Security
Authenticated forms carry the CSRF token when saving
Saves that were refused for lack of the protection token now work across every submission path.
The server requires a protection token on every authenticated form, to make sure the submission came from the system's own screen. Some submission paths did not attach that token, and the save was refused with no clear explanation.
The fix covers the regular form submission, the submission triggered by script and the save made from the editor preview, which inherits the token from the page that opened it.
When the protection refuses a navigation, the user sees the expired-session screen instead of a generic error. Background calls still receive the answer in JSON, for the screen to handle.
In short
- Regular, scripted and editor submissions covered
- An expired session gets its own screen
- Background calls still receive JSON
Source: Core · req-109 · BATCH-109