder = str_replace($CONFIG->url, "", $forwarder);
            $forwarder = str_replace("http://", "", $forwarder);
            $forwarder = str_replace("@", "", $forwarder);

            if (substr($forwarder,0,1) == "/") {
                $forwarder = substr($forwarder,1);
            }
           
            if (isset($CONFIG->actions[$action])) {
                if (
                    (isadminloggedin()) ||
                    (!$CONFIG->actions[$action]['admin'])
                ) {
                    if ($CONFIG->actions[$action]['public'] || $_SESSION['id'] != -1) {
                       
                        // Trigger action event TODO: This is only called before the primary action is called. We need to rethink actions for 1.5
                        $event_result = true;
                        $event_result = trigger_plugin_hook('action', $action, null, $event_result);
                       
                        // Include action
                        if ($event_result) // Event_result being false doesn't produce an error - since i assume this will be handled in the hook itself. TODO make this better!
                        {
                            /** Refs #749: We now warn if action token is missing. Later this will be replaced with action_gatekeeper() as detailed in #750 */
                            if (!validate_action_token(false))
                            {
                                // Display a temporary warning message - in future versions this will be a hard fail via an action gatekeeper.
                                $message = "WARNING: Action $action was called without an action token. It is stongly recommended that you consider doing this. Plugin authors should use 'input/form' or pass is_action=true to 'output/confirmlink' or 'output/url'.";
                               
                                //if ((!isset($CONFIG->disable_action_token_warning)) || (!$CONFIG->disable_action_token_warning))
                                //    register_error($message);
                                   
                                error_log($message);
                            }
                           
                            if (include($CONFIG->actions[$action]['file'])) {
                            } else {
                                register_error(sprintf(elgg_echo('actionundefined'),$action));
                            }
                        }
                    } else {
                        register_error(elgg_echo('actionloggedout'));
                    }
                }
            } else {
                register_error(sprintf(elgg_echo('actionundefined'),$action));
            }
           
           
            forward($CONFIG->url . $forwarder);
           
        }
   
    /**
     * Registers a particular action in memory
     *
     * @param string $action The name of the action (eg "register", "account/settings/save")
     * @param boolean $public Can this action be accessed by people not logged into the system?
     * @param string $filename Optionally, the filename where this action is located
     * @param boolean $admin_only Whether this action is only available to admin users.
     */
       
        function register_action($action, $public = false, $filename = "", $admin_only = false) {
            global $CONFIG;           
           
            if (!isset($CONFIG->actions)) {
                $CONFIG->actions = array();
            }
           
            if (empty($filename)) {
                $path = "";
                if (isset($CONFIG->path)) $path = $CONFIG->path;
               
                $filename = $path . "actions/" . $action . ".php";
            }
           
            $CONFIG->actions[$action] = array('file' => $filename, 'public' => $public, 'admin' => $admin_only);
            return true;
        }

Cash and Dhrup,

#1 I turned off all the plugins and I still get the same error. Did you try to register? How to keep trying to register when I run out of my three email addresses I use?

#2 I just registered another account after turning off all the plugins and it gave me a confirm, and then couldn't sign in. When I log in with my only working username I can't see the new register!!

I loaded the 1.7 beta files over the 1.7a I show. Here is my release, this the new Beta?