OpenCart throws Invalid Token Session after deleting orders - ajax

Question

I have written a bespoke Ajax call and function to delete missing orders in OpenCart 2.1.0.2. Although the function works as it should, and the orders are deleted, upon return from the controller, OpenCart logs me out and gives me an Invalid Token Session error, even though the passed token is correct.
Here's my ajax call on the order_list.tpl template:
$('#button-delete_missing').on('click', function(e) {
if (confirm('<?php echo $text_confirm; ?>')) {
var node = this;
$.ajax({
url: '<?php echo $store; ?>index.php?route=api/order/deleteMissing&token=<?php echo $_GET["token"] ?>',
dataType: 'json',
crossDomain: true,
beforeSend: function () {
$(node).button('loading');
},
complete: function () {
$(node).button('reset');
},
success: function (json) {
$('.alert').remove();
if (json['error']) {
$('#content > .container-fluid').prepend('<div class="alert alert-danger"><i class="fa fa-exclamation-circle"></i> ' + json['error'] + ' <button type="button" class="close" data-dismiss="alert">×</button></div>');
}
if (json['success']) {
$('#content > .container-fluid').prepend('<div class="alert alert-success"><i class="fa fa-check-circle"></i> ' + json['success'] + ' <button type="button" class="close" data-dismiss="alert">×</button></div>');
}
},
error: function (xhr, ajaxOptions, thrownError) {
alert(thrownError + "\r\n" + xhr.statusText + "\r\n" + xhr.responseText);
}
});
}
});
This is exactly the same as the other calls on the page, except it's going to a different function in the controller:
public function deleteMissing() {
$this->load->language('api/order');
$json = array();
$this->load->model('checkout/order');
$this->model_checkout_order->deleteMissingOrders();
$json['success'] = $this->language->get('text_success');
if (isset($this->request->server['HTTP_ORIGIN'])) {
$this->response->addHeader('Access-Control-Allow-Origin: ' . $this->request->server['HTTP_ORIGIN']);
$this->response->addHeader('Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS');
$this->response->addHeader('Access-Control-Max-Age: 1000');
$this->response->addHeader('Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With');
}
$this->response->addHeader('Content-Type: application/json');
$this->response->setOutput(json_encode($json));
}
Which, in turn, is the same as the delete function, just without the need for a specific order id. Here's the function in the model that actually does the delete:
public function deleteMissingOrders() {
$query = $this->db->query("SELECT order_id FROM " . DB_PREFIX . "order WHERE order_status_id = 0 OR order_status_id = null");
$rows = $query->rows;
$order_ids = array();
foreach($rows as $row) {
$order_ids[] = $row['order_id'];
}
if(!empty($order_ids)) {
foreach($order_ids as $order_id) {
$this->db->query("DELETE FROM `" . DB_PREFIX . "order` WHERE order_id = '" . (int)$order_id . "'");
$this->db->query("DELETE FROM `" . DB_PREFIX . "order_product` WHERE order_id = '" . (int)$order_id . "'");
$this->db->query("DELETE FROM `" . DB_PREFIX . "order_option` WHERE order_id = '" . (int)$order_id . "'");
$this->db->query("DELETE FROM `" . DB_PREFIX . "order_voucher` WHERE order_id = '" . (int)$order_id . "'");
$this->db->query("DELETE FROM `" . DB_PREFIX . "order_total` WHERE order_id = '" . (int)$order_id . "'");
}
}
}
The function gets all the null or zero ID order statuses and deletes all relevant data - this WORKS. I've tried it, and all the missing orders are deleted; it's just that when it comes back it throws a non-descript error (i.e. does not run the success part of the ajax call) and logs me out of the admin area.
If anyone can help with this I would be grateful. Maybe there's one thing I've missed, or something I haven't put in which is needed?

Answer 1

I I'm reading this correctly, your script doesnt seem to know what token is. Does it have a declaration? Because Jquery doesnt know what PHP knows.
Do something like
var token = <?php echo $_GET['token'] ?>;