diff --git a/Admin/Routes/Web/Api.php b/Admin/Routes/Web/Api.php index cf782e0..d0a0dea 100755 --- a/Admin/Routes/Web/Api.php +++ b/Admin/Routes/Web/Api.php @@ -22,6 +22,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiDataChange', 'verb' => RouteVerb::ANY, + 'csrf' => true, 'permission' => [ ], ], @@ -48,6 +49,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiLogout', 'verb' => RouteVerb::SET, + 'csrf' => true, 'permission' => [ ], ], @@ -74,6 +76,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiSettingsSet', 'verb' => RouteVerb::SET, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::MODIFY, @@ -83,6 +86,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiSettingsGet', 'verb' => RouteVerb::GET, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::READ, @@ -95,6 +99,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiSettingsDesignSet', 'verb' => RouteVerb::SET, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::MODIFY, @@ -107,6 +112,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiGroupCreate', 'verb' => RouteVerb::PUT, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::CREATE, @@ -116,6 +122,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiGroupUpdate', 'verb' => RouteVerb::SET, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::MODIFY, @@ -125,6 +132,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiGroupDelete', 'verb' => RouteVerb::DELETE, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::DELETE, @@ -134,6 +142,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiGroupGet', 'verb' => RouteVerb::GET, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::READ, @@ -146,6 +155,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiAccountFind', 'verb' => RouteVerb::GET, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::READ, @@ -157,6 +167,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiGroupFind', 'verb' => RouteVerb::GET, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::READ, @@ -168,6 +179,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiAccountGroupFind', 'verb' => RouteVerb::GET, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::READ, @@ -180,6 +192,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiAccountCreate', 'verb' => RouteVerb::PUT, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::CREATE, @@ -189,6 +202,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiAccountUpdate', 'verb' => RouteVerb::SET, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::MODIFY, @@ -198,6 +212,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiAccountDelete', 'verb' => RouteVerb::DELETE, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::DELETE, @@ -207,6 +222,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiAccountGet', 'verb' => RouteVerb::GET, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::READ, @@ -218,6 +234,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiSettingsAccountLocalizationSet', 'verb' => RouteVerb::SET, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::MODIFY, @@ -230,6 +247,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiModuleStatusUpdate', 'verb' => RouteVerb::SET, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::MODIFY, @@ -242,6 +260,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiAddAccountToGroup', 'verb' => RouteVerb::PUT, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::MODIFY, @@ -253,6 +272,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiAddGroupToAccount', 'verb' => RouteVerb::PUT, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::MODIFY, @@ -265,6 +285,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiGroupPermissionGet', 'verb' => RouteVerb::PUT, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::PERMISSION, @@ -274,6 +295,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiAddGroupPermission', 'verb' => RouteVerb::PUT, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::PERMISSION, @@ -283,6 +305,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiGroupPermissionUpdate', 'verb' => RouteVerb::SET, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::PERMISSION, @@ -292,6 +315,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiGroupPermissionDelete', 'verb' => RouteVerb::DELETE, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::PERMISSION, @@ -303,6 +327,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiAccountPermissionGet', 'verb' => RouteVerb::GET, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::PERMISSION, @@ -312,6 +337,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiAddAccountPermission', 'verb' => RouteVerb::PUT, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::PERMISSION, @@ -321,6 +347,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiAccountPermissionUpdate', 'verb' => RouteVerb::SET, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::PERMISSION, @@ -330,6 +357,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiAccountPermissionDelete', 'verb' => RouteVerb::DELETE, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::PERMISSION, @@ -341,6 +369,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiReInit', 'verb' => RouteVerb::GET, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::CREATE, @@ -353,6 +382,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiUpdateFile', 'verb' => RouteVerb::GET, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::CREATE, @@ -364,6 +394,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiCheckForUpdates', 'verb' => RouteVerb::PUT, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::CREATE, @@ -375,6 +406,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiController:apiCheckForUpdates', 'verb' => RouteVerb::PUT, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::CREATE, @@ -386,6 +418,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiAttributeController:apiAddressCreate', 'verb' => RouteVerb::PUT, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::CREATE, @@ -395,6 +428,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiAttributeController:apiAddressUpdate', 'verb' => RouteVerb::SET, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::MODIFY, @@ -404,6 +438,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiAttributeController:apiAddressDelete', 'verb' => RouteVerb::DELETE, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::DELETE, @@ -415,6 +450,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiAttributeController:apiContactCreate', 'verb' => RouteVerb::PUT, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::CREATE, @@ -424,6 +460,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiAttributeController:apiContactUpdate', 'verb' => RouteVerb::SET, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::MODIFY, @@ -433,6 +470,7 @@ return [ [ 'dest' => '\Modules\Admin\Controller\ApiAttributeController:apiContactDelete', 'verb' => RouteVerb::DELETE, + 'csrf' => true, 'permission' => [ 'module' => ApiController::NAME, 'type' => PermissionType::DELETE, diff --git a/Admin/Settings/Theme/Backend/settings.tpl.php b/Admin/Settings/Theme/Backend/settings.tpl.php index e117c41..07ccc0b 100755 --- a/Admin/Settings/Theme/Backend/settings.tpl.php +++ b/Admin/Settings/Theme/Backend/settings.tpl.php @@ -57,7 +57,7 @@ echo $this->data['nav']->render();