Implement CSRF

src/components/admin.vue

@@ -50,7 +50,7 @@ export default {
 			}
 		},
 		createElem(sType) {
-			this.api.get('admin_create', {type: sType})
+			this.api.post('admin_create', {type: sType})
 				.then((aoNewElemTypes) => {
 					for(const [sType, aoNewElems] of Object.entries(aoNewElemTypes)) {
 						for(const [iKey, oNewElem] of Object.entries(aoNewElems)) {
@@ -68,7 +68,7 @@ export default {
 				id: oElem.id
 			};
 
-			this.api.get('admin_delete', asInputs)
+			this.api.post('admin_delete', asInputs)
 				.then((asData) => {
 					delete this.elems[asInputs.type][asInputs.id];
 					this.addFeedback('success', this.l('admin.delete_success'), asInputs);
@@ -90,7 +90,7 @@ export default {
 					value:	sNewVal
 				};
 
-				this.api.get('admin_set', asInputs)
+				this.api.post('admin_set', asInputs)
 					.then((asData) => {
 						this.elems[oElem.type][oElem.id][oEvent.target.name] = sNewVal;
 						this.addFeedback('success', this.l('admin.save_success'), asInputs);
@@ -106,7 +106,7 @@ export default {
 			this.saveTimer = setTimeout(() => {this.updateElem(oElem, oEvent);}, 2000);
 		},
 		updateProject() {
-			this.api.get('update_project')
+			this.api.post('update_project')
 				.then((asData, sMsg) => {this.addFeedback('success', sMsg, {'update':'project'});})
 				.catch((sMsg) => {this.addFeedback('error', sMsg, {'update':'project'});});
 		}

src/components/project.vue

@@ -514,8 +514,8 @@ export default {
 			return {
 				top: this.mapPadding,
 				bottom: this.mapPadding,
-				left: this.mapPadding + ((!bIsMobile && this.panels.settingsOpen && this.settings)?this.settings.getWidth():0),
-				right: this.mapPadding + ((!bIsMobile && this.panels.feedOpen && this.feed)?this.feed.getWidth():0)
+				left: this.mapPadding + ((!bIsMobile && this.panels.leftOpen && this.settings)?this.settings.getWidth():0),
+				right: this.mapPadding + ((!bIsMobile && this.panels.rightOpen && this.feed)?this.feed.getWidth():0)
 			};
 		},
 		updateMapPadding(iDuration=0) {

src/components/projectNewsletter.vue

@@ -39,7 +39,7 @@ export default {
 				const sAction = this.action;
 				this.loading = true;
 
-				this.api.request(sAction, {'email': this.user.email, 'name': this.user.name})
+				this.api.request(sAction, {'email': this.user.email, 'name': this.user.name}, 'POST')
 					.then((asResponse) => {
 						this.feedbacks.push({type: asResponse.result, msg: asResponse.desc});
 						this.user.setInfo(asResponse.data);

src/components/projectPost.vue

@@ -134,7 +134,7 @@
 			send() {
 				if(this.postMessage != '' && this.user.name != '') {
 					this.sending = true;
-					this.api.get(
+					this.api.post(
 							'add_post',
 							{
 								id_project: this.project.project.id,

src/components/upload.vue

@@ -51,6 +51,7 @@ export default {
 				endpoint,
 				fieldName: 'files[]',
 				formData: true,
+				headers: {'X-CSRF-Token': this.consts.csrf_token},
 				allowedMetaFields: ['t', 'name', 'type'],
 				getResponseData(xhr) {
 					return JSON.parse(xhr.responseText || '{}');
@@ -65,7 +66,7 @@ export default {
 				const uploadedFiles = response?.body?.files || [];
 				uploadedFiles.forEach((uploadedFile) => {
 					const hasError = Object.prototype.hasOwnProperty.call(uploadedFile, 'error');
-					this.logs.push(hasError ? uploadedFile.error : this.lang.get('upload.success', [uploadedFile.name]));
+					this.logs.push(hasError ? uploadedFile.error : this.lang.get('upload.success', [uploadedFile.original_name || uploadedFile.name]));
 					if(!hasError) this.files.push({...uploadedFile, content: ''});
 				});
 			});
@@ -85,7 +86,7 @@ export default {
 			event.target.value = '';
 		},
 		addComment(oFile) {
-			this.api.get('add_comment', {
+			this.api.post('add_comment', {
 					id: oFile.id,
 					content: oFile.content
 				})
@@ -98,7 +99,7 @@ export default {
 				navigator.geolocation.getCurrentPosition(
 					(position) => {
 						this.logs.push('Sending position...');
-						this.api.get('add_position', {
+						this.api.post('add_position', {
 								'latitude': position.coords.latitude,
 								'longitude': position.coords.longitude,
 								'timestamp': Math.round(position.timestamp / 1000)