document and files and folders: Add missing CSRF checks, add missing permission checks

agent/modals/document/document_add.php

@@ -17,6 +17,7 @@ ob_start();
     </button>
 </div>
 <form action="post.php" method="post" autocomplete="off">
+    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
     <input type="hidden" name="client_id" value="<?= $client_id ?>">
     <input type="hidden" name="contact" value="<?= $contact_id ?>">
     <input type="hidden" name="asset" value="<?= $asset_id ?>">

agent/modals/document/document_add_file_relation.php

@@ -8,6 +8,7 @@
                 </button>
             </div>
             <form action="post.php" method="post" autocomplete="off">
+                <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
                 <input type="hidden" name="client_id" value="<?php echo $client_id; ?>">
                 <input type="hidden" name="document_id" value="<?php echo $document_id; ?>">
                 <div class="modal-body">

agent/modals/document/document_add_from_template.php

@@ -18,6 +18,7 @@ ob_start();
     </button>
 </div>
 <form action="post.php" method="post" autocomplete="off">
+    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
     <input type="hidden" name="client_id" value="<?php echo $client_id; ?>">
     <div class="modal-body">
 

agent/modals/document/document_edit.php

@@ -25,6 +25,7 @@ ob_start();
     </button>
 </div>
 <form action="post.php" method="post" autocomplete="off">
+    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
     <input type="hidden" name="document_id" value="<?php echo $document_id; ?>">
     <input type="hidden" name="client_id" value="<?php echo $client_id; ?>">
     <div class="modal-body">

agent/modals/document/document_edit_visibility.php

@@ -27,6 +27,7 @@ ob_start();
     </button>
 </div>
 <form action="post.php" method="post" autocomplete="off">
+    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
     <div class="modal-body">
         <input type="hidden" name="document_id" value="<?= $document_id ?>">
         <div class="form-group">

agent/modals/document/document_link_asset.php

@@ -23,6 +23,7 @@ ob_start();
     </button>
 </div>
 <form action="post.php" method="post" autocomplete="off">
+    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
     <input type="hidden" name="document_id" value="<?= $document_id ?>">
     <div class="modal-body">
 

agent/modals/document/document_link_contact.php

@@ -24,6 +24,7 @@ ob_start();
     </button>
 </div>
 <form action="post.php" method="post" autocomplete="off">
+    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
     <input type="hidden" name="document_id" value="<?= $document_id ?>">
     <div class="modal-body">
 

agent/modals/document/document_link_file.php

@@ -24,6 +24,7 @@ ob_start();
     </button>
 </div>
 <form action="post.php" method="post" autocomplete="off">
+    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
     <input type="hidden" name="document_id" value="<?= $document_id ?>">
     <div class="modal-body">
 

agent/modals/document/document_link_software.php

@@ -24,6 +24,7 @@ ob_start();
     </button>
 </div>
 <form action="post.php" method="post" autocomplete="off">
+    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
     <input type="hidden" name="document_id" value="<?= $document_id ?>">
     <div class="modal-body">
 

agent/modals/document/document_link_vendor.php

@@ -24,6 +24,7 @@ ob_start();
     </button>
 </div>
 <form action="post.php" method="post" autocomplete="off">
+    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
     <input type="hidden" name="document_id" value="<?= $document_id ?>">
     <div class="modal-body">
 

agent/modals/document/document_move.php

@@ -22,6 +22,7 @@ ob_start();
     </button>
 </div>
 <form action="post.php" method="post" autocomplete="off">
+    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
     <input type="hidden" name="document_id" value="<?php echo $document_id; ?>">
     <div class="modal-body">
 

agent/modals/document/document_rename.php

@@ -21,6 +21,7 @@ ob_start();
     </button>
 </div>
 <form action="post.php" method="post" autocomplete="off">
+    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
     <input type="hidden" name="document_id" value="<?php echo $document_id; ?>">
     <input type="hidden" name="client_id" value="<?php echo $client_id; ?>">
     <div class="modal-body">