04/28 Fixed some security issues

templates/time_attendance_import.html

@@ -343,6 +343,7 @@
     </div>
     <div class="import-body">
       <form id="importForm" method="POST" enctype="multipart/form-data" action="{{ url_for('time_attendance.import_time_attendance') }}">
+      <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
 
         <!-- Project Selection - REQUIRED (moved to top) -->
         <div class="form-group" style="margin-bottom: 1.5rem;">
@@ -885,6 +886,7 @@ importForm.addEventListener('submit', async (e) => {
   try {
     const resp = await fetch('{{ url_for("time_attendance.start_import_job") }}', {
       method: 'POST',
+      headers: { 'X-CSRF-Token': (window.qrConfig && window.qrConfig.csrfToken) || '' },
       body: formData
     });
     const data = await resp.json();