#367 fixed a csrf bug since 2014

src/psm/Module/Server/Controller/StatusController.php

@@ -37,6 +37,7 @@ class StatusController extends AbstractServerController {
 	function __construct(Database $db, \Twig_Environment $twig) {
 		parent::__construct($db, $twig);
 
+		$this->setCSRFKey('status');
 		$this->setActions(array('index', 'saveLayout'), 'index');
 	}
 

src/templates/default/module/server/status/index.tpl.html

@@ -1,4 +1,5 @@
 <div class="tab-content">
+	<input type="hidden" name="saveLayout_csrf" value="{{ csrf_token(csrf_key|default('')) }}" />
 	<div id="flow-layout" class="tab-pane {{ block_layout_active }}">
 		<div class="entity-container">
 			{% for server in servers_offline %}

static/js/scripts.js

@@ -135,6 +135,7 @@ function psm_xhr(mod, params, method, on_complete, options) {
 function psm_saveLayout(layout) {
 	var params = {
 		action: 'saveLayout',
+		csrf: $("input[name=saveLayout_csrf]").val(),
 		layout: layout
 	};
 	psm_xhr('server_status', params, 'POST');