Use form posts for transfer jobs

server/public/app.js

@@ -380,6 +380,7 @@ async function handleDrop(event, win, targetPath) {
     for (const file of files) {
       form.append('files', file, file.name);
     }
+    appendCsrf(form);
     await fetchChecked(apiUrl(`upload.php?path=${encodeURIComponent(targetPath)}`), {
       method: 'POST',
       body: form
@@ -390,10 +391,14 @@ async function handleDrop(event, win, targetPath) {
 
 async function createJob(type, source, destination) {
   recordDebug('job.create.request', { type, source, destination });
+  const body = new URLSearchParams();
+  body.set('source', source);
+  body.set('destination', destination);
+  appendCsrf(body);
   const job = await api(apiUrl(`job.php?action=${encodeURIComponent(type)}`), {
     method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ source, destination })
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8' },
+    body
   });
   recordDebug('job.create.response', job);
   state.jobs.set(job.id, job);
@@ -911,6 +916,24 @@ function apiUrl(path) {
   return `${API_BASE.replace(/\/$/, '')}/${path.replace(/^\//, '')}`;
 }
 
+function appendCsrf(body) {
+  const token = getCsrfToken();
+  if (!token) {
+    recordDebug('csrf.missing', {});
+    return;
+  }
+  body.append('csrf_token', token);
+  recordDebug('csrf.attached', { length: token.length });
+}
+
+function getCsrfToken() {
+  return window.csrf_token
+    || document.querySelector('input[name="csrf_token"]')?.value
+    || document.querySelector('meta[name="csrf_token"]')?.content
+    || document.querySelector('meta[name="csrf-token"]')?.content
+    || '';
+}
+
 function recordDebug(label, data = {}) {
   const item = {
     id: state.nextDebugId++,