SA-CONTRIB-2014-061, CVE-2014-2715 - Fix

Reviewed all modules, especially page callbacks and updated security as necessary.
As modules are reviewed and updated further, latest commit contains more updates than the patch.

Here's current version of that function:

function vwrooms_filedelete($type, $nid) {
  global $user;

  //filtering the 2 parameters
  $types = array('vls', 'vconf', 'vconsult', 'v2wvc');
  if (!in_array($type, $types)) {
    return t('Invalid type!');
  }
  $nid = (int) $nid;

  //select room for deletion based on access
  if (!user_access('administer vwrooms')) {
	//allow deletion only if owned by $user
    $fr = db_query("select r.room,n.uid from {{$type}_rooms} r inner join {node} n on (n.nid=r.nid) and n.uid=$user->uid and n.nid=$nid")->fetchObject();
  }
  else {
	//user has access to delete any room
    $fr = db_query("select r.room,n.uid from {{$type}_rooms} r inner join {node} n on (n.nid=r.nid) and n.nid=$nid")->fetchObject();
  }

 if (!$fr->room)   //no room selected
  {
    return t('Invalid room or permissions!');
  }
  else
  {
    vwrooms_removeroom($fr->room, $type);
    return t('Room was deleted.');
  }

}

Please elaborate on the CSRF vulnerability you mentioned and fix you require.
An extra dialog/confirmation step so trigger by link is not possible?

Added an extra form to fix CSRF, as suggested :

 $items['vwrooms/deletefiles/%/%'] = array(
'page callback' => 'drupal_get_form',
'page arguments' => array('vwrooms_fdelete',2,3),
'access arguments' => array('access content'),
'access callback' => TRUE,
'type' => MENU_CALLBACK
);

Then used confirm_form() :

function vwrooms_fdelete($form, &$form_state, $type, $nid) {

  //filtering the 2 parameters
  $types = array('vls', 'vconf', 'vconsult', 'v2wvc');
  if (!in_array($type, $types)) {
    return t('Invalid type!');
  }
  $nid = (int) $nid;

	$form = array();

	$form['type'] = array(
		'#type' => 'value',
		'#value' => $type,
	);

	$form['nid'] = array(
		'#type' => 'value',
		'#value' => $nid,
	);

	return confirm_form(
		$form,
		t('Are you sure you want to delete room files?'),
		'node/'.$nid,
		t('This action cannot be undone.') . " ($type/$nid)",
		t('Delete Files'),
		t('Return to Room')
	);

	return $form;
}

function vwrooms_fdelete_submit($form, &$form_state)
{
	vwrooms_filedelete($form_state['values']['type'], $form_state['values']['nid'], $form_state);
}


function vwrooms_filedelete($type, $nid, &$form_state) {
  global $user;

  //filtering the 2 parameters
  $types = array('vls', 'vconf', 'vconsult', 'v2wvc');
  if (!in_array($type, $types)) {
    return t('Invalid type!');
  }
  $nid = (int) $nid;

  //select room for deletion based on access
  if (!user_access('administer vwrooms')) {
	//allow deletion only if owned by $user
    $fr = db_query("select r.room,n.uid from {{$type}_rooms} r inner join {node} n on (n.nid=r.nid) and n.uid=$user->uid and n.nid=$nid")->fetchObject();
  }
  else {
	//user has access to delete any room
    $fr = db_query("select r.room,n.uid from {{$type}_rooms} r inner join {node} n on (n.nid=r.nid) and n.nid=$nid")->fetchObject();
  }

  if (!$fr->room)   //no room selected
  {
  	drupal_set_message('Invalid room or permissions!');
  }
  else
  {
    vwrooms_removeroom($fr->room, $type);
	drupal_set_message('You confirmed file deletion for room ' .$fr->room . '.');
  }

	$form_state['redirect'] = 'node/'.$nid;

}

Update was pushed to repository so module users can secure their sites as soon as the project is restored.

That script tool and all other similar were removed and latest version tagged as 7.x-1.8.

[7.x-1.x 011fd3c] Update
4 files changed, 228 deletions(-)
delete mode 100755 v2wvc/v2wvc/delete_all_uploads.php
delete mode 100755 vconf/vconf/delete_all_uploads.php
delete mode 100755 vconsult/vconsult/delete_all_uploads.php
delete mode 100755 vls/vls/delete_all_uploads.php

The script tool above was used to clean folder "uploads" containing chat logs and was provided as sample cleanup tool with original editions.
Was not affecting other files or data, just the application logs folder, so it's not a security issue for Drupal setup or a reason to close project.

The affirmation "The code is just a bunch of security bugs. " referring to contributed modules is not accurate, at least. All bugs reported until now were fixed and these contributed integration modules provide a lot of functionality as documented on project home page http://www.videowhisper.com/?p=Drupal-Pay-Per-View-Streaming .

Developers addressed all reported security issue and more that were identified. We did not state project is perfect. If anybody finds any issue, our developers will check and try to fix as they did before.
Finding a new flaw does not mean entire project is flawed and should be closed.
With that logic any project including Drupal should be closed when a flaw is found because developers "not revisited the entire codebase to truly audit and fix it all".