Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present

2026-08-03 22:27:16 +00:00 · 2026-07-24 13:40:37 -04:00
parent dd358da65d
commit af51c4316f
80 changed files with 519 additions and 517 deletions
--- a/admin/post/ai_model.php
+++ b/admin/post/ai_model.php
@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['add_ai_model'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $provider_id = intval($_POST['provider']);
    $model = escapeSql($_POST['model']);
@@ -29,7 +29,7 @@ if (isset($_POST['add_ai_model'])) {

 if (isset($_POST['edit_ai_model'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $model_id = intval($_POST['model_id']);
    $model = escapeSql($_POST['model']);
@@ -48,7 +48,7 @@ if (isset($_POST['edit_ai_model'])) {

 if (isset($_GET['delete_ai_model'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $model_id = intval($_GET['delete_ai_model']);

--- a/admin/post/ai_provider.php
+++ b/admin/post/ai_provider.php
@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['add_ai_provider'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $provider = escapeSql($_POST['provider']);
    $url = escapeSql($_POST['url']);
@@ -29,7 +29,7 @@ if (isset($_POST['add_ai_provider'])) {

 if (isset($_POST['edit_ai_provider'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $provider_id = intval($_POST['provider_id']);
    $provider = escapeSql($_POST['provider']);
@@ -48,7 +48,7 @@ if (isset($_POST['edit_ai_provider'])) {

 if (isset($_GET['delete_ai_provider'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();
    
    $provider_id = intval($_GET['delete_ai_provider']);

--- a/admin/post/api_keys.php
+++ b/admin/post/api_keys.php
@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['add_api_key'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $name = escapeSql($_POST['name']);
    $expire = escapeSql($_POST['expire']);
@@ -33,7 +33,7 @@ if (isset($_POST['add_api_key'])) {

 if (isset($_GET['revoke_api_key'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $api_key_id = intval($_GET['revoke_api_key']);

@@ -54,7 +54,7 @@ if (isset($_GET['revoke_api_key'])) {

 if (isset($_GET['delete_api_key'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $api_key_id = intval($_GET['delete_api_key']);

@@ -75,7 +75,7 @@ if (isset($_GET['delete_api_key'])) {

 if (isset($_POST['bulk_delete_api_keys'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    if (isset($_POST['api_key_ids'])) {

--- a/admin/post/backup.php
+++ b/admin/post/backup.php
@@ -206,7 +206,7 @@ function zipFolderStrict(string $folderPath, string $zipFilePath): void {

 if (isset($_GET['download_backup'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $timestamp   = date('YmdHis');
    $baseName    = "itflow_{$timestamp}";
@@ -302,7 +302,7 @@ if (isset($_GET['download_backup'])) {

 if (isset($_POST['backup_master_key'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $password = $_POST['password'];

--- a/admin/post/category.php
+++ b/admin/post/category.php
@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['add_category'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    require_once 'category_model.php';

@@ -26,7 +26,7 @@ if (isset($_POST['add_category'])) {

 if (isset($_POST['edit_category'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    require_once 'category_model.php';

@@ -44,7 +44,7 @@ if (isset($_POST['edit_category'])) {

 if (isset($_GET['archive_category'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $category_id = intval($_GET['archive_category']);

@@ -66,7 +66,7 @@ if (isset($_GET['archive_category'])) {

 if (isset($_GET['restore_category'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $category_id = intval($_GET['restore_category']);

@@ -88,7 +88,7 @@ if (isset($_GET['restore_category'])) {

 if (isset($_GET['delete_category'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $category_id = intval($_GET['delete_category']);

--- a/admin/post/contract_template.php
+++ b/admin/post/contract_template.php
@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['add_contract_template'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    // Sanitize text inputs
    $name = escapeSql($_POST['name']);
@@ -63,7 +63,7 @@ if (isset($_POST['add_contract_template'])) {

 if (isset($_POST['edit_contract_template'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $contract_template_id = intval($_POST['contract_template_id']);
    $name            = escapeSql($_POST['name']);
@@ -112,7 +112,7 @@ if (isset($_POST['edit_contract_template'])) {

 if (isset($_GET['archive_contract_template'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $contract_template_id = intval($_GET['archive_contract_template']);

@@ -131,7 +131,7 @@ if (isset($_GET['archive_contract_template'])) {

 if (isset($_GET['restore_contract_template'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $contract_template_id = intval($_GET['restore_contract_template']);

@@ -150,7 +150,7 @@ if (isset($_GET['restore_contract_template'])) {

 if (isset($_GET['delete_contract_template'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();
    
    $contract_template_id = intval($_GET['delete_contract_template']);

--- a/admin/post/custom_field.php
+++ b/admin/post/custom_field.php
@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if(isset($_POST['create_custom_field'])){

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    require_once 'custom_field_model.php';

@@ -28,7 +28,7 @@ if(isset($_POST['create_custom_field'])){

 if(isset($_POST['edit_custom_field'])){

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    require_once 'custom_field_model.php';

@@ -46,7 +46,7 @@ if(isset($_POST['edit_custom_field'])){

 if(isset($_GET['delete_custom_field'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();
    
    $custom_field_id = intval($_GET['delete_custom_field']);

--- a/admin/post/custom_link.php
+++ b/admin/post/custom_link.php
@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['add_custom_link'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $name = escapeSql($_POST['name']);
    $uri = escapeSql($_POST['uri']);
@@ -31,7 +31,7 @@ if (isset($_POST['add_custom_link'])) {

 if (isset($_POST['edit_custom_link'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $custom_link_id = intval($_POST['custom_link_id']);
    $name = escapeSql($_POST['name']);
@@ -53,7 +53,7 @@ if (isset($_POST['edit_custom_link'])) {

 if (isset($_GET['delete_custom_link'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $custom_link_id = intval($_GET['delete_custom_link']);

--- a/admin/post/document_template.php
+++ b/admin/post/document_template.php
@@ -6,7 +6,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['add_document_template'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $name = escapeSql($_POST['name']);
    $description = escapeSql($_POST['description']);
@@ -38,7 +38,7 @@ if (isset($_POST['add_document_template'])) {

 if (isset($_POST['edit_document_template'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $document_template_id = intval($_POST['document_template_id']);
    $name = escapeSql($_POST['name']);
@@ -73,7 +73,7 @@ if (isset($_POST['edit_document_template'])) {

 if (isset($_GET['delete_document_template'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $document_template_id = intval($_GET['delete_document_template']);

--- a/admin/post/identity_provider.php
+++ b/admin/post/identity_provider.php
@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['edit_identity_provider'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $azure_client_id = escapeSql($_POST['azure_client_id']);
    $azure_client_secret = escapeSql($_POST['azure_client_secret']);
--- a/admin/post/mail_queue.php
+++ b/admin/post/mail_queue.php
@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_GET['send_failed_mail'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $email_id = intval($_GET['send_failed_mail']);

@@ -20,7 +20,7 @@ if (isset($_GET['send_failed_mail'])) {

 if (isset($_GET['cancel_mail'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $email_id = intval($_GET['cancel_mail']);

@@ -36,7 +36,7 @@ if (isset($_GET['cancel_mail'])) {

 if (isset($_POST['bulk_cancel_emails'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    if (isset($_POST['email_ids'])) {

@@ -64,7 +64,7 @@ if (isset($_POST['bulk_cancel_emails'])) {

 if (isset($_POST['bulk_delete_emails'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    if (isset($_POST['email_ids'])) {

--- a/admin/post/payment_method.php
+++ b/admin/post/payment_method.php
@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['add_payment_method'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $name = cleanInput($_POST['name']);
    $description = cleanInput($_POST['description']);
@@ -32,7 +32,7 @@ if (isset($_POST['add_payment_method'])) {

 if (isset($_POST['edit_payment_method'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $payment_method_id = intval($_POST['payment_method_id']);
    $name = cleanInput($_POST['name']);
@@ -59,7 +59,7 @@ if (isset($_POST['edit_payment_method'])) {

 if (isset($_GET['delete_payment_method'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $payment_method_id = intval($_GET['delete_payment_method']);

--- a/admin/post/payment_provider.php
+++ b/admin/post/payment_provider.php
@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['add_payment_provider'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $provider = escapeSql($_POST['provider']);
    $public_key = escapeSql($_POST['public_key']);
@@ -39,7 +39,7 @@ if (isset($_POST['add_payment_provider'])) {

 if (isset($_POST['edit_payment_provider'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $provider_id = intval($_POST['provider_id']);
    $description = escapeSql($_POST['description']);
@@ -62,7 +62,7 @@ if (isset($_POST['edit_payment_provider'])) {

 if (isset($_GET['delete_payment_provider'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $provider_id = intval($_GET['delete_payment_provider']);

--- a/admin/post/project_template.php
+++ b/admin/post/project_template.php
@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['add_project_template'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $name = escapeSql($_POST['name']);
    $description = escapeSql($_POST['description']);
@@ -23,7 +23,7 @@ if (isset($_POST['add_project_template'])) {

 if (isset($_POST['edit_project_template'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $project_template_id = intval($_POST['project_template_id']);
    $name = escapeSql($_POST['name']);
@@ -41,7 +41,7 @@ if (isset($_POST['edit_project_template'])) {

 if (isset($_POST['edit_ticket_template_order'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $ticket_template_id = intval($_POST['ticket_template_id']);
    $project_template_id = intval($_POST['project_template_id']);
@@ -55,7 +55,7 @@ if (isset($_POST['edit_ticket_template_order'])) {

 if (isset($_POST['add_ticket_template_to_project_template'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $project_template_id = intval($_POST['project_template_id']);
    $ticket_template_id = intval($_POST['ticket_template_id']);
@@ -73,7 +73,7 @@ if (isset($_POST['add_ticket_template_to_project_template'])) {

 if (isset($_POST['remove_ticket_template_from_project_template'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $ticket_template_id = intval($_POST['ticket_template_id']);
    $project_template_id = intval($_POST['project_template_id']);
@@ -90,7 +90,7 @@ if (isset($_POST['remove_ticket_template_from_project_template'])) {

 if (isset($_GET['delete_project_template'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $project_template_id = intval($_GET['delete_project_template']);

--- a/admin/post/roles.php
+++ b/admin/post/roles.php
@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['add_role'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $name = escapeSql($_POST['role_name']);
    $description = escapeSql($_POST['role_description']);
@@ -42,7 +42,7 @@ if (isset($_POST['add_role'])) {

 if (isset($_POST['edit_role'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $role_id = intval($_POST['role_id']);
    $name = escapeSql($_POST['role_name']);
@@ -75,7 +75,7 @@ if (isset($_POST['edit_role'])) {

 if (isset($_GET['archive_role'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $role_id = intval($_GET['archive_role']);

--- a/admin/post/saved_payment_method.php
+++ b/admin/post/saved_payment_method.php
@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_GET['delete_saved_payment'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $saved_payment_id = intval($_GET['delete_saved_payment']);

--- a/admin/post/settings_ai.php
+++ b/admin/post/settings_ai.php
@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['edit_ai_settings'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $provider = escapeSql($_POST['provider']);
    if($provider){
--- a/admin/post/settings_company.php
+++ b/admin/post/settings_company.php
@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['edit_company'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $name = escapeSql($_POST['name']);
    $address = escapeSql($_POST['address']);
@@ -54,7 +54,7 @@ if (isset($_POST['edit_company'])) {

 if (isset($_GET['remove_company_logo'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $sql = mysqli_query($mysqli,"SELECT company_logo FROM companies");
    $row = mysqli_fetch_assoc($sql);
--- a/admin/post/settings_default.php
+++ b/admin/post/settings_default.php
@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['edit_default_settings'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $start_page = escapeSql($_POST['start_page']);
    $expense_account = intval($_POST['expense_account']);
--- a/admin/post/settings_invoice.php
+++ b/admin/post/settings_invoice.php
@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['edit_invoice_settings'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $config_invoice_prefix = escapeSql($_POST['config_invoice_prefix']);
    $config_invoice_next_number = intval($_POST['config_invoice_next_number']);
--- a/admin/post/settings_localization.php
+++ b/admin/post/settings_localization.php
@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['edit_localization'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $locale = escapeSql($_POST['locale']);
    $currency_code = escapeSql($_POST['currency_code']);
--- a/admin/post/settings_mail.php
+++ b/admin/post/settings_mail.php
@@ -8,7 +8,7 @@ if (!defined('MICROSOFT_OAUTH_BASE_URL')) {

 if (isset($_POST['oauth_connect_microsoft_mail'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    // Save the OAuth credential fields from this form so the auth flow uses the latest inputs
    $config_mail_oauth_client_id     = escapeSql($_POST['config_mail_oauth_client_id'] ?? '');
@@ -75,7 +75,7 @@ if (isset($_POST['oauth_connect_microsoft_mail'])) {

 if (isset($_POST['edit_mail_smtp_settings'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $config_smtp_provider            = escapeSql($_POST['config_smtp_provider']);
    $config_smtp_host       = escapeSql($_POST['config_smtp_host'] ?? $config_smtp_host);
@@ -105,7 +105,7 @@ if (isset($_POST['edit_mail_smtp_settings'])) {

 if (isset($_POST['edit_mail_imap_settings'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $config_imap_provider            = escapeSql($_POST['config_imap_provider']);
    $config_imap_host       = escapeSql($_POST['config_imap_host'] ?? $config_imap_host);
@@ -135,7 +135,7 @@ if (isset($_POST['edit_mail_imap_settings'])) {

 if (isset($_POST['edit_mail_oauth_settings'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $config_mail_oauth_client_id     = escapeSql($_POST['config_mail_oauth_client_id'] ?? '');
    $config_mail_oauth_client_secret = escapeSql($_POST['config_mail_oauth_client_secret'] ?? '');
@@ -159,7 +159,7 @@ if (isset($_POST['edit_mail_oauth_settings'])) {

 if (isset($_POST['edit_mail_from_settings'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $config_mail_from_email = escapeSql(filter_var($_POST['config_mail_from_email'], FILTER_VALIDATE_EMAIL));
    $config_mail_from_name = escapeSql(preg_replace('/[^a-zA-Z0-9\s]/', '', $_POST['config_mail_from_name']));
@@ -185,7 +185,7 @@ if (isset($_POST['edit_mail_from_settings'])) {

 if (isset($_POST['test_email_smtp'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $test_email = intval($_POST['test_email']);

@@ -232,7 +232,7 @@ if (isset($_POST['test_email_smtp'])) {

 if (isset($_POST['test_email_imap'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $provider = escapeSql($config_imap_provider ?? '');

@@ -497,7 +497,7 @@ if (isset($_POST['test_email_imap'])) {

 if (isset($_POST['test_oauth_token_refresh'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $provider = escapeSql($_POST['oauth_provider'] ?? '');

--- a/admin/post/settings_module.php
+++ b/admin/post/settings_module.php
@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['edit_module_settings'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $config_module_enable_itdoc = intval($_POST['config_module_enable_itdoc'] ?? 0);
    $config_module_enable_ticketing = intval($_POST['config_module_enable_ticketing'] ?? 0);
--- a/admin/post/settings_notification.php
+++ b/admin/post/settings_notification.php
@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['edit_notification_settings'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $config_enable_cron = intval($_POST['config_enable_cron'] ?? 0);
    $config_enable_alert_domain_expire = intval($_POST['config_enable_alert_domain_expire'] ?? 0);
--- a/admin/post/settings_online_payment.php
+++ b/admin/post/settings_online_payment.php
@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['edit_online_payment_settings'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $config_stripe_enable = intval($_POST['config_stripe_enable'] ?? 0);
    $config_stripe_publishable = escapeSql($_POST['config_stripe_publishable']);
--- a/admin/post/settings_online_payment_clients.php
+++ b/admin/post/settings_online_payment_clients.php
@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_GET['stripe_remove_pm'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    if (!$config_stripe_enable) {
        flashAlert("Stripe not enabled", 'error');
@@ -49,7 +49,7 @@ if (isset($_GET['stripe_remove_pm'])) {

 if (isset($_GET['stripe_reset_customer'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $client_id = intval($_GET['client_id']);

--- a/admin/post/settings_project.php
+++ b/admin/post/settings_project.php
@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['edit_project_settings'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $config_project_prefix = escapeSql($_POST['config_project_prefix']);
    $config_project_next_number = intval($_POST['config_project_next_number']);
--- a/admin/post/settings_quote.php
+++ b/admin/post/settings_quote.php
@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['edit_quote_settings'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $config_quote_prefix = escapeSql($_POST['config_quote_prefix']);
    $config_quote_next_number = intval($_POST['config_quote_next_number']);
--- a/admin/post/settings_security.php
+++ b/admin/post/settings_security.php
@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['edit_security_settings'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $config_login_message = escapeSql($_POST['config_login_message']);
    $config_login_key_required = intval($_POST['config_login_key_required'] ?? 0);
--- a/admin/post/settings_telemetry.php
+++ b/admin/post/settings_telemetry.php
@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['edit_telemetry_settings'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $config_telemetry = intval($_POST['config_telemetry']);

--- a/admin/post/settings_theme.php
+++ b/admin/post/settings_theme.php
@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['edit_theme_settings'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $theme = preg_replace("/[^0-9a-zA-Z-]/", "", escapeSql($_POST['edit_theme_settings']));

@@ -20,7 +20,7 @@ if (isset($_POST['edit_theme_settings'])) {

 if (isset($_POST['edit_favicon_settings'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    // Check to see if a file is attached
    if (isset($_FILES['file']['tmp_name'])) {
@@ -52,7 +52,7 @@ if (isset($_POST['edit_favicon_settings'])) {

 if (isset($_GET['reset_favicon'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    if (file_exists("../uploads/favicon.ico")) {
        unlink("../uploads/favicon.ico");
--- a/admin/post/settings_ticket.php
+++ b/admin/post/settings_ticket.php
@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['edit_ticket_settings'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $config_ticket_prefix = escapeSql($_POST['config_ticket_prefix']);
    $config_ticket_next_number = intval($_POST['config_ticket_next_number']);
--- a/admin/post/software_template.php
+++ b/admin/post/software_template.php
@@ -6,7 +6,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['add_software_template'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $name = escapeSql($_POST['name']);
    $version = escapeSql($_POST['version']);
@@ -29,7 +29,7 @@ if (isset($_POST['add_software_template'])) {

 if (isset($_POST['edit_software_template'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $software_template_id = intval($_POST['software_template_id']);
    $name = escapeSql($_POST['name']);
@@ -51,7 +51,7 @@ if (isset($_POST['edit_software_template'])) {

 if (isset($_GET['delete_software_template'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $software_template_id = intval($_GET['delete_software_template']);

--- a/admin/post/tag.php
+++ b/admin/post/tag.php
@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['add_tag'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    require_once 'tag_model.php';

@@ -26,7 +26,7 @@ if (isset($_POST['add_tag'])) {

 if (isset($_POST['edit_tag'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    require_once 'post/tag_model.php';

@@ -44,7 +44,7 @@ if (isset($_POST['edit_tag'])) {

 if (isset($_GET['delete_tag'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $tag_id = intval($_GET['delete_tag']);

--- a/admin/post/tax.php
+++ b/admin/post/tax.php
@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['add_tax'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $name = escapeSql($_POST['name']);
    $percent = floatval($_POST['percent']);
@@ -27,7 +27,7 @@ if (isset($_POST['add_tax'])) {

 if (isset($_POST['edit_tax'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $tax_id = intval($_POST['tax_id']);
    $name = escapeSql($_POST['name']);
@@ -45,7 +45,7 @@ if (isset($_POST['edit_tax'])) {

 if (isset($_GET['archive_tax'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $tax_id = intval($_GET['archive_tax']);

@@ -63,7 +63,7 @@ if (isset($_GET['archive_tax'])) {

 if (isset($_GET['delete_tax'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $tax_id = intval($_GET['delete_tax']);

--- a/admin/post/ticket_status.php
+++ b/admin/post/ticket_status.php
@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['add_ticket_status'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $name = escapeSql($_POST['name']);
    $color = escapeSql($_POST['color']);
@@ -23,7 +23,7 @@ if (isset($_POST['add_ticket_status'])) {

 if (isset($_POST['edit_ticket_status'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $ticket_status_id = intval($_POST['ticket_status_id']);
    $name = escapeSql($_POST['name']);
@@ -43,7 +43,7 @@ if (isset($_POST['edit_ticket_status'])) {

 if (isset($_GET['delete_ticket_status'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $ticket_status_id = intval($_GET['delete_ticket_status']);

--- a/admin/post/ticket_template.php
+++ b/admin/post/ticket_template.php
@@ -10,7 +10,7 @@ require_once '../agent/post/task.php';

 if (isset($_POST['add_ticket_template'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $name = escapeSql($_POST['name']);
    $description = escapeSql($_POST['description']);
@@ -36,7 +36,7 @@ if (isset($_POST['add_ticket_template'])) {

 if (isset($_POST['edit_ticket_template'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $ticket_template_id = intval($_POST['ticket_template_id']);
    $name = escapeSql($_POST['name']);
@@ -56,7 +56,7 @@ if (isset($_POST['edit_ticket_template'])) {

 if (isset($_GET['delete_ticket_template'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $ticket_template_id = intval($_GET['delete_ticket_template']);

@@ -78,7 +78,7 @@ if (isset($_GET['delete_ticket_template'])) {

 if (isset($_POST['add_ticket_template_task'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $ticket_template_id = intval($_POST['ticket_template_id']);
    $task_name = escapeSql($_POST['task_name']);
@@ -97,7 +97,7 @@ if (isset($_POST['add_ticket_template_task'])) {

 if (isset($_GET['delete_task_template'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $task_template_id = intval($_GET['delete_task_template']);

--- a/admin/post/update.php
+++ b/admin/post/update.php
@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_GET['update'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    enforceAdminPermission();

@@ -286,7 +286,7 @@ if (isset($_GET['update'])) {

 if (isset($_GET['update_db'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    // Get the current version
    require_once ('../includes/database_version.php');
--- a/admin/post/users.php
+++ b/admin/post/users.php
@@ -8,7 +8,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

 if (isset($_POST['add_user'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    require_once 'user_model.php';

@@ -100,7 +100,7 @@ if (isset($_POST['add_user'])) {

 if (isset($_POST['edit_user'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    require_once 'user_model.php';

@@ -180,7 +180,7 @@ if (isset($_POST['edit_user'])) {

 if (isset($_GET['activate_user'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $user_id = intval($_GET['activate_user']);

@@ -198,7 +198,7 @@ if (isset($_GET['activate_user'])) {

 if (isset($_GET['disable_user'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $user_id = intval($_GET['disable_user']);

@@ -220,7 +220,7 @@ if (isset($_GET['disable_user'])) {

 if (isset($_GET['revoke_remember_me'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $user_id = intval($_GET['revoke_remember_me']);

@@ -238,7 +238,7 @@ if (isset($_GET['revoke_remember_me'])) {

 if (isset($_POST['archive_user'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $user_id = intval($_POST['user_id']);
    $ticket_assign = intval($_POST['ticket_assign']);
@@ -263,7 +263,7 @@ if (isset($_POST['archive_user'])) {

 if (isset($_POST['restore_user'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $user_id = intval($_POST['user_id']);
    $new_password = trim($_POST['new_password']);
@@ -293,7 +293,7 @@ if (isset($_POST['restore_user'])) {

 if (isset($_POST['export_users_csv'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    //get records from database
    $sql = mysqli_query($mysqli, "SELECT * FROM users LEFT JOIN user_roles ON user_role_id = role_id ORDER BY user_name ASC");
@@ -350,7 +350,7 @@ if (isset($_POST['ir_reset_user_password'])) {

    // Incident response: allow mass reset of agent passwords

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    // Confirm logged-in user password, for security
    $admin_password = $_POST['admin_password'];
--- a/admin/post/vendor_template.php
+++ b/admin/post/vendor_template.php
@@ -9,7 +9,7 @@ require_once '../agent/post/vendor.php';

 if (isset($_POST['add_vendor_template'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $name = escapeSql($_POST['name']);
    $description = escapeSql($_POST['description']);
@@ -39,7 +39,7 @@ if (isset($_POST['add_vendor_template'])) {

 if (isset($_POST['edit_vendor_template'])) {

-    validateCSRFToken($_POST['csrf_token']);
+    validateCSRFToken();

    $vendor_template_id = intval($_POST['vendor_template_id']);
    $name = escapeSql($_POST['name']);
@@ -145,7 +145,7 @@ if (isset($_POST['edit_vendor_template'])) {

 if (isset($_GET['delete_vendor_template'])) {

-    validateCSRFToken($_GET['csrf_token']);
+    validateCSRFToken();

    $vendor_template_id = intval($_GET['delete_vendor_template']);