История коммитов

CsrfMiddleware runs after TrimStringsMiddleware and before the middlewares of the route, so a forged request never reaches the logic of a module. The token is read from the csrf_token field or the X-CSRF-Token header; a failure is answered 403, negotiated as JSON for XHR because the Vue components read response.data.message.

Ships with enforce = false in config/csrf.php: a failure is only logged and the request is served, so a form that still misses the token surfaces in the log instead of in support. The flag goes away when the check is turned on.

Route::withoutCsrf() and RouteCollection::withoutCsrf() mark a route, a collection or a group as exempt; the flag travels as a route default and reaches the kernel as RouteMatchResult::$csrfExempt. config/csrf.php holds path patterns for the entry points whose routes are not ours to edit. Nothing reads the flag yet — the middleware follows.

60 POST forms in 58 templates had no csrf_token field, among them login, registration, password restore and the whole downloads, library, mail and album modules. Adds the hidden field to every one of them, a csrf-token meta tag to both layouts and an X-CSRF-Token axios default in both globals.js so JSON requests can carry the token too. Behaviour is unchanged until the CSRF middleware is enabled.

laminas-servicemanager and laminas-uri were required directly but never used in code; laminas-escaper leaves as a transitive dependency of laminas-uri.

The admin, album, collections, profile and pagination migrations are done, and the
guestbook analysis records its own completion. Nothing in these documents is still
open, so they have nothing left to track.

Broken code samples in the configuration article, and the test.php recipe now points
at the public directory.

The raw tags around the Twig examples were printed on the pages instead of being
honoured, so they are gone.

Two pages of the guide: the module creation walkthrough no longer wires the
translation domain from a controller constructor, and the theme build entries are
declared in the theme manifest rather than in vite.config.js.

Attachments of guestbook posts are runtime data, like the uploads of the other
modules already listed here.

The migration is finished, so the working document has nothing left to track.