elcreator · Oct 27, 2026 · Oct 27, 2026 · Oct 27, 2026 · Oct 27, 2026 · Oct 27, 2026
diff --git a/core/src/Providers/ArtisanServiceProvider.php b/core/src/Providers/ArtisanServiceProvider.php
@@ -9,6 +9,7 @@
 use Illuminate\Console\Scheduling\ScheduleFinishCommand;
 use Illuminate\Console\Scheduling\ScheduleTestCommand;
 use Illuminate\Console\Scheduling\ScheduleWorkCommand;
+use Illuminate\Console\Signals;
 use Illuminate\Events\Dispatcher;
 use Illuminate\Support\ServiceProvider;
 use Illuminate\Database\Console\Seeds\SeedCommand;
@@ -22,6 +23,7 @@
 use Illuminate\Database\Console\Migrations\RefreshCommand as MigrateRefreshCommand;
 use Illuminate\Database\Console\Migrations\RollbackCommand as MigrateRollbackCommand;
 use Illuminate\Database\Console\Migrations\MigrateMakeCommand;
+use Symfony\Component\Console\SignalRegistry\SignalRegistry;
 
 use EvolutionCMS\Console\ClearCompiledCommand;
 use EvolutionCMS\Console\VendorPublishCommand;
@@ -104,6 +106,8 @@ class ArtisanServiceProvider extends ServiceProvider
      */
     public function register()
     {
+        Signals::resolveAvailabilityUsing(static fn () => SignalRegistry::isSupported());
+
         $hereCommands = array_merge(
             $this->commands, $this->devCommands
         );

diff --git a/core/tests/Unit/Console/ConsoleSignalsTest.php b/core/tests/Unit/Console/ConsoleSignalsTest.php
@@ -0,0 +1,55 @@
+<?php
+
+use EvolutionCMS\Providers\ArtisanServiceProvider;
+use Illuminate\Console\Command;
+use Illuminate\Console\Signals;
+use Illuminate\Container\Container;
+use Symfony\Component\Console\Application;
+
+beforeEach(function () {
+    $this->resolver = new ReflectionProperty(Signals::class, 'availabilityResolver');
+    $this->previousResolver = $this->resolver->getValue();
+    $this->resolver->setValue(null, null);
+
+    (new ArtisanServiceProvider(new Container()))->register();
+});
+
+afterEach(function () {
+    $this->resolver->setValue(null, $this->previousResolver);
+});
+
+test('console boot registers signal availability for the current runtime', function () {
+    $called = false;
+
+    Signals::whenAvailable(function () use (&$called) {
+        $called = true;
+    });
+
+    expect($called)->toBe(function_exists('pcntl_signal'));
+});
+
+test('commands can trap and release signals after console boot', function () {
+    $command = new Command();
+    $command->setApplication(new Application());
+    $resolved = false;
+    $signal = defined('SIGUSR1') ? SIGUSR1 : 10;
+    $previousHandler = function_exists('pcntl_signal_get_handler')
+        ? pcntl_signal_get_handler($signal)
+        : null;
+
+    try {
+        $command->trap(function () use (&$resolved, $signal) {
+            $resolved = true;
+
+            return $signal;
+        }, static function () {});
+
+        expect($resolved)->toBe(function_exists('pcntl_signal'));
+    } finally {
+        $command->untrap();
+    }
+
+    if ($previousHandler !== null) {
+        expect(pcntl_signal_get_handler($signal))->toBe($previousHandler);
+    }
+});
diff --git a/core/tests/Unit/Manager/ElementListCsrfTokenTest.php b/core/tests/Unit/Manager/ElementListCsrfTokenTest.php
@@ -0,0 +1,62 @@
+<?php
+
+use EvolutionCMS\Traits\Models\ManagerActions;
+use Illuminate\Filesystem\Filesystem;
+use Illuminate\View\Compilers\BladeCompiler;
+
+it('renders session tokens on every mutating element list link', function (string $view, string $model, int $expectedLinks) {
+    $source = file_get_contents(dirname(__DIR__, 4) . '/manager/views/page/resources/elements/' . $view . '.blade.php');
+    preg_match_all('/(?:href|data-enable-href|data-disable-href)="({{ \$item->makeUrl\(.*?)"/', $source, $matches);
+
+    $item = new class {
+        use ManagerActions;
+
+        public bool $exists = true;
+        public array $managerActionsMap;
+
+        public function getKey(): int
+        {
+            return 42;
+        }
+    };
+    $item->managerActionsMap = (new ReflectionClass($model))->getDefaultProperties()['managerActionsMap'];
+    $originalSession = $_SESSION ?? null;
+    $_SESSION = ['_token' => str_repeat('a', 40)];
+    $compiler = new BladeCompiler(new Filesystem(), sys_get_temp_dir());
+    $mutating = 0;
+
+    try {
+        // The module name runs it for managers who can execute but cannot edit modules.
+        foreach (['actions.edit', 'actions.run'] as $action) {
+            foreach ($matches[1] as $fragment) {
+                ob_start();
+                try {
+                    eval('?>' . $compiler->compileString($fragment));
+                    $url = html_entity_decode(ob_get_contents(), ENT_QUOTES, 'UTF-8');
+                } finally {
+                    ob_end_clean();
+                }
+                parse_str((string) parse_url($url, PHP_URL_QUERY), $query);
+                expect($query['id'])->toBe('42');
+
+                if ($query['a'] === (string) $item->managerActionsMap['id']['actions.edit']) {
+                    expect($query)->not->toHaveKey('_token');
+                    continue;
+                }
+
+                expect($query['_token'] ?? null)->toBe($_SESSION['_token']);
+                $mutating++;
+            }
+        }
+        expect($mutating)->toBe($expectedLinks);
+    } finally {
+        $_SESSION = $originalSession;
+    }
+})->with([
+    'templates' => ['template', EvolutionCMS\Models\SiteTemplate::class, 4],
+    'chunks' => ['chunk', EvolutionCMS\Models\SiteHtmlsnippet::class, 8],
+    'snippets' => ['snippet', EvolutionCMS\Models\SiteSnippet::class, 8],
+    'plugins' => ['plugin', EvolutionCMS\Models\SitePlugin::class, 8],
+    'TVs' => ['tv', EvolutionCMS\Models\SiteTmplvar::class, 4],
+    'modules' => ['module', EvolutionCMS\Models\SiteModule::class, 11],
+]);
diff --git a/core/tests/Unit/Security/ManagerCsrfMiddlewareTest.php b/core/tests/Unit/Security/ManagerCsrfMiddlewareTest.php
@@ -201,6 +201,12 @@ function csrfPassed(Request $request): bool
     expect(csrfPassed(csrfRequest('GET', ['a' => 27, 'id' => 3, 'action' => 'delete'])))->toBeTrue();
 });
 
+it('does not reach an element delete processor without the current session token', function (int $action) {
+    expect(csrfPassed(csrfRequest('GET', ['a' => $action, 'id' => 3])))->toBeFalse()
+        ->and(csrfPassed(csrfRequest('GET', ['a' => $action, 'id' => 3, '_token' => 'stale'])))->toBeFalse()
+        ->and(csrfPassed(csrfRequest('GET', ['a' => $action, 'id' => 3, '_token' => str_repeat('a', 40)])))->toBeTrue();
+})->with([21, 80, 25, 104, 303, 110]);
+
 it('accepts destructive GET actions carrying the session token', function () {
     $request = csrfRequest('GET', ['a' => 112, 'id' => 3, '_token' => str_repeat('a', 40)]);
 

diff --git a/manager/views/page/resources/elements/chunk.blade.php b/manager/views/page/resources/elements/chunk.blade.php
@@ -42,10 +42,10 @@
                            onclick="actionDisableElement(this)"
                            title="@if($item->disabled) {{ ManagerTheme::getLexicon('enable') }} @else {{ ManagerTheme::getLexicon('disable') }} @endif"
                            data-disabled="{{ $item->disabled }}"
-                           data-enable-href="{{ $item->makeUrl('actions.enable', false, ['disabled' => 0]) }}"
+                           data-enable-href="{{ $item->makeUrl('actions.enable', false, ['disabled' => 0, '_token' => csrf_token()]) }}"
                            data-enable-title="{{ ManagerTheme::getLexicon('enable') }}"
                            data-enable-icon="{{ $_style['icon_enable'] }}"
-                           data-disable-href="{{ $item->makeUrl('actions.disable', false, ['disabled' => 1]) }}"
+                           data-disable-href="{{ $item->makeUrl('actions.disable', false, ['disabled' => 1, '_token' => csrf_token()]) }}"
                            data-disable-title="{{ ManagerTheme::getLexicon('disable') }}"
                            data-disable-icon="{{ $_style['icon_disable'] }}"
                         >
@@ -55,14 +55,14 @@
                     @endif
                     @if(evolutionCMS()->hasPermission('new_chunk'))
                     <li>
-                        <a href="{{ $item->makeUrl('actions.duplicate') }}" target="main" title="{{ ManagerTheme::getLexicon('resource_duplicate') }}" onclick="return confirm('{{ ManagerTheme::getLexicon('confirm_duplicate_record') }}')">
+                        <a href="{{ $item->makeUrl('actions.duplicate', false, ['_token' => csrf_token()]) }}" target="main" title="{{ ManagerTheme::getLexicon('resource_duplicate') }}" onclick="return confirm('{{ ManagerTheme::getLexicon('confirm_duplicate_record') }}')">
                             <i class="{{ $_style['icon_clone'] }}"></i>
                         </a>
                     </li>
                     @endif
                     @if(evolutionCMS()->hasPermission('delete_chunk'))
                     <li>
-                        <a href="{{ $item->makeUrl('actions.delete') }}" target="main" title="{{ ManagerTheme::getLexicon('delete') }}" onclick="return confirm('{{ ManagerTheme::getLexicon('confirm_delete_htmlsnippet') }}')">
+                        <a href="{{ $item->makeUrl('actions.delete', false, ['_token' => csrf_token()]) }}" target="main" title="{{ ManagerTheme::getLexicon('delete') }}" onclick="return confirm('{{ ManagerTheme::getLexicon('confirm_delete_htmlsnippet') }}')">
                             <i class="{{ $_style['icon_trash'] }}"></i>
                         </a>
                     </li>

diff --git a/manager/views/page/resources/elements/module.blade.php b/manager/views/page/resources/elements/module.blade.php
@@ -15,7 +15,7 @@
                     @if(empty($action))
                         <span class="man_el_name">
                     @else
-                        <a class="man_el_name site_modules" target="main" data-type="site_modules" data-id="{{ $item->id }}" data-catid="{{ $item->category }}" href="{{ $item->makeUrl($action) }}">
+                        <a class="man_el_name site_modules" target="main" data-type="site_modules" data-id="{{ $item->id }}" data-catid="{{ $item->category }}" href="{{ $item->makeUrl($action, false, $action === 'actions.run' ? ['_token' => csrf_token()] : []) }}">
                     @endif
                         @if(empty($item->icon))
                             <i class="{{ $_style['icon_module'] }}"></i>
@@ -45,7 +45,7 @@
                 <ul class="elements_buttonbar">
                     @if(evolutionCMS()->hasPermission('exec_module'))
                         <li>
-                            <a href="{{ $item->makeUrl('actions.run') }}" target="main" title="{{ ManagerTheme::getLexicon('run_module') }}">
+                            <a href="{{ $item->makeUrl('actions.run', false, ['_token' => csrf_token()]) }}" target="main" title="{{ ManagerTheme::getLexicon('run_module') }}">
                                 <i class="{{ $_style['icon_play'] }}"></i>
                             </a>
                         </li>
@@ -61,10 +61,10 @@
                                onclick="actionDisableElement(this)"
                                title="@if($item->disabled) {{ ManagerTheme::getLexicon('enable') }} @else {{ ManagerTheme::getLexicon('disable') }} @endif"
                                data-disabled="{{ $item->disabled }}"
-                               data-enable-href="{{ $item->makeUrl('actions.enable', false, ['disabled' => 0]) }}"
+                               data-enable-href="{{ $item->makeUrl('actions.enable', false, ['disabled' => 0, '_token' => csrf_token()]) }}"
                                data-enable-title="{{ ManagerTheme::getLexicon('enable') }}"
                                data-enable-icon="{{ $_style['icon_enable'] }}"
-                               data-disable-href="{{ $item->makeUrl('actions.disable', false, ['disabled' => 1]) }}"
+                               data-disable-href="{{ $item->makeUrl('actions.disable', false, ['disabled' => 1, '_token' => csrf_token()]) }}"
                                data-disable-title="{{ ManagerTheme::getLexicon('disable') }}"
                                data-disable-icon="{{ $_style['icon_disable'] }}"
                             >
@@ -74,14 +74,14 @@
                     @endif
                     @if(evolutionCMS()->hasPermission('new_module') && evolutionCMS()->hasPermission('save_module'))
                         <li>
-                            <a href="{{ $item->makeUrl('actions.duplicate') }}" target="main" title="{{ ManagerTheme::getLexicon('resource_duplicate') }}" onclick="return confirm('{{ ManagerTheme::getLexicon('confirm_duplicate_record') }}')">
+                            <a href="{{ $item->makeUrl('actions.duplicate', false, ['_token' => csrf_token()]) }}" target="main" title="{{ ManagerTheme::getLexicon('resource_duplicate') }}" onclick="return confirm('{{ ManagerTheme::getLexicon('confirm_duplicate_record') }}')">
                                 <i class="{{ $_style['icon_clone'] }}"></i>
                             </a>
                         </li>
                     @endif
                     @if(evolutionCMS()->hasPermission('delete_module'))
                         <li>
-                            <a href="{{ $item->makeUrl('actions.delete') }}" target="main" title="{{ ManagerTheme::getLexicon('delete') }}" onclick="return confirm('{{ ManagerTheme::getLexicon('confirm_delete_module') }}')">
+                            <a href="{{ $item->makeUrl('actions.delete', false, ['_token' => csrf_token()]) }}" target="main" title="{{ ManagerTheme::getLexicon('delete') }}" onclick="return confirm('{{ ManagerTheme::getLexicon('confirm_delete_module') }}')">
                                 <i class="{{ $_style['icon_trash'] }}"></i>
                             </a>
                         </li>

diff --git a/manager/views/page/resources/elements/plugin.blade.php b/manager/views/page/resources/elements/plugin.blade.php
@@ -42,10 +42,10 @@
                            onclick="actionDisableElement(this)"
                            title="@if($item->disabled) {{ ManagerTheme::getLexicon('enable') }} @else {{ ManagerTheme::getLexicon('disable') }} @endif"
                            data-disabled="{{ $item->disabled }}"
-                           data-enable-href="{{ $item->makeUrl('actions.enable', false, ['disabled' => 0]) }}"
+                           data-enable-href="{{ $item->makeUrl('actions.enable', false, ['disabled' => 0, '_token' => csrf_token()]) }}"
                            data-enable-title="{{ ManagerTheme::getLexicon('enable') }}"
                            data-enable-icon="{{ $_style['icon_enable'] }}"
-                           data-disable-href="{{ $item->makeUrl('actions.disable', false, ['disabled' => 1]) }}"
+                           data-disable-href="{{ $item->makeUrl('actions.disable', false, ['disabled' => 1, '_token' => csrf_token()]) }}"
                            data-disable-title="{{ ManagerTheme::getLexicon('disable') }}"
                            data-disable-icon="{{ $_style['icon_disable'] }}"
                         >
@@ -55,14 +55,14 @@
                     @endif
                     @if(evolutionCMS()->hasPermission('new_plugin'))
                     <li>
-                        <a href="{{ $item->makeUrl('actions.duplicate') }}" target="main" title="{{ ManagerTheme::getLexicon('resource_duplicate') }}" onclick="return confirm('{{ ManagerTheme::getLexicon('confirm_duplicate_record') }}')">
+                        <a href="{{ $item->makeUrl('actions.duplicate', false, ['_token' => csrf_token()]) }}" target="main" title="{{ ManagerTheme::getLexicon('resource_duplicate') }}" onclick="return confirm('{{ ManagerTheme::getLexicon('confirm_duplicate_record') }}')">
                             <i class="{{ $_style['icon_clone'] }}"></i>
                         </a>
                     </li>
                     @endif
                     @if(evolutionCMS()->hasPermission('delete_plugin'))
                     <li>
-                        <a href="{{ $item->makeUrl('actions.delete') }}" target="main" title="{{ ManagerTheme::getLexicon('delete') }}" onclick="return confirm('{{ ManagerTheme::getLexicon('confirm_delete_plugin') }}')">
+                        <a href="{{ $item->makeUrl('actions.delete', false, ['_token' => csrf_token()]) }}" target="main" title="{{ ManagerTheme::getLexicon('delete') }}" onclick="return confirm('{{ ManagerTheme::getLexicon('confirm_delete_plugin') }}')">
                             <i class="{{ $_style['icon_trash'] }}"></i>
                         </a>
                     </li>

diff --git a/manager/views/page/resources/elements/snippet.blade.php b/manager/views/page/resources/elements/snippet.blade.php
@@ -42,10 +42,10 @@
                            onclick="actionDisableElement(this)"
                            title="@if($item->disabled) {{ ManagerTheme::getLexicon('enable') }} @else {{ ManagerTheme::getLexicon('disable') }} @endif"
                            data-disabled="{{ $item->disabled }}"
-                           data-enable-href="{{ $item->makeUrl('actions.enable', false, ['disabled' => 0]) }}"
+                           data-enable-href="{{ $item->makeUrl('actions.enable', false, ['disabled' => 0, '_token' => csrf_token()]) }}"
                            data-enable-title="{{ ManagerTheme::getLexicon('enable') }}"
                            data-enable-icon="{{ $_style['icon_enable'] }}"
-                           data-disable-href="{{ $item->makeUrl('actions.disable', false, ['disabled' => 1]) }}"
+                           data-disable-href="{{ $item->makeUrl('actions.disable', false, ['disabled' => 1, '_token' => csrf_token()]) }}"
                            data-disable-title="{{ ManagerTheme::getLexicon('disable') }}"
                            data-disable-icon="{{ $_style['icon_disable'] }}"
                         >
@@ -55,14 +55,14 @@
                     @endif
                     @if(evolutionCMS()->hasPermission('new_snippet'))
                     <li>
-                        <a href="{{ $item->makeUrl('actions.duplicate') }}" target="main" title="{{ ManagerTheme::getLexicon('resource_duplicate') }}" onclick="return confirm('{{ ManagerTheme::getLexicon('confirm_duplicate_record') }}')">
+                        <a href="{{ $item->makeUrl('actions.duplicate', false, ['_token' => csrf_token()]) }}" target="main" title="{{ ManagerTheme::getLexicon('resource_duplicate') }}" onclick="return confirm('{{ ManagerTheme::getLexicon('confirm_duplicate_record') }}')">
                             <i class="{{ $_style['icon_clone'] }}"></i>
                         </a>
                     </li>
                     @endif
                     @if(evolutionCMS()->hasPermission('delete_snippet'))
                     <li>
-                        <a href="{{ $item->makeUrl('actions.delete') }}" target="main" title="{{ ManagerTheme::getLexicon('delete') }}" onclick="return confirm('{{ ManagerTheme::getLexicon('confirm_delete_snippet') }}')">
+                        <a href="{{ $item->makeUrl('actions.delete', false, ['_token' => csrf_token()]) }}" target="main" title="{{ ManagerTheme::getLexicon('delete') }}" onclick="return confirm('{{ ManagerTheme::getLexicon('confirm_delete_snippet') }}')">
                             <i class="{{ $_style['icon_trash'] }}"></i>
                         </a>
                     </li>

diff --git a/manager/views/page/resources/elements/template.blade.php b/manager/views/page/resources/elements/template.blade.php
@@ -40,14 +40,14 @@
                     @endif
                     @if(evolutionCMS()->hasPermission('new_template'))
                     <li>
-                        <a href="{{ $item->makeUrl('actions.duplicate') }}" target="main" title="{{ ManagerTheme::getLexicon('resource_duplicate') }}" onclick="return confirm('{{ ManagerTheme::getLexicon('confirm_duplicate_record') }}')">
+                        <a href="{{ $item->makeUrl('actions.duplicate', false, ['_token' => csrf_token()]) }}" target="main" title="{{ ManagerTheme::getLexicon('resource_duplicate') }}" onclick="return confirm('{{ ManagerTheme::getLexicon('confirm_duplicate_record') }}')">
                             <i class="{{ $_style['icon_clone'] }}"></i>
                         </a>
                     </li>
                     @endif
                     @if(evolutionCMS()->hasPermission('delete_template'))
                     <li>
-                        <a href="{{ $item->makeUrl('actions.delete') }}" target="main" title="{{ ManagerTheme::getLexicon('delete') }}" onclick="return confirm('{{ ManagerTheme::getLexicon('confirm_delete_template') }}')">
+                        <a href="{{ $item->makeUrl('actions.delete', false, ['_token' => csrf_token()]) }}" target="main" title="{{ ManagerTheme::getLexicon('delete') }}" onclick="return confirm('{{ ManagerTheme::getLexicon('confirm_delete_template') }}')">
                             <i class="{{ $_style['icon_trash'] }}"></i>
                         </a>
                     </li>