added form token auth to page editing, updated API

brain/api/v1/PagesAPI.inc.php

@@ -104,7 +104,24 @@ class PagesAPI
       case "delete":
       case "create":
       case "write":
+        $body = $request->getParsedBody();
+        if (!isset($body["form_token"])) {
+          $result = [
+            "message" => "No form token. Not good, sport.",
+            "type" => "TASK_FORM_AUTH",
+          ];
+        } else {
+          if ($body["form_token"] == Session::get("form_token")) {
+            //TODO: Verify form fields
             $result = (new Book("../content/pages"))->editPage($task, $request);
+          } else {
+            $result = [
+              "message" => "Form token, auth failed. Uh oh.",
+              "type" => "TASK_FORM_AUTH",
+            ];
+          }
+        }
+
         break;
       case "add-entry-image":
         $result = ImagesAPI::uploadImage($request);

brain/views/dash/page-edit.twig

@@ -78,7 +78,7 @@
                 {% endapply %}                
                 <input id="featured-image-upload" type="file" name="featured-image-upload"/>
                 <input id="post-image-upload" type="file" name="post-image-upload"/>
-                <input name="token" type="hidden" value="{{ token }}">
+                <input id="form_token" name="token" type="hidden" value="{{ token }}">
               </div>
             </div>
           </div>

src/com/actions/PageActions.js

@@ -56,6 +56,10 @@ export default class PostActions {
         "published",
         document.getElementById("option-published").getAttribute("data-active")
       );
+      pageInfo.append(
+        "form_token",
+        document.getElementById("form_token").value
+      );
       if (image != null || image != undefined) {
         if (image.type.match("image.*")) {
           pageInfo.append("feature_image", image, image.name);

src/libraries/FipamoAdminAPI.js

@@ -217,6 +217,7 @@ class FipamoAdminAPI {
    * @param {boolean} form[].menu - property that indicates page is included in site menu
    * @param {boolean} form[].featured - property that indicates page is featured
    * @param {boolean} form[].published - property that indicates page is public
+   * @param {string} form[].form_token - hidden property to authenticate form submission
    * @param {input} form[].feature_image - main image for page
    * @example
    * api.pageActions(TASK, data).then(response=>{