A detailed description of the problem: I give a player Edit permission on a Token's Bar 1 using the check box under Token Settings, update the default token, and save changes. I drag out the same character, the box is now unchecked and the player cannot edit the bar. Steps to reproduce: I drag a charcter (ex: draconic spirit) from the Compendium for the 2024 PHB to the page to add it to the game, then delete it and change the token art I Drag the token from the journal on to a page I left click the token Then I click the cog to get into Token Settings I then hover over the three vertical dots to the right of Bar 1 I check the Edit box under Player Permissions I click Update Default Token I click Save Changes I drag the same character token from the journal on to the page I left click the token Then I click the cog to get into Token Settings I then hover over the three vertical dots to the right of Bar 1 The Edit box is no longer checked Description of your setup: Google Chrome Version 138.0.7204.101 (Official Build) (64-bit) Microsoft Windows 11 Home JavaScript status: Enabled Link to Roll20 profile: <a href="https://app.roll20.net/users/674721/spider" rel="nofollow">https://app.roll20.net/users/674721/spider</a> Link to game: <a href="https://app.roll20.net/campaigns/details/18438923/world-of-greyhawk-saltmarsh" rel="nofollow">https://app.roll20.net/campaigns/details/18438923/world-of-greyhawk-saltmarsh</a> Screenshots: <a href="https://imgur.com/a/TnOP9aL" rel="nofollow">https://imgur.com/a/TnOP9aL</a> Browser add-ons or extensions enabled: AdBlock, Google Docs Offline, Google Translate Console Log: jquery.migrate.js:20 JQMIGRATE: Logging is active gtm.js?id=GTM-MKL9HM6&gtm_auth=RyNPjkDTh-LgK4oo5gJi6A&gtm_preview=env-1&gtm_cookies_win=x:262 Refused to load the script ' <a href="https://snap.licdn.com/li.lms-analytics/insight.min.js" rel="nofollow">https://snap.licdn.com/li.lms-analytics/insight.min.js</a> ' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval' 'nonce-I1NoEAH8G8yJP9Ci' 'nonce-8i2FF5yoDP1DbHn9' 'nonce-TBZ2raUP8MxvlEuO' <a href="https://cdn.roll20.net" rel="nofollow">https://cdn.roll20.net</a> blob: <a href="https://www.datadoghq-browser-agent.com" rel="nofollow">https://www.datadoghq-browser-agent.com</a> <a href="http://cdn.inspectlet.com" rel="nofollow">http://cdn.inspectlet.com</a> https://*.googlesyndication.com https://*.doubleclick.net https://*.thedemiplane.com https://*.demiplane.com <a href="https://partner.googleadservices.com" rel="nofollow">https://partner.googleadservices.com</a> <a href="https://www.googletagservices.com" rel="nofollow">https://www.googletagservices.com</a> <a href="https://ssl.google-analytics.com" rel="nofollow">https://ssl.google-analytics.com</a> <a href="https://www.google-analytics.com" rel="nofollow">https://www.google-analytics.com</a> <a href="https://ajax.googleapis.com" rel="nofollow">https://ajax.googleapis.com</a> <a href="https://apis.google.com" rel="nofollow">https://apis.google.com</a> <a href="http://ajax.googleapis.com" rel="nofollow">http://ajax.googleapis.com</a> <a href="https://d3clqjduf2gvxg.cloudfront.net" rel="nofollow">https://d3clqjduf2gvxg.cloudfront.net</a> <a href="https://cdn.firebase.com" rel="nofollow">https://cdn.firebase.com</a> https://*.firebaseio.com https://*.tokbox.com https://*.opentok.com <a href="http://static.opentok.com" rel="nofollow">http://static.opentok.com</a> <a href="http://www.google-analytics.com" rel="nofollow">http://www.google-analytics.com</a> <a href="http://cdn.crowdin.com" rel="nofollow">http://cdn.crowdin.com</a> <a href="https://crowdin.com" rel="nofollow">https://crowdin.com</a> <a href="http://stun.l.google.com" rel="nofollow">http://stun.l.google.com</a> *.sentry-cdn.com <a href="https://www.googletagmanager.com" rel="nofollow">https://www.googletagmanager.com</a> https://*.refiner.io https://*.maze.co". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback. Ec @ gtm.js?id=GTM-MKL9HM6&gtm_auth=RyNPjkDTh-LgK4oo5gJi6A&gtm_preview=env-1&gtm_cookies_win=x:262 gtm.js?id=GTM-MKL9HM6&gtm_auth=RyNPjkDTh-LgK4oo5gJi6A&gtm_preview=env-1&gtm_cookies_win=x:262 Refused to load the script ' <a href="https://bat.bing.com/bat.js" rel="nofollow">https://bat.bing.com/bat.js</a> ' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval' 'nonce-I1NoEAH8G8yJP9Ci' 'nonce-8i2FF5yoDP1DbHn9' 'nonce-TBZ2raUP8MxvlEuO' <a href="https://cdn.roll20.net" rel="nofollow">https://cdn.roll20.net</a> blob: <a href="https://www.datadoghq-browser-agent.com" rel="nofollow">https://www.datadoghq-browser-agent.com</a> <a href="http://cdn.inspectlet.com" rel="nofollow">http://cdn.inspectlet.com</a> https://*.googlesyndication.com https://*.doubleclick.net https://*.thedemiplane.com https://*.demiplane.com <a href="https://partner.googleadservices.com" rel="nofollow">https://partner.googleadservices.com</a> <a href="https://www.googletagservices.com" rel="nofollow">https://www.googletagservices.com</a> <a href="https://ssl.google-analytics.com" rel="nofollow">https://ssl.google-analytics.com</a> <a href="https://www.google-analytics.com" rel="nofollow">https://www.google-analytics.com</a> <a href="https://ajax.googleapis.com" rel="nofollow">https://ajax.googleapis.com</a> <a href="https://apis.google.com" rel="nofollow">https://apis.google.com</a> <a href="http://ajax.googleapis.com" rel="nofollow">http://ajax.googleapis.com</a> <a href="https://d3clqjduf2gvxg.cloudfront.net" rel="nofollow">https://d3clqjduf2gvxg.cloudfront.net</a> <a href="https://cdn.firebase.com" rel="nofollow">https://cdn.firebase.com</a> https://*.firebaseio.com https://*.tokbox.com https://*.opentok.com <a href="http://static.opentok.com" rel="nofollow">http://static.opentok.com</a> <a href="http://www.google-analytics.com" rel="nofollow">http://www.google-analytics.com</a> <a href="http://cdn.crowdin.com" rel="nofollow">http://cdn.crowdin.com</a> <a href="https://crowdin.com" rel="nofollow">https://crowdin.com</a> <a href="http://stun.l.google.com" rel="nofollow">http://stun.l.google.com</a> *.sentry-cdn.com <a href="https://www.googletagmanager.com" rel="nofollow">https://www.googletagmanager.com</a> https://*.refiner.io https://*.maze.co". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback. Ec @ gtm.js?id=GTM-MKL9HM6&gtm_auth=RyNPjkDTh-LgK4oo5gJi6A&gtm_preview=env-1&gtm_cookies_win=x:262 CAMPAIGN ID: 18438923 vtt.bundle.9f1415d38b44eef4b71c.js:52103 USING WEBGL ACCELERATION... vtt.bundle.9f1415d38b44eef4b71c.js:52103 WEBGL STARTUP SUCCESS vue.esm-browser.js:12663 You are running a development build of Vue. Make sure to use the production build (*.prod.js) when deploying for production. vtt.bundle.9f1415d38b44eef4b71c.js:52164 Loading Custom character sheets. vtt.bundle.9f1415d38b44eef4b71c.js:6250 Activating Jumpgate/Legacy Bridge Uh @ vtt.bundle.9f1415d38b44eef4b71c.js:6250 vtt.bundle.9f1415d38b44eef4b71c.js:42849 BJS - [07:49:52]: Babylon.js v7.10.2 - WebGL2 - Parallel shader compilation tutorial_tips.js:7 tuts loaded gtm.js?id=GTM-MKL9HM6&gtm_auth=RyNPjkDTh-LgK4oo5gJi6A&gtm_preview=env-1&gtm_cookies_win=x:222 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval' 'nonce-I1NoEAH8G8yJP9Ci' 'nonce-8i2FF5yoDP1DbHn9' 'nonce-TBZ2raUP8MxvlEuO' <a href="https://cdn.roll20.net" rel="nofollow">https://cdn.roll20.net</a> blob: <a href="https://www.datadoghq-browser-agent.com" rel="nofollow">https://www.datadoghq-browser-agent.com</a> <a href="http://cdn.inspectlet.com" rel="nofollow">http://cdn.inspectlet.com</a> https://*.googlesyndication.com https://*.doubleclick.net https://*.thedemiplane.com https://*.demiplane.com <a href="https://partner.googleadservices.com" rel="nofollow">https://partner.googleadservices.com</a> <a href="https://www.googletagservices.com" rel="nofollow">https://www.googletagservices.com</a> <a href="https://ssl.google-analytics.com" rel="nofollow">https://ssl.google-analytics.com</a> <a href="https://www.google-analytics.com" rel="nofollow">https://www.google-analytics.com</a> <a href="https://ajax.googleapis.com" rel="nofollow">https://ajax.googleapis.com</a> <a href="https://apis.google.com" rel="nofollow">https://apis.google.com</a> <a href="http://ajax.googleapis.com" rel="nofollow">http://ajax.googleapis.com</a> <a href="https://d3clqjduf2gvxg.cloudfront.net" rel="nofollow">https://d3clqjduf2gvxg.cloudfront.net</a> <a href="https://cdn.firebase.com" rel="nofollow">https://cdn.firebase.com</a> https://*.firebaseio.com https://*.tokbox.com https://*.opentok.com <a href="http://static.opentok.com" rel="nofollow">http://static.opentok.com</a> <a href="http://www.google-analytics.com" rel="nofollow">http://www.google-analytics.com</a> <a href="http://cdn.crowdin.com" rel="nofollow">http://cdn.crowdin.com</a> <a href="https://crowdin.com" rel="nofollow">https://crowdin.com</a> <a href="http://stun.l.google.com" rel="nofollow">http://stun.l.google.com</a> *.sentry-cdn.com <a href="https://www.googletagmanager.com" rel="nofollow">https://www.googletagmanager.com</a> https://*.refiner.io https://*.maze.co". Either the 'unsafe-inline' keyword, a hash ('sha256-77bgQblnRaKk1m8aq2FHqKiER4ywljc0EoTvK4RBca4='), or a nonce ('nonce-...') is required to enable inline execution. f.ba @ gtm.js?id=GTM-MKL9HM6&gtm_auth=RyNPjkDTh-LgK4oo5gJi6A&gtm_preview=env-1&gtm_cookies_win=x:222 totallyNotAnalytics.bundle.211eae135d34dbffa65b.js:3 Error fetching content: TypeError: Cannot read properties of undefined (reading 'protocol') ct.<computed> @ totallyNotAnalytics.bundle.211eae135d34dbffa65b.js:3 totallyNotAnalytics.bundle.211eae135d34dbffa65b.js:3 Error fetching content: TypeError: Cannot read properties of undefined (reading 'protocol') ct.<computed> @ totallyNotAnalytics.bundle.211eae135d34dbffa65b.js:3 data:image/png;base…:1 Failed to load resource: net::ERR_INVALID_URL gtm.js?id=GTM-MKL9HM6&gtm_auth=RyNPjkDTh-LgK4oo5gJi6A&gtm_preview=env-1&gtm_cookies_win=x:222 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval' 'nonce-I1NoEAH8G8yJP9Ci' 'nonce-8i2FF5yoDP1DbHn9' 'nonce-TBZ2raUP8MxvlEuO' <a href="https://cdn.roll20.net" rel="nofollow">https://cdn.roll20.net</a> blob: <a href="https://www.datadoghq-browser-agent.com" rel="nofollow">https://www.datadoghq-browser-agent.com</a> <a href="http://cdn.inspectlet.com" rel="nofollow">http://cdn.inspectlet.com</a> https://*.googlesyndication.com https://*.doubleclick.net https://*.thedemiplane.com https://*.demiplane.com <a href="https://partner.googleadservices.com" rel="nofollow">https://partner.googleadservices.com</a> <a href="https://www.googletagservices.com" rel="nofollow">https://www.googletagservices.com</a> <a href="https://ssl.google-analytics.com" rel="nofollow">https://ssl.google-analytics.com</a> <a href="https://www.google-analytics.com" rel="nofollow">https://www.google-analytics.com</a> <a href="https://ajax.googleapis.com" rel="nofollow">https://ajax.googleapis.com</a> <a href="https://apis.google.com" rel="nofollow">https://apis.google.com</a> <a href="http://ajax.googleapis.com" rel="nofollow">http://ajax.googleapis.com</a> <a href="https://d3clqjduf2gvxg.cloudfront.net" rel="nofollow">https://d3clqjduf2gvxg.cloudfront.net</a> <a href="https://cdn.firebase.com" rel="nofollow">https://cdn.firebase.com</a> https://*.firebaseio.com https://*.tokbox.com https://*.opentok.com <a href="http://static.opentok.com" rel="nofollow">http://static.opentok.com</a> <a href="http://www.google-analytics.com" rel="nofollow">http://www.google-analytics.com</a> <a href="http://cdn.crowdin.com" rel="nofollow">http://cdn.crowdin.com</a> <a href="https://crowdin.com" rel="nofollow">https://crowdin.com</a> <a href="http://stun.l.google.com" rel="nofollow">http://stun.l.google.com</a> *.sentry-cdn.com <a href="https://www.googletagmanager.com" rel="nofollow">https://www.googletagmanager.com</a> https://*.refiner.io https://*.maze.co". Either the 'unsafe-inline' keyword, a hash ('sha256-ZdDTEfl8xrGn7iZ/2mMDizDIe6JRmep2vz9STHJi4Zs='), or a nonce ('nonce-...') is required to enable inline execution. f.ba @ gtm.js?id=GTM-MKL9HM6&gtm_auth=RyNPjkDTh-LgK4oo5gJi6A&gtm_preview=env-1&gtm_cookies_win=x:222 vtt.bundle.9f1415d38b44eef4b71c.js:6964 GPU tier: 3 gtm.js?id=GTM-MKL9HM6&gtm_auth=RyNPjkDTh-LgK4oo5gJi6A&gtm_preview=env-1&gtm_cookies_win=x:876 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval' 'nonce-I1NoEAH8G8yJP9Ci' 'nonce-8i2FF5yoDP1DbHn9' 'nonce-TBZ2raUP8MxvlEuO' <a href="https://cdn.roll20.net" rel="nofollow">https://cdn.roll20.net</a> blob: <a href="https://www.datadoghq-browser-agent.com" rel="nofollow">https://www.datadoghq-browser-agent.com</a> <a href="http://cdn.inspectlet.com" rel="nofollow">http://cdn.inspectlet.com</a> https://*.googlesyndication.com https://*.doubleclick.net https://*.thedemiplane.com https://*.demiplane.com <a href="https://partner.googleadservices.com" rel="nofollow">https://partner.googleadservices.com</a> <a href="https://www.googletagservices.com" rel="nofollow">https://www.googletagservices.com</a> <a href="https://ssl.google-analytics.com" rel="nofollow">https://ssl.google-analytics.com</a> <a href="https://www.google-analytics.com" rel="nofollow">https://www.google-analytics.com</a> <a href="https://ajax.googleapis.com" rel="nofollow">https://ajax.googleapis.com</a> <a href="https://apis.google.com" rel="nofollow">https://apis.google.com</a> <a href="http://ajax.googleapis.com" rel="nofollow">http://ajax.googleapis.com</a> <a href="https://d3clqjduf2gvxg.cloudfront.net" rel="nofollow">https://d3clqjduf2gvxg.cloudfront.net</a> <a href="https://cdn.firebase.com" rel="nofollow">https://cdn.firebase.com</a> https://*.firebaseio.com https://*.tokbox.com https://*.opentok.com <a href="http://static.opentok.com" rel="nofollow">http://static.opentok.com</a> <a href="http://www.google-analytics.com" rel="nofollow">http://www.google-analytics.com</a> <a href="http://cdn.crowdin.com" rel="nofollow">http://cdn.crowdin.com</a> <a href="https://crowdin.com" rel="nofollow">https://crowdin.com</a> <a href="http://stun.l.google.com" rel="nofollow">http://stun.l.google.com</a> *.sentry-cdn.com <a href="https://www.googletagmanager.com" rel="nofollow">https://www.googletagmanager.com</a> https://*.refiner.io https://*.maze.co". Either the 'unsafe-inline' keyword, a hash ('sha256-WMvB5a9sfb5yenMcovFF+86zyadX3yXLPLdqGcd3u5A='), or a nonce ('nonce-...') is required to enable inline execution. (anonymous) @ gtm.js?id=GTM-MKL9HM6&gtm_auth=RyNPjkDTh-LgK4oo5gJi6A&gtm_preview=env-1&gtm_cookies_win=x:876 gtm.js?id=GTM-MKL9HM6&gtm_auth=RyNPjkDTh-LgK4oo5gJi6A&gtm_preview=env-1&gtm_cookies_win=x:876 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval' 'nonce-I1NoEAH8G8yJP9Ci' 'nonce-8i2FF5yoDP1DbHn9' 'nonce-TBZ2raUP8MxvlEuO' <a href="https://cdn.roll20.net" rel="nofollow">https://cdn.roll20.net</a> blob: <a href="https://www.datadoghq-browser-agent.com" rel="nofollow">https://www.datadoghq-browser-agent.com</a> <a href="http://cdn.inspectlet.com" rel="nofollow">http://cdn.inspectlet.com</a> https://*.googlesyndication.com https://*.doubleclick.net https://*.thedemiplane.com https://*.demiplane.com <a href="https://partner.googleadservices.com" rel="nofollow">https://partner.googleadservices.com</a> <a href="https://www.googletagservices.com" rel="nofollow">https://www.googletagservices.com</a> <a href="https://ssl.google-analytics.com" rel="nofollow">https://ssl.google-analytics.com</a> <a href="https://www.google-analytics.com" rel="nofollow">https://www.google-analytics.com</a> <a href="https://ajax.googleapis.com" rel="nofollow">https://ajax.googleapis.com</a> <a href="https://apis.google.com" rel="nofollow">https://apis.google.com</a> <a href="http://ajax.googleapis.com" rel="nofollow">http://ajax.googleapis.com</a> <a href="https://d3clqjduf2gvxg.cloudfront.net" rel="nofollow">https://d3clqjduf2gvxg.cloudfront.net</a> <a href="https://cdn.firebase.com" rel="nofollow">https://cdn.firebase.com</a> https://*.firebaseio.com https://*.tokbox.com https://*.opentok.com <a href="http://static.opentok.com" rel="nofollow">http://static.opentok.com</a> <a href="http://www.google-analytics.com" rel="nofollow">http://www.google-analytics.com</a> <a href="http://cdn.crowdin.com" rel="nofollow">http://cdn.crowdin.com</a> <a href="https://crowdin.com" rel="nofollow">https://crowdin.com</a> <a href="http://stun.l.google.com" rel="nofollow">http://stun.l.google.com</a> *.sentry-cdn.com <a href="https://www.googletagmanager.com" rel="nofollow">https://www.googletagmanager.com</a> https://*.refiner.io https://*.maze.co". Either the 'unsafe-inline' keyword, a hash ('sha256-VussMEcsqEPalla4i7RvpHqvRE4+2WmSh4DL2kBzaD4='), or a nonce ('nonce-...') is required to enable inline execution. (anonymous) @ gtm.js?id=GTM-MKL9HM6&gtm_auth=RyNPjkDTh-LgK4oo5gJi6A&gtm_preview=env-1&gtm_cookies_win=x:876 editor/:1 <meta name="apple-mobile-web-app-capable" content="yes"> is deprecated. Please include <meta name="mobile-web-app-capable" content="yes"> vtt.bundle.9f1415d38b44eef4b71c.js:38594 ➡️ Roll20 Beacon v1.7.13 (SDK: v0.0.37) ➡️ ⬅️ Roll20 Beacon SDK v0.0.37 ⬅️ vtt.bundle.9f1415d38b44eef4b71c.js:7164 Player -O8tKH4oeva3nBmWiV5a is offline... vtt.bundle.9f1415d38b44eef4b71c.js:7164 Player -ODdXWyqkS7Kwnj9MP3r is offline... vtt.bundle.9f1415d38b44eef4b71c.js:7164 Player -ODdpN62uy9rDp1sthAX is offline... vtt.bundle.9f1415d38b44eef4b71c.js:7164 Player -ODnJ189GUOmYZkxP1zL is offline... vtt.bundle.9f1415d38b44eef4b71c.js:7164 Player -OEkJIqbyZBA39Fa4Jo0 is offline... vtt.bundle.9f1415d38b44eef4b71c.js:7164 Player -OOODldpCdlHZWKtb43d is offline... vtt.bundle.9f1415d38b44eef4b71c.js:52075 Firebase Online vtt.bundle.9f1415d38b44eef4b71c.js:38594 ➡️ Roll20 Beacon v1.7.13 (SDK: v0.0.37) ➡️ vtt.bundle.9f1415d38b44eef4b71c.js:50 Scheduled automatic refresh of OAuth token sheet.js:807 ⬅️ Roll20 Beacon SDK v0.0.37 ⬅️ vtt.bundle.9f1415d38b44eef4b71c.js:7184 Settings relay initialized vtt.bundle.9f1415d38b44eef4b71c.js:38709 marked(): mangle parameter is enabled by default, but is deprecated since version 5.0.0, and will be removed in the future. To clear this warning, install <a href="https://www.npmjs.com/package/marked-mangle" rel="nofollow">https://www.npmjs.com/package/marked-mangle</a> , or disable by setting `{mangle: false}`. oe @ vtt.bundle.9f1415d38b44eef4b71c.js:38709 vtt.bundle.9f1415d38b44eef4b71c.js:38709 marked(): headerIds and headerPrefix parameters enabled by default, but are deprecated since version 5.0.0, and will be removed in the future. To clear this warning, install <a href="https://www.npmjs.com/package/marked-gfm-heading-id" rel="nofollow">https://www.npmjs.com/package/marked-gfm-heading-id</a> , or disable by setting `{headerIds: false}`. oe @ vtt.bundle.9f1415d38b44eef4b71c.js:38709 vtt.bundle.9f1415d38b44eef4b71c.js:34953 Download the Apollo DevTools for a better development experience: <a href="https://chrome.google.com/webstore/detail/apollo-client-developer-t/jdkknkkbebbapilgoeccciglkfbmbnfm" rel="nofollow">https://chrome.google.com/webstore/detail/apollo-client-developer-t/jdkknkkbebbapilgoeccciglkfbmbnfm</a> SpeedTest Results: Internet speed test 0 1 5 10 20 50 100+ 124 .5 Megabits per second Testing upload... 117.2 Mbps download 126.1 Mbps upload Latency: 12 ms Server: Portland Your Internet connection is very fast. Your Internet connection should be able to handle multiple devices streaming HD videos, video conferencing, and gaming at the same time.
