Merge pull request #1843 from netalertx/next_release

Next release

Author: jokob-sk

front/maintenance.php

@@ -508,7 +508,7 @@ function UploadConfig()
   appConfBase64 = btoa(appConf)
 
   // import
-  $.post('php/server/query_replace_config.php', { base64data: appConfBase64, fileName: "app.conf" }, function(msg) {
+  $.post('php/server/query_replace_config.php', { base64data: appConfBase64, fileName: "app.conf", csrf_token: <?= json_encode(getCsrfToken()) ?> }, function(msg) {
     console.log(msg);
     // showMessage(msg);
     write_notification(`[Maintenance]: ${msg}`, 'interrupt');

front/php/server/query_replace_config.php

@@ -17,6 +17,8 @@
 // Handle incoming requests
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
 
+    requireCsrfToken();
+
     $base64Data = $_POST['base64data'] ?? null;
     if (!$base64Data) {
         http_response_code(400);

front/workflowsCore.php

@@ -1231,7 +1231,7 @@ function saveWorkflows()
   appConfBase64 = btoa(JSON.stringify(getWorkflowsJson()))
 
   // import
-  $.post('php/server/query_replace_config.php', { base64data: appConfBase64, fileName: "workflows.json" })
+  $.post('php/server/query_replace_config.php', { base64data: appConfBase64, fileName: "workflows.json", csrf_token: <?= json_encode(getCsrfToken()) ?> })
     .done(function(msg) {
       console.log(msg);
       write_notification(`[WF]: ${msg}`, 'interrupt');