3 Commits

Include renames

Author	SHA1	Message	Date
Gmer4Lfe	c34224effa	Carry the CSRF token on fetch requests and put mutations behind POST ... Unraid already enforces CSRF on every POST via auto_prepend, but its injector is jQuery-only — the plugin's native fetch() calls carried no token and were being terminated before the endpoint ran, silently, because csrf_terminate exits with an empty body that r.json() swallows.	2026-08-02 10:28:53 -04:00
Gmer4Lfe	987313e7dc	Document the PHP api layer and fix what documenting it exposed ... Writing down what each endpoint actually guarantees made the places it didn't obvious — shell arguments reaching a crontab or a bash -c unescaped, master.conf written without tmp+rename, and conf edits that could be saved without ever being parsed.	2026-08-02 10:11:39 -04:00
Gmer4Lfe	a5936331c9	auth stack page, monitor cache fix, symlink install	2026-06-05 19:20:28 -04:00