fix csrf on core plugins ajax

src/common/core/antibot/ui/template.html

@@ -1,4 +1,12 @@
 {% extends "base.html" %} {% block content %}
+<input
+  type="csrf_token"
+  name="csrf_token"
+  value="{{ csrf_token }}"
+  class="hidden"
+  hidden
+/>
+
 <div class="col-span-12 grid grid-cols-12 gap-4">
   <!-- info-->
   <div

src/common/core/authbasic/ui/template.html

@@ -1,4 +1,11 @@
 {% extends "base.html" %} {% block content %}
+<input
+  type="csrf_token"
+  name="csrf_token"
+  value="{{ csrf_token }}"
+  class="hidden"
+  hidden
+/>
 
 <div class="col-span-12 grid grid-cols-12 gap-4">
   <!-- info-->

src/common/core/badbehavior/ui/template.html

@@ -1,4 +1,12 @@
 {% extends "base.html" %} {% block content %}
+<input
+  type="csrf_token"
+  name="csrf_token"
+  value="{{ csrf_token }}"
+  class="hidden"
+  hidden
+/>
+
 <div class="col-span-12 grid grid-cols-12 gap-4">
   <!-- info-->
   <div class="col-span-12 grid grid-cols-12 gap-4">

src/common/core/blacklist/ui/template.html

@@ -1,4 +1,11 @@
 {% extends "base.html" %} {% block content %}
+<input
+  type="csrf_token"
+  name="csrf_token"
+  value="{{ csrf_token }}"
+  class="hidden"
+  hidden
+/>
 
 <div class="col-span-12 grid grid-cols-12 gap-4">
   <div class="col-span-12 grid grid-cols-12 gap-4">

src/common/core/bunkernet/ui/template.html

@@ -1,4 +1,11 @@
 {% extends "base.html" %} {% block content %}
+<input
+  type="csrf_token"
+  name="csrf_token"
+  value="{{ csrf_token }}"
+  class="hidden"
+  hidden
+/>
 
 <div class="col-span-12 grid grid-cols-12 gap-4">
   <!-- status -->

src/common/core/cors/ui/template.html

@@ -1,5 +1,13 @@
 {% extends "base.html" %} {% block content %}
 
+<input
+  type="csrf_token"
+  name="csrf_token"
+  value="{{ csrf_token }}"
+  class="hidden"
+  hidden
+/>
+
 <div class="col-span-12 grid grid-cols-12 gap-4">
   <!-- info-->
   <div

src/common/core/country/ui/template.html

@@ -1,4 +1,11 @@
 {% extends "base.html" %} {% block content %}
+<input
+  type="csrf_token"
+  name="csrf_token"
+  value="{{ csrf_token }}"
+  class="hidden"
+  hidden
+/>
 
 <div class="col-span-12 grid grid-cols-12 gap-4">
   <!-- info-->

src/common/core/customcert/ui/template.html

@@ -1,4 +1,12 @@
 {% extends "base.html" %} {% block content %}
+<input
+  type="csrf_token"
+  name="csrf_token"
+  value="{{ csrf_token }}"
+  class="hidden"
+  hidden
+/>
+
 <div class="col-span-12 grid grid-cols-12 gap-4">
   <!-- info-->
   <div

src/common/core/db/ui/template.html

@@ -1,4 +1,11 @@
 {% extends "base.html" %} {% block content %}
+<input
+  type="csrf_token"
+  name="csrf_token"
+  value="{{ csrf_token }}"
+  class="hidden"
+  hidden
+/>
 
 <div class="col-span-12 grid grid-cols-12 gap-4">
   <!-- info-->

src/common/core/dnsbl/ui/template.html

@@ -1,4 +1,11 @@
 {% extends "base.html" %} {% block content %}
+<input
+  type="csrf_token"
+  name="csrf_token"
+  value="{{ csrf_token }}"
+  class="hidden"
+  hidden
+/>
 
 <div class="col-span-12 grid grid-cols-12 gap-4">
   <!-- info-->

src/common/core/errors/ui/template.html

@@ -1,4 +1,11 @@
 {% extends "base.html" %} {% block content %}
+<input
+  type="csrf_token"
+  name="csrf_token"
+  value="{{ csrf_token }}"
+  class="hidden"
+  hidden
+/>
 
 <div class="col-span-12 grid grid-cols-12 gap-4">
   <!-- info-->

src/common/core/greylist/ui/template.html

@@ -1,4 +1,11 @@
 {% extends "base.html" %} {% block content %}
+<input
+  type="csrf_token"
+  name="csrf_token"
+  value="{{ csrf_token }}"
+  class="hidden"
+  hidden
+/>
 
 <div class="col-span-12 grid grid-cols-12 gap-4">
   <div class="col-span-12 grid grid-cols-12 gap-4">

src/common/core/letsencrypt/ui/template.html

@@ -1,4 +1,12 @@
 {% extends "base.html" %} {% block content %}
+<input
+  type="csrf_token"
+  name="csrf_token"
+  value="{{ csrf_token }}"
+  class="hidden"
+  hidden
+/>
+
 <div class="col-span-12 grid grid-cols-12 gap-4">
   <!-- info-->
   <div

src/common/core/limit/ui/template.html

@@ -1,4 +1,12 @@
 {% extends "base.html" %} {% block content %}
+<input
+  type="csrf_token"
+  name="csrf_token"
+  value="{{ csrf_token }}"
+  class="hidden"
+  hidden
+/>
+
 <div class="col-span-12 grid grid-cols-12 gap-4">
   <!-- info-->
   <div

src/common/core/misc/ui/template.html

@@ -1,4 +1,11 @@
 {% extends "base.html" %} {% block content %}
+<input
+  type="csrf_token"
+  name="csrf_token"
+  value="{{ csrf_token }}"
+  class="hidden"
+  hidden
+/>
 
 <div class="col-span-12 grid grid-cols-12 gap-4">
   <div class="col-span-12 grid grid-cols-12 gap-4">

src/common/core/modsecurity/ui/template.html

@@ -1,4 +1,11 @@
 {% extends "base.html" %} {% block content %}
+<input
+  type="csrf_token"
+  name="csrf_token"
+  value="{{ csrf_token }}"
+  class="hidden"
+  hidden
+/>
 
 <div class="col-span-12 grid grid-cols-12 gap-4">
   <!-- info-->

src/common/core/redis/ui/template.html

@@ -1,4 +1,11 @@
 {% extends "base.html" %} {% block content %}
+<input
+  type="csrf_token"
+  name="csrf_token"
+  value="{{ csrf_token }}"
+  class="hidden"
+  hidden
+/>
 
 <div class="col-span-12 grid grid-cols-12 gap-4">
   <!-- status -->

src/common/core/reversescan/ui/template.html

@@ -1,4 +1,12 @@
 {% extends "base.html" %} {% block content %}
+<input
+  type="csrf_token"
+  name="csrf_token"
+  value="{{ csrf_token }}"
+  class="hidden"
+  hidden
+/>
+
 <div class="col-span-12 grid grid-cols-12 gap-4">
   <!-- info-->
   <div

src/common/core/selfsigned/ui/template.html

@@ -1,4 +1,12 @@
 {% extends "base.html" %} {% block content %}
+<input
+  type="csrf_token"
+  name="csrf_token"
+  value="{{ csrf_token }}"
+  class="hidden"
+  hidden
+/>
+
 <div class="col-span-12 grid grid-cols-12 gap-4">
   <!-- info-->
   <div

src/common/core/whitelist/ui/template.html

@@ -1,4 +1,11 @@
 {% extends "base.html" %} {% block content %}
+<input
+  type="csrf_token"
+  name="csrf_token"
+  value="{{ csrf_token }}"
+  class="hidden"
+  hidden
+/>
 
 <div class="col-span-12 grid grid-cols-12 gap-4">
   <div class="col-span-12 grid grid-cols-12 gap-4">

src/ui/static/js/plugins/setup.js

@@ -47,7 +47,8 @@ class SetupPlugin {
       fetch(location.href, {
         method: "POST",
         headers: {
-          "X-CSRFToken": "{{ csrf_token() }}",
+          "X-CSRFToken": document.querySelector('input[name="csrf_token"]')
+            .value,
         },
       })
         .then((res) => res.json())