Where. /admin/learn/courses/new
What happens. Creating a course fails with:
Invalid or missing security token. Please refresh and try again.
Likely cause. The CSRF token is missing from the course-create form or is not validated correctly on submit.
Related. The same error appears on other Learn admin forms (role edit, SCORM upload); these likely share one root cause in the Learn admin CSRF handling.
Status: verified, reproducible (always). Open — not yet actioned.
Patrick Bass
@mobieus
Resolved and deployed to production. Commit 0753b320f6.
All 48 Learn admin templates (including courses/new, scorm/new, cohorts/form) were using $_SESSION['csrf'] and name='_csrf' instead of the canonical $csrfToken / name='_csrf_token'. Mass-replaced across the entire Learn template tree. Course creation now works.
Status: fixed. Thread closed.
Patrick Bass
@mobieus
Glad you're here. Reading, posting, and browsing all work on mobile. A few power-user tools — the image editor and the bulk file uploader — are easier on a larger screen, so feel free to jump over to a desktop for those.
Patrick Bass