Unfortunately, the root cause of this behavior cannot be fixed without a major rework of the way form security is handled in MantisBT.

MantisBT retrieves the form security token from the PHP session; the maximum validity of stored session data is not defined in Mantis but in PHP itself (session.gc_maxlifetime). If garbage collection has taken place, then this information is no longer available to Mantis.

The error message you get has to be generic as it has multiple possible causes, and due what I explained above, we are not able to determine which.

If you get this error a lot, it may be worth increasing the value of this parameter in your installation to something that fits your usage scenario.

At the moment, I believe the only thing that can reasonably be done, is to modify the error message to reflect the fact that this error can also be triggered by a session timeout.

Original message for error 2800 is:

Invalid form security token. Did you submit the form twice by accident?

Proposed alternative error message:

Invalid form security token. This may happen if you submitted the form twice by accident, or because your session has timed out.

Invalid form security token. This could be caused by accidentally submitting the form twice, or by a session timeout.

Thoughts, comments ?

The error message has been amended, and a new Troubleshooting chapter added to the Admin guide with some explanations on the cause of this error and possible workarounds.

Marking as 'acknowledged' not resolved/closed to track that change gets ported to master-2.0.x branch