04/28 Fixed some security issues

templates/edit_user.html

@@ -15,6 +15,7 @@
 
     <div class="edit-user-container">
         <form id="editUserForm" method="POST" action="{{ url_for('users.edit_user', user_id=user.id) }}">
+      <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
             <!-- User Information Section -->
             <div class="form-section">
                 <h3>
@@ -470,6 +471,7 @@
                     method: 'POST',
                     headers: {
                         'Content-Type': 'application/json',
+          'X-CSRF-Token': (window.qrConfig && window.qrConfig.csrfToken) || '',
                     },
                     body: JSON.stringify({ project_ids: projectIds })
                 });