Enhance CSRF protection in upload endpoints

Author: KrzysztofPajak

src/Web/Grand.SharedUIResources/Views/Shared/EditorTemplates/MultiPicture.cshtml

@@ -32,7 +32,10 @@
                     Reference: '@reference',
                     ObjectId: '@objectId'
                 },
-                inputName: "files"
+                inputName: "files",
+                customHeaders: {
+                    'X-CSRF-TOKEN': $('input[name="__RequestVerificationToken"]').val()
+                }
             },
             template: "@(clientId)-qq-template",
             multiple: true,

src/Web/Grand.SharedUIResources/Views/Shared/EditorTemplates/Picture.cshtml

@@ -44,7 +44,10 @@ else
                     Reference: '@ViewData["Reference"]',
                     ObjectId: '@ViewData["ObjectId"]'
                 },
-                inputName: "file"
+                inputName: "file",
+                customHeaders: {
+                    'X-CSRF-TOKEN': $('input[name="__RequestVerificationToken"]').val()
+                }
             },            
             template: "@(clientId)-qq-template",
             multiple: false,

src/Web/Grand.Web.Admin/Controllers/PictureController.cs

@@ -32,8 +32,7 @@ public PictureController(
         _mediaSettings = mediaSettings;
     }
 
-    [HttpPost]
-    [IgnoreAntiforgeryToken]
+    [HttpPost]   
     public virtual async Task<IActionResult> AsyncUpload(IFormFile file, Reference reference = Reference.None, string objectId = "")
     {
         if (file == null)
@@ -73,8 +72,7 @@ await _pictureService.InsertPicture(fileBinary, contentType, null, reference: re
         });
     }
 
-    [HttpPost]
-    [IgnoreAntiforgeryToken]
+    [HttpPost]   
     public virtual async Task<IActionResult> AsyncLogoUpload(IFormFile file)
     {
         if (!await _permissionService.Authorize(StandardPermission.ManageSettings))

src/Web/Grand.Web.Admin/Controllers/ProductController.cs

@@ -1028,8 +1028,7 @@ public async Task<IActionResult> AssociatedProductAddPopup(ProductModel.AddAssoc
 
     #region Product pictures
 
-    [HttpPost]
-    [IgnoreAntiforgeryToken]
+    [HttpPost]    
     public async Task<IActionResult> ProductPictureAdd(
         IFormFileCollection files,
         Reference reference, string objectId,

src/Web/Grand.Web.Store/Controllers/PictureController.cs

@@ -33,7 +33,6 @@ public PictureController(
     }
 
     [HttpPost]
-    [IgnoreAntiforgeryToken]
     public virtual async Task<IActionResult> AsyncUpload(IFormFile file, Reference reference = Reference.None, string objectId = "")
     {
         if (file == null)
@@ -74,7 +73,6 @@ await _pictureService.InsertPicture(fileBinary, contentType, null, reference: re
     }
 
     [HttpPost]
-    [IgnoreAntiforgeryToken]
     public virtual async Task<IActionResult> AsyncLogoUpload(IFormFile file)
     {
         if (!await _permissionService.Authorize(StandardPermission.ManageSettings))

src/Web/Grand.Web.Store/Controllers/ProductController.cs

@@ -1087,7 +1087,6 @@ public async Task<IActionResult> AssociatedProductAddPopup(ProductModel.AddAssoc
     #region Product pictures
 
     [HttpPost]
-    [IgnoreAntiforgeryToken]
     public async Task<IActionResult> ProductPictureAdd(
         IFormFileCollection files,
         Reference reference, string objectId,

src/Web/Grand.Web.Vendor/Controllers/ProductController.cs

@@ -1074,8 +1074,7 @@ public async Task<IActionResult> AssociatedProductAddPopup(ProductModel.AddAssoc
 
     #region Product pictures
 
-    [HttpPost]
-    [IgnoreAntiforgeryToken]
+    [HttpPost]    
     public async Task<IActionResult> ProductPictureAdd(
         IFormFileCollection files,
         Reference reference, string objectId,