security: use more antiforgery tokens

Disco.Web/Areas/API/Controllers/AuthorizationRoleController.cs

@@ -17,7 +17,7 @@ namespace Disco.Web.Areas.API.Controllers
         #region Properties
 
         const string pName = "name";
-
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(int id, string key, string value = null, bool redirect = false)
         {
             try
@@ -40,19 +40,19 @@ namespace Disco.Web.Areas.API.Controllers
                 }
                 else
                 {
-                    return Json("Invalid Authorization Role Id", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Invalid Authorization Role Id");
                 }
                 if (redirect)
                     return RedirectToAction(MVC.Config.AuthorizationRole.Index(authorizationRole.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
@@ -96,27 +96,27 @@ namespace Disco.Web.Areas.API.Controllers
                 AuthorizationLog.LogRoleConfiguredClaimsAdded(AuthorizationRole, CurrentUser.UserId, addedClaims);
         }
 
-        private void UpdateSubjects(AuthorizationRole AuthorizationRole, string[] Subjects)
+        private void UpdateSubjects(AuthorizationRole AuthorizationRole, string[] subjects)
         {
             string subjectIds = null;
             string[] removedSubjects = null;
             string[] addedSubjects = null;
 
             // Validate Subjects
-            if (Subjects != null && Subjects.Length > 0)
+            if (subjects != null && subjects.Length > 0)
             {
-                var subjects = Subjects
+                var subjectRecords = subjects
                     .Where(s => !string.IsNullOrWhiteSpace(s))
                     .Select(s => s.Trim())
                     .Select(s => Tuple.Create(s, ActiveDirectory.RetrieveADObject(s, Quick: true)))
                     .Where(s => s.Item2 is ADUserAccount || s.Item2 is ADGroup)
                     .ToList();
-                var invalidSubjects = subjects.Where(s => s.Item2 == null).ToList();
+                var invalidSubjects = subjectRecords.Where(s => s.Item2 == null).ToList();
 
                 if (invalidSubjects.Count > 0)
                     throw new ArgumentException($"Subjects not found: {string.Join(", ", invalidSubjects)}", "Subjects");
 
-                var proposedSubjects = subjects.Select(s => s.Item2.Id).OrderBy(s => s).ToArray();
+                var proposedSubjects = subjectRecords.Select(s => s.Item2.Id).OrderBy(s => s).ToArray();
                 var currentSubjects = AuthorizationRole.SubjectIds == null ? new string[0] : AuthorizationRole.SubjectIds.Split(',');
                 removedSubjects = currentSubjects.Except(proposedSubjects).ToArray();
                 addedSubjects = proposedSubjects.Except(currentSubjects).ToArray();
@@ -139,12 +139,14 @@ namespace Disco.Web.Areas.API.Controllers
             }
         }
 
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateName(int id, string RoleName = null, bool redirect = false)
         {
             return Update(id, pName, RoleName, redirect);
         }
 
-        public virtual ActionResult UpdateClaims(int id, string[] ClaimKeys = null, bool redirect = false)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult UpdateClaims(int id, string[] claimKeys = null, bool redirect = false)
         {
             try
             {
@@ -154,26 +156,27 @@ namespace Disco.Web.Areas.API.Controllers
                 var authorizationRole = Database.AuthorizationRoles.Find(id);
                 if (authorizationRole != null)
                 {
-                    UpdateClaims(authorizationRole, ClaimKeys);
+                    UpdateClaims(authorizationRole, claimKeys);
                 }
                 else
                 {
-                    return Json("Invalid Authorization Role Id", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Invalid Authorization Role Id");
                 }
                 if (redirect)
                     return RedirectToAction(MVC.Config.AuthorizationRole.Index(authorizationRole.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateSubjects(int id, string[] Subjects = null, bool redirect = false)
         {
             try
@@ -188,26 +191,26 @@ namespace Disco.Web.Areas.API.Controllers
                 }
                 else
                 {
-                    return Json("Invalid Authorization Role Id", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Invalid Authorization Role Id");
                 }
                 if (redirect)
                     return RedirectToAction(MVC.Config.AuthorizationRole.Index(authorizationRole.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         #endregion
 
         #region Actions
-
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Delete(int id, bool? redirect = false)
         {
             try
@@ -220,7 +223,7 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect.HasValue && redirect.Value)
                         return RedirectToAction(MVC.Config.AuthorizationRole.Index(null));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 throw new Exception("Invalid Authorization Role Id");
             }
@@ -229,33 +232,33 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
-        [HttpPost]
-        public virtual ActionResult UpdateAdministratorSubjects(string[] Subjects, bool redirect = false)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult UpdateAdministratorSubjects(string[] subjects, bool redirect = false)
         {
             string[] proposedSubjects;
             string[] removedSubjects = null;
             string[] addedSubjects = null;
 
             // Validate Subjects
-            if (Subjects == null || Subjects.Length == 0)
+            if (subjects == null || subjects.Length == 0)
                 throw new ArgumentNullException("Subjects", "At least one Id must be supplied");
 
-            var subjects = Subjects
+            var subjectValues = subjects
                 .Where(s => !string.IsNullOrWhiteSpace(s))
                 .Select(s => s.Trim())
                 .Select(s => Tuple.Create(s, ActiveDirectory.RetrieveADObject(s, Quick: true)))
                 .Where(s => s.Item2 is ADUserAccount || s.Item2 is ADGroup)
                 .ToList();
-            var invalidSubjects = subjects.Where(s => s.Item2 == null).ToList();
+            var invalidSubjects = subjectValues.Where(s => s.Item2 == null).ToList();
 
             if (invalidSubjects.Count > 0)
                 throw new ArgumentException($"Subjects not found: {string.Join(", ", invalidSubjects)}", "Subjects");
 
-            proposedSubjects = subjects.Select(s => s.Item2.Id).OrderBy(s => s).ToArray();
+            proposedSubjects = subjectValues.Select(s => s.Item2.Id).OrderBy(s => s).ToArray();
             var currentSubjects = UserService.AdministratorSubjectIds;
             removedSubjects = currentSubjects.Except(proposedSubjects).ToArray();
             addedSubjects = proposedSubjects.Except(currentSubjects).ToArray();
@@ -270,7 +273,7 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.AuthorizationRole.Index());
             else
-                return Json("OK");
+                return Ok();
         }
 
         #endregion

Disco.Web/Areas/API/Controllers/BootstrapperController.cs

@@ -1,53 +0,0 @@
-using Disco.Services.Authorization;
-using Disco.Services.Web;
-using System;
-using System.Web.Mvc;
-
-namespace Disco.Web.Areas.API.Controllers
-{
-    [DiscoAuthorize(Claims.Config.Enrolment.Configure)]
-    public partial class BootstrapperController : AuthorizedDatabaseController
-    {
-        public virtual ActionResult MacSshUsername(string MacSshUsername)
-        {
-            try
-            {
-                if (!string.IsNullOrWhiteSpace(MacSshUsername))
-                {
-                    Database.DiscoConfiguration.Bootstrapper.MacSshUsername = MacSshUsername;
-                    Database.SaveChanges();
-                    return Json("OK", JsonRequestBehavior.AllowGet);
-                }
-                else
-                {
-                    throw new Exception("The Username cannot be null or empty");
-                }
-            }
-            catch (Exception ex)
-            {
-                return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
-            }
-        }
-        public virtual ActionResult MacSshPassword(string MacSshPassword)
-        {
-            try
-            {
-                if (!string.IsNullOrWhiteSpace(MacSshPassword))
-                {
-                    Database.DiscoConfiguration.Bootstrapper.MacSshPassword = MacSshPassword;
-                    Database.SaveChanges();
-                    return Json("OK", JsonRequestBehavior.AllowGet);
-                }
-                else
-                {
-                    throw new Exception("The Password cannot be null or empty");
-                }
-            }
-            catch (Exception ex)
-            {
-                return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
-            }
-        }
-
-    }
-}

Disco.Web/Areas/API/Controllers/DeviceBatchController.cs

@@ -9,6 +9,7 @@ using Disco.Services.Web;
 using Disco.Web.Extensions;
 using System;
 using System.Collections.Generic;
+using System.Data.Entity;
 using System.Drawing;
 using System.Linq;
 using System.Web.Mvc;
@@ -35,6 +36,7 @@ namespace Disco.Web.Areas.API.Controllers
         const string pAssignedUsersLinkedGroup = "assigneduserslinkedgroup";
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(int id, string key, string value = null, bool redirect = false)
         {
             Authorization.Require(Claims.Config.DeviceBatch.Configure);
@@ -104,109 +106,124 @@ namespace Disco.Web.Areas.API.Controllers
                 }
                 else
                 {
-                    return Json("Invalid Device Batch Id", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Invalid Device Batch Id");
                 }
                 if (redirect)
                     return RedirectToAction(MVC.Config.DeviceBatch.Index(deviceBatch.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         #region Update Shortcut Methods
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateName(int id, string BatchName = null, bool redirect = false)
         {
             return Update(id, pName, BatchName, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdatePurchaseDate(int id, string PurchaseDate = null, bool redirect = false)
         {
             return Update(id, pPurchaseDate, PurchaseDate, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateSupplier(int id, string Supplier = null, bool redirect = false)
         {
             return Update(id, pSupplier, Supplier, redirect);
         }
 
-        [DiscoAuthorize(Claims.Config.DeviceBatch.Configure), ValidateInput(false)]
-        public virtual ActionResult UpdatePurchaseDetails(int id, string PurchaseDetails = null, bool redirect = false)
+        [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken, ValidateInput(false)]
+        public virtual ActionResult UpdatePurchaseDetails(int id, string purchaseDetails = null, bool redirect = false)
         {
-            return Update(id, pPurchaseDetails, PurchaseDetails, redirect);
+            return Update(id, pPurchaseDetails, purchaseDetails, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateUnitCost(int id, string UnitCost = null, bool redirect = false)
         {
             return Update(id, pUnitCost, UnitCost, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateUnitQuantity(int id, string UnitQuantity = null, bool redirect = false)
         {
             return Update(id, pUnitQuantity, UnitQuantity, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDefaultDeviceModelId(int id, string DefaultDeviceModelId = null, bool redirect = false)
         {
             return Update(id, pDefaultDeviceModelId, DefaultDeviceModelId, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateWarrantyValidUntil(int id, string WarrantyValidUntil = null, bool redirect = false)
         {
             return Update(id, pWarrantyValidUntil, WarrantyValidUntil, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure), ValidateInput(false)]
-        public virtual ActionResult UpdateWarrantyDetails(int id, string WarrantyDetails = null, bool redirect = false)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult UpdateWarrantyDetails(int id, string warrantyDetails = null, bool redirect = false)
         {
-            return Update(id, pWarrantyDetails, WarrantyDetails, redirect);
+            return Update(id, pWarrantyDetails, warrantyDetails, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuredDate(int id, string InsuredDate = null, bool redirect = false)
         {
             return Update(id, pInsuredDate, InsuredDate, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceSupplier(int id, string InsuranceSupplier = null, bool redirect = false)
         {
             return Update(id, pInsuranceSupplier, InsuranceSupplier, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuredUntil(int id, string InsuredUntil = null, bool redirect = false)
         {
             return Update(id, pInsuredUntil, InsuredUntil, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure), ValidateInput(false)]
-        public virtual ActionResult UpdateInsuranceDetails(int id, string InsuranceDetails = null, bool redirect = false)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult UpdateInsuranceDetails(int id, string insuranceDetails = null, bool redirect = false)
         {
-            return Update(id, pInsuranceDetails, InsuranceDetails, redirect);
+            return Update(id, pInsuranceDetails, insuranceDetails, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure), ValidateInput(false)]
-        public virtual ActionResult UpdateComments(int id, string Comments = null, bool redirect = false)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult UpdateComments(int id, string comments = null, bool redirect = false)
         {
-            return Update(id, pComments, Comments, redirect);
+            return Update(id, pComments, comments, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDevicesLinkedGroup(int id, string GroupId = null, bool redirect = false)
         {
             try
@@ -228,17 +245,18 @@ namespace Disco.Web.Areas.API.Controllers
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
                     }
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateAssignedUsersLinkedGroup(int id, string GroupId = null, bool redirect = false)
         {
             try
@@ -260,42 +278,42 @@ namespace Disco.Web.Areas.API.Controllers
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
                     }
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         #endregion
 
         #region Update Properties
-        private void UpdateName(DeviceBatch deviceBatch, string Name)
+        private void UpdateName(DeviceBatch deviceBatch, string name)
         {
-            if (string.IsNullOrWhiteSpace(Name))
+            if (string.IsNullOrWhiteSpace(name))
                 throw new ArgumentNullException("Name", "Device Batch Name is required");
             else
             {
                 // Check for Duplicates
-                var d = Database.DeviceBatches.Where(db => db.Id != deviceBatch.Id && db.Name == Name).Count();
+                var d = Database.DeviceBatches.Where(db => db.Id != deviceBatch.Id && db.Name == name).Count();
                 if (d > 0)
                 {
                     throw new Exception("A Device Batch with that name already exists");
                 }
-                deviceBatch.Name = Name;
+                deviceBatch.Name = name;
             }
             Database.SaveChanges();
         }
-        private void UpdatePurchaseDate(DeviceBatch deviceBatch, string PurchaseDate)
+        private void UpdatePurchaseDate(DeviceBatch deviceBatch, string purchaseDate)
         {
-            if (string.IsNullOrEmpty(PurchaseDate))
+            if (string.IsNullOrEmpty(purchaseDate))
                 throw new ArgumentNullException("PurchaseDate", "A Device Batch Purchase Date is required");
             else
             {
-                if (DateTime.TryParse(PurchaseDate, out var ecd))
+                if (DateTime.TryParse(purchaseDate, out var ecd))
                 {
                     deviceBatch.PurchaseDate = ecd.Date;
                 }
@@ -306,48 +324,48 @@ namespace Disco.Web.Areas.API.Controllers
             }
             Database.SaveChanges();
         }
-        private void UpdateSupplier(DeviceBatch deviceBatch, string Supplier)
+        private void UpdateSupplier(DeviceBatch deviceBatch, string supplier)
         {
-            if (string.IsNullOrWhiteSpace(Supplier))
+            if (string.IsNullOrWhiteSpace(supplier))
                 deviceBatch.Supplier = null;
             else
-                deviceBatch.Supplier = Supplier;
+                deviceBatch.Supplier = supplier;
             Database.SaveChanges();
         }
-        private void UpdatePurchaseDetails(DeviceBatch deviceBatch, string PurchaseDetails)
+        private void UpdatePurchaseDetails(DeviceBatch deviceBatch, string purchaseDetails)
         {
-            if (string.IsNullOrWhiteSpace(PurchaseDetails))
+            if (string.IsNullOrWhiteSpace(purchaseDetails))
                 deviceBatch.PurchaseDetails = null;
             else
-                deviceBatch.PurchaseDetails = PurchaseDetails;
+                deviceBatch.PurchaseDetails = purchaseDetails;
             Database.SaveChanges();
         }
-        private void UpdateUnitCost(DeviceBatch deviceBatch, string UnitCost)
+        private void UpdateUnitCost(DeviceBatch deviceBatch, string unitCost)
         {
-            if (string.IsNullOrWhiteSpace(UnitCost))
+            if (string.IsNullOrWhiteSpace(unitCost))
                 deviceBatch.UnitCost = null;
             else
             {
-                if (decimal.TryParse(UnitCost, out var unitCost))
-                {
-                    deviceBatch.UnitCost = unitCost;
-                }
+                unitCost = unitCost.Trim();
+                if (unitCost.StartsWith("$"))
+                    unitCost = unitCost.Substring(1).Trim(); // Remove $ sign if present
+
+                if (decimal.TryParse(unitCost, out var unitCostValue))
+                    deviceBatch.UnitCost = unitCostValue;
                 else
-                {
                     throw new Exception("Invalid Currency Format");
-                }
             }
             Database.SaveChanges();
         }
-        private void UpdateUnitQuantity(DeviceBatch deviceBatch, string UnitQuantity)
+        private void UpdateUnitQuantity(DeviceBatch deviceBatch, string unitQuantity)
         {
-            if (string.IsNullOrWhiteSpace(UnitQuantity))
+            if (string.IsNullOrWhiteSpace(unitQuantity))
                 deviceBatch.UnitQuantity = null;
             else
             {
-                if (int.TryParse(UnitQuantity, out var unitQuantity))
+                if (int.TryParse(unitQuantity, out var unitQuantityValue))
                 {
-                    deviceBatch.UnitQuantity = unitQuantity;
+                    deviceBatch.UnitQuantity = unitQuantityValue;
                 }
                 else
                 {
@@ -356,11 +374,11 @@ namespace Disco.Web.Areas.API.Controllers
             }
             Database.SaveChanges();
         }
-        private void UpdateDefaultDeviceModelId(DeviceBatch deviceBatch, string DefaultDeviceModelId)
+        private void UpdateDefaultDeviceModelId(DeviceBatch deviceBatch, string defaultDeviceModelId)
         {
-            if (!string.IsNullOrEmpty(DefaultDeviceModelId))
+            if (!string.IsNullOrEmpty(defaultDeviceModelId))
             {
-                if (int.TryParse(DefaultDeviceModelId, out var bId))
+                if (int.TryParse(defaultDeviceModelId, out var bId))
                 {
                     var dm = Database.DeviceModels.Find(bId);
                     if (dm != null)
@@ -384,13 +402,13 @@ namespace Disco.Web.Areas.API.Controllers
             }
             throw new Exception("Invalid Device Model Id");
         }
-        private void UpdateWarrantyValidUntil(DeviceBatch deviceBatch, string WarrantyValidUntil)
+        private void UpdateWarrantyValidUntil(DeviceBatch deviceBatch, string warrantyValidUntil)
         {
-            if (string.IsNullOrEmpty(WarrantyValidUntil))
+            if (string.IsNullOrEmpty(warrantyValidUntil))
                 deviceBatch.WarrantyValidUntil = null;
             else
             {
-                if (DateTime.TryParse(WarrantyValidUntil, out var ecd))
+                if (DateTime.TryParse(warrantyValidUntil, out var ecd))
                 {
                     deviceBatch.WarrantyValidUntil = ecd.Date;
                 }
@@ -401,21 +419,21 @@ namespace Disco.Web.Areas.API.Controllers
             }
             Database.SaveChanges();
         }
-        private void UpdateWarrantyDetails(DeviceBatch deviceBatch, string WarrantyDetails)
+        private void UpdateWarrantyDetails(DeviceBatch deviceBatch, string warrantyDetails)
         {
-            if (string.IsNullOrWhiteSpace(WarrantyDetails))
+            if (string.IsNullOrWhiteSpace(warrantyDetails))
                 deviceBatch.WarrantyDetails = null;
             else
-                deviceBatch.WarrantyDetails = WarrantyDetails;
+                deviceBatch.WarrantyDetails = warrantyDetails;
             Database.SaveChanges();
         }
-        private void UpdateInsuredDate(DeviceBatch deviceBatch, string InsuredDate)
+        private void UpdateInsuredDate(DeviceBatch deviceBatch, string insuredDate)
         {
-            if (string.IsNullOrEmpty(InsuredDate))
+            if (string.IsNullOrEmpty(insuredDate))
                 deviceBatch.InsuredDate = null;
             else
             {
-                if (DateTime.TryParse(InsuredDate, out var ecd))
+                if (DateTime.TryParse(insuredDate, out var ecd))
                 {
                     deviceBatch.InsuredDate = ecd.Date;
                 }
@@ -426,21 +444,21 @@ namespace Disco.Web.Areas.API.Controllers
             }
             Database.SaveChanges();
         }
-        private void UpdateInsuranceSupplier(DeviceBatch deviceBatch, string InsuranceSupplier)
+        private void UpdateInsuranceSupplier(DeviceBatch deviceBatch, string insuranceSupplier)
         {
-            if (string.IsNullOrWhiteSpace(InsuranceSupplier))
+            if (string.IsNullOrWhiteSpace(insuranceSupplier))
                 deviceBatch.InsuranceSupplier = null;
             else
-                deviceBatch.InsuranceSupplier = InsuranceSupplier;
+                deviceBatch.InsuranceSupplier = insuranceSupplier;
             Database.SaveChanges();
         }
-        private void UpdateInsuredUntil(DeviceBatch deviceBatch, string InsuredUntil)
+        private void UpdateInsuredUntil(DeviceBatch deviceBatch, string insuredUntil)
         {
-            if (string.IsNullOrEmpty(InsuredUntil))
+            if (string.IsNullOrEmpty(insuredUntil))
                 deviceBatch.InsuredUntil = null;
             else
             {
-                if (DateTime.TryParse(InsuredUntil, out var ecd))
+                if (DateTime.TryParse(insuredUntil, out var ecd))
                 {
                     deviceBatch.InsuredUntil = ecd.Date;
                 }
@@ -451,26 +469,26 @@ namespace Disco.Web.Areas.API.Controllers
             }
             Database.SaveChanges();
         }
-        private void UpdateInsuranceDetails(DeviceBatch deviceBatch, string InsuranceDetails)
+        private void UpdateInsuranceDetails(DeviceBatch deviceBatch, string insuranceDetails)
         {
-            if (string.IsNullOrWhiteSpace(InsuranceDetails))
+            if (string.IsNullOrWhiteSpace(insuranceDetails))
                 deviceBatch.InsuranceDetails = null;
             else
-                deviceBatch.InsuranceDetails = InsuranceDetails;
+                deviceBatch.InsuranceDetails = insuranceDetails;
             Database.SaveChanges();
         }
-        private void UpdateComments(DeviceBatch deviceBatch, string Comments)
+        private void UpdateComments(DeviceBatch deviceBatch, string comments)
         {
-            if (string.IsNullOrWhiteSpace(Comments))
+            if (string.IsNullOrWhiteSpace(comments))
                 deviceBatch.Comments = null;
             else
-                deviceBatch.Comments = Comments;
+                deviceBatch.Comments = comments;
             Database.SaveChanges();
         }
 
-        private ScheduledTaskStatus UpdateDevicesLinkedGroup(DeviceBatch DeviceBatch, string DevicesLinkedGroup)
+        private ScheduledTaskStatus UpdateDevicesLinkedGroup(DeviceBatch DeviceBatch, string devicesLinkedGroup)
         {
-            var configJson = ADManagedGroup.ValidConfigurationToJson(DeviceBatchDevicesManagedGroup.GetKey(DeviceBatch), DevicesLinkedGroup, null);
+            var configJson = ADManagedGroup.ValidConfigurationToJson(DeviceBatchDevicesManagedGroup.GetKey(DeviceBatch), devicesLinkedGroup, null);
 
             if (DeviceBatch.DevicesLinkedGroup != configJson)
             {
@@ -485,9 +503,9 @@ namespace Disco.Web.Areas.API.Controllers
             return null;
         }
 
-        private ScheduledTaskStatus UpdateAssignedUsersLinkedGroup(DeviceBatch DeviceBatch, string AssignedUsersLinkedGroup)
+        private ScheduledTaskStatus UpdateAssignedUsersLinkedGroup(DeviceBatch DeviceBatch, string assignedUsersLinkedGroup)
         {
-            var configJson = ADManagedGroup.ValidConfigurationToJson(DeviceBatchAssignedUsersManagedGroup.GetKey(DeviceBatch), AssignedUsersLinkedGroup, null);
+            var configJson = ADManagedGroup.ValidConfigurationToJson(DeviceBatchAssignedUsersManagedGroup.GetKey(DeviceBatch), assignedUsersLinkedGroup, null);
 
             if (DeviceBatch.AssignedUsersLinkedGroup != configJson)
             {
@@ -506,6 +524,7 @@ namespace Disco.Web.Areas.API.Controllers
         #region Actions
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Delete)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Delete(int id, bool? redirect = false)
         {
             try
@@ -518,7 +537,7 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect.HasValue && redirect.Value)
                         return RedirectToAction(MVC.Config.DeviceBatch.Index(null));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 throw new Exception("Invalid Device Batch Number");
             }
@@ -527,7 +546,7 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
@@ -536,6 +555,7 @@ namespace Disco.Web.Areas.API.Controllers
         #region Index
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Show)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Index(int? id)
         {
             if (id.HasValue)
@@ -556,6 +576,7 @@ namespace Disco.Web.Areas.API.Controllers
         #region Timeline
 
         [DiscoAuthorizeAll(Claims.Config.DeviceBatch.Show, Claims.Config.DeviceBatch.ShowTimeline)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Timeline()
         {
 
@@ -601,7 +622,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
         #endregion
 
-        #region Attachements
+        #region Attachments
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Show)]
         [OutputCache(Location = System.Web.UI.OutputCacheLocation.Client, Duration = 172800)]
@@ -660,6 +681,9 @@ namespace Disco.Web.Areas.API.Controllers
                         if (string.IsNullOrEmpty(contentType) || contentType.Equals("unknown/unknown", StringComparison.OrdinalIgnoreCase))
                             contentType = MimeTypes.ResolveMimeType(file.FileName);
 
+                        if (string.IsNullOrWhiteSpace(comments))
+                            comments = null;
+
                         var attachment = new DeviceBatchAttachment()
                         {
                             DeviceBatchId = batch.Id,
@@ -687,7 +711,7 @@ namespace Disco.Web.Areas.API.Controllers
         [DiscoAuthorize(Claims.Config.DeviceBatch.Show)]
         public virtual ActionResult Attachment(int id)
         {
-            var attachment = Database.DeviceBatchAttachments.Include("TechUser").Where(m => m.Id == id).FirstOrDefault();
+            var attachment = Database.DeviceBatchAttachments.Include(a => a.TechUser).Where(m => m.Id == id).FirstOrDefault();
             if (attachment != null)
             {
 
@@ -699,13 +723,13 @@ namespace Disco.Web.Areas.API.Controllers
 
                 return Json(m, JsonRequestBehavior.AllowGet);
             }
-            return Json(new Models.Attachment.AttachmentModel() { Result = "Invalid Attachment Number" }, JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Attachment Number");
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Show)]
         public virtual ActionResult Attachments(int id)
         {
-            var batch = Database.DeviceBatches.Include("DeviceBatchAttachments.TechUser").Where(m => m.Id == id).FirstOrDefault();
+            var batch = Database.DeviceBatches.Include(b => b.DeviceBatchAttachments.Select(a => a.TechUser)).Where(m => m.Id == id).FirstOrDefault();
             if (batch != null)
             {
                 var m = new Models.Attachment.AttachmentsModel()
@@ -716,20 +740,21 @@ namespace Disco.Web.Areas.API.Controllers
 
                 return Json(m, JsonRequestBehavior.AllowGet);
             }
-            return Json(new Models.Attachment.AttachmentsModel() { Result = "Invalid Device Batch Id" }, JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Device Batch Id");
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult AttachmentRemove(int id)
         {
-            var attachment = Database.DeviceBatchAttachments.Include("TechUser").Where(m => m.Id == id).FirstOrDefault();
+            var attachment = Database.DeviceBatchAttachments.Include(a => a.TechUser).Where(m => m.Id == id).FirstOrDefault();
             if (attachment != null)
             {
                 attachment.OnDelete(Database);
                 Database.SaveChanges();
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
             }
-            return Json("Invalid Attachment Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Attachment Number");
         }
 
         #endregion

Disco.Web/Areas/API/Controllers/DeviceCertificateController.cs

@@ -9,6 +9,7 @@ namespace Disco.Web.Areas.API.Controllers
     {
 
         [DiscoAuthorize(Claims.Config.DeviceCertificate.DownloadCertificates)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Download(int id)
         {
             var wc = Database.DeviceCertificates.Find(id);

Disco.Web/Areas/API/Controllers/DeviceController.cs

@@ -26,7 +26,6 @@ namespace Disco.Web.Areas.API.Controllers
 {
     public partial class DeviceController : AuthorizedDatabaseController
     {
-
         const string pDeviceProfileId = "deviceprofileid";
         const string pDeviceBatchId = "devicebatchid";
         const string pAssetNumber = "assetnumber";
@@ -37,6 +36,7 @@ namespace Disco.Web.Areas.API.Controllers
         const string pDetailBattery = "detailbattery";
         const string pDetailKeyboard = "detailkeyboard";
 
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(string id, string key, string value = null, bool redirect = false)
         {
             Database.Configuration.LazyLoadingEnabled = true;
@@ -99,20 +99,21 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect)
                     return RedirectToAction(MVC.Device.Show(device.SerialNumber));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         #region Update Shortcut Methods
 
-        [DiscoAuthorize(Claims.Device.Properties.DeviceProfile), HttpPost, ValidateAntiForgeryToken]
+        [DiscoAuthorize(Claims.Device.Properties.DeviceProfile)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDeviceProfileId(string id, string DeviceProfileId = null, bool enforceOrganisationalUnit = false, bool redirect = false)
         {
             var updateResult = Update(id, pDeviceProfileId, DeviceProfileId, redirect);
@@ -163,24 +164,28 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.Device.Properties.DeviceBatch)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDeviceBatchId(string id, string DeviceBatchId = null, bool redirect = false)
         {
             return Update(id, pDeviceBatchId, DeviceBatchId, redirect);
         }
 
         [DiscoAuthorize(Claims.Device.Properties.AssetNumber)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateAssetNumber(string id, string AssetNumber = null, bool redirect = false)
         {
             return Update(id, pAssetNumber, AssetNumber, redirect);
         }
 
         [DiscoAuthorize(Claims.Device.Properties.Location)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateLocation(string id, string Location = null, bool redirect = false)
         {
             return Update(id, pLocation, Location, redirect);
         }
 
         [DiscoAuthorize(Claims.Device.Actions.AssignUser)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateAssignedUserId(string id, string AssignedUserId = null, bool redirect = false)
         {
             if (!string.IsNullOrWhiteSpace(AssignedUserId))
@@ -190,24 +195,28 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.Device.Actions.AllowUnauthenticatedEnrol)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateAllowUnauthenticatedEnrol(string id, string AllowUnauthenticatedEnrol = null, bool redirect = false)
         {
             return Update(id, pAllowUnauthenticatedEnrol, AllowUnauthenticatedEnrol, redirect);
         }
 
         [DiscoAuthorize(Claims.Device.Properties.Details)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDetailACAdapter(string id, string DetailACAdapter = null, bool redirect = false)
         {
             return Update(id, pDetailACAdapter, DetailACAdapter, redirect);
         }
 
         [DiscoAuthorize(Claims.Device.Properties.Details)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDetailBattery(string id, string DetailBattery = null, bool redirect = false)
         {
             return Update(id, pDetailBattery, DetailBattery, redirect);
         }
 
         [DiscoAuthorize(Claims.Device.Properties.Details)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDetailKeyboard(string id, string DetailKeyboard = null, bool redirect = false)
         {
             return Update(id, pDetailKeyboard, DetailKeyboard, redirect);
@@ -344,31 +353,36 @@ namespace Disco.Web.Areas.API.Controllers
         #region Device Actions
 
         [DiscoAuthorize(Claims.Device.Actions.Decommission)]
-        public virtual ActionResult Decommission(string id, int Reason, bool redirect)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult Decommission(string id, int? Reason = null, bool redirect = false)
         {
+            if (Reason == null)
+                throw new ArgumentNullException(nameof(Reason), "Decommission Reason is required");
+
             var d = Database.Devices.Find(id);
             Database.Configuration.LazyLoadingEnabled = true;
             if (d != null)
             {
                 if (d.CanDecommission())
                 {
-                    d.OnDecommission((DecommissionReasons)Reason, Database);
+                    d.OnDecommission((DecommissionReasons)Reason.Value, Database);
 
                     Database.SaveChanges();
                     if (redirect)
                         return RedirectToAction(MVC.Device.Show(id));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 else
                 {
-                    return Json("Device's state doesn't allow this action", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Device's state doesn't allow this action");
                 }
             }
-            return Json("Invalid Device Serial Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Device Serial Number");
         }
 
         [DiscoAuthorize(Claims.Device.Actions.Recommission)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Recommission(string id, bool redirect)
         {
             var d = Database.Devices.Find(id);
@@ -383,17 +397,18 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect)
                         return RedirectToAction(MVC.Device.Show(id));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 else
                 {
-                    return Json("Device's state doesn't allow this action", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Device's state doesn't allow this action");
                 }
             }
-            return Json("Invalid Device Serial Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Device Serial Number");
         }
 
         [DiscoAuthorize(Claims.Device.Actions.Delete)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Delete(string id, bool redirect)
         {
             var j = Database.Devices.Find(id);
@@ -408,43 +423,20 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect)
                         return RedirectToAction(MVC.Device.Index());
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 else
                 {
-                    return Json("Job's state doesn't allow this action", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Job's state doesn't allow this action");
                 }
             }
-            return Json("Invalid Device Serial Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Device Serial Number");
         }
 
         #endregion
 
-        [DiscoAuthorize(Claims.Device.Actions.GenerateDocuments)]
-        public virtual ActionResult GeneratePdf(string id, string DocumentTemplateId)
-        {
-            if (string.IsNullOrEmpty(id))
-                throw new ArgumentNullException(nameof(id));
-            if (string.IsNullOrEmpty(DocumentTemplateId))
-                throw new ArgumentNullException(nameof(DocumentTemplateId));
-
-            // Obsolete: Use API\DocumentTemplate\Generate instead
-            return RedirectToAction(MVC.API.DocumentTemplate.Generate(DocumentTemplateId, id));
-        }
-
-        [DiscoAuthorize(Claims.Device.Actions.GenerateDocuments)]
-        public virtual ActionResult GeneratePdfPackage(string id, string DocumentTemplatePackageId)
-        {
-            if (string.IsNullOrEmpty(id))
-                throw new ArgumentNullException(nameof(id));
-            if (string.IsNullOrEmpty(DocumentTemplatePackageId))
-                throw new ArgumentNullException(nameof(DocumentTemplatePackageId));
-
-            // Obsolete: Use API\DocumentTemplatePackage\Generate instead
-            return RedirectToAction(MVC.API.DocumentTemplatePackage.Generate(DocumentTemplatePackageId, id));
-        }
-
         [DiscoAuthorize(Claims.Device.Show)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult LastNetworkLogonDate(string id)
         {
             if (string.IsNullOrWhiteSpace(id))
@@ -585,7 +577,8 @@ namespace Disco.Web.Areas.API.Controllers
             return HttpNotFound("Invalid Attachment Number");
         }
 
-        [DiscoAuthorize(Claims.Device.Actions.AddAttachments), ValidateAntiForgeryToken]
+        [DiscoAuthorize(Claims.Device.Actions.AddAttachments)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult AttachmentUpload(string id, string comments)
         {
             var d = Database.Devices.Find(id);
@@ -644,7 +637,7 @@ namespace Disco.Web.Areas.API.Controllers
 
                 return Json(m, JsonRequestBehavior.AllowGet);
             }
-            return Json(new Models.Attachment.AttachmentModel() { Result = "Invalid Attachment Number" }, JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Attachment Number");
         }
 
         [DiscoAuthorize(Claims.Device.ShowAttachments)]
@@ -661,10 +654,11 @@ namespace Disco.Web.Areas.API.Controllers
 
                 return Json(m, JsonRequestBehavior.AllowGet);
             }
-            return Json(new Models.Attachment.AttachmentsModel() { Result = "Invalid Device Serial Number" }, JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Device Serial Number");
         }
 
         [DiscoAuthorizeAny(Claims.Job.Actions.RemoveAnyAttachments, Claims.Job.Actions.RemoveOwnAttachments)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult AttachmentRemove(int id)
         {
             var da = Database.DeviceAttachments.Include("TechUser").Where(m => m.Id == id).FirstOrDefault();
@@ -677,9 +671,9 @@ namespace Disco.Web.Areas.API.Controllers
 
                 da.OnDelete(Database);
                 Database.SaveChanges();
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
             }
-            return Json("Invalid Attachment Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Attachment Number");
         }
 
         [DiscoAuthorize(Claims.Device.Actions.AddAttachments)]
@@ -706,11 +700,7 @@ namespace Disco.Web.Areas.API.Controllers
             }
             catch (InvalidOperationException ex)
             {
-                return Json(new
-                {
-                    Success = false,
-                    ErrorMessage = ex.Message,
-                });
+                return BadRequest(ex.Message);
             }
         }
 
@@ -736,6 +726,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.Device.Actions.Import)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult ImportBegin(HttpPostedFileBase ImportFile, bool HasHeader)
         {
             if (ImportFile == null || ImportFile.ContentLength == 0)
@@ -752,15 +743,14 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.Device.Actions.Import)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult ImportParse(string Id, List<DeviceImportFieldTypes> Headers)
         {
             if (string.IsNullOrWhiteSpace(Id))
-                throw new ArgumentNullException("Id");
+                throw new ArgumentNullException(nameof(Id));
 
-            var context = Import_RetrieveContext(Id);
-
-            if (context == null)
-                throw new ArgumentException("The Import Session Id is invalid or the session timed out (60 minutes), try importing again", "Id");
+            var context = Import_RetrieveContext(Id)
+                ?? throw new ArgumentException("The Import Session Id is invalid or the session timed out (60 minutes), try importing again", nameof(Id));
 
             context.UpdateColumnTypes(Headers);
 
@@ -777,15 +767,14 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.Device.Actions.Import)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult ImportApply(string Id)
         {
             if (string.IsNullOrWhiteSpace(Id))
-                throw new ArgumentNullException("Id");
+                throw new ArgumentNullException(nameof(Id));
 
-            var context = Import_RetrieveContext(Id);
-
-            if (context == null)
-                throw new ArgumentException("The Import Session Id is invalid or the session timed out (60 minutes), try importing again", "Id");
+            var context = Import_RetrieveContext(Id)
+                ?? throw new ArgumentException("The Import Session Id is invalid or the session timed out (60 minutes), try importing again", nameof(Id));
 
             var status = DeviceImportApplyTask.ScheduleNow(context);
             status.SetFinishedUrl(Url.Action(MVC.Device.Import(context.SessionId)));
@@ -895,6 +884,7 @@ namespace Disco.Web.Areas.API.Controllers
         #endregion
 
         [DiscoAuthorize(Claims.DiscoAdminAccount)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult MigrateDeviceMacAddressesFromLog()
         {
             var taskStatus = Disco.Services.Devices.Enrolment.LogMacAddressImportingTask.ScheduleImmediately();

Disco.Web/Areas/API/Controllers/DeviceFlagAssignmentController.cs

@@ -40,14 +40,14 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     return Redirect($"{Url.Action(MVC.Device.Show(assignment.DeviceSerialNumber))}#DeviceDetailTab-Flags");
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 

Disco.Web/Areas/API/Controllers/DeviceFlagController.cs

@@ -24,6 +24,7 @@ namespace Disco.Web.Areas.API.Controllers
         const string pOnUnassignmentExpression = "onunassignmentexpression";
 
         [DiscoAuthorize(Claims.Config.DeviceFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(int id, string key, string value = null, bool? redirect = null)
         {
             Authorization.Require(Claims.Config.DeviceFlag.Configure);
@@ -68,43 +69,48 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     return RedirectToAction(MVC.Config.DeviceFlag.Index(flag.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         #region Update Shortcut Methods
         [DiscoAuthorize(Claims.Config.DeviceFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateName(int id, string FlagName = null, bool? redirect = null)
         {
             return Update(id, pName, FlagName, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDescription(int id, string Description = null, bool? redirect = null)
         {
             return Update(id, pDescription, Description, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateIcon(int id, string Icon = null, bool? redirect = null)
         {
             return Update(id, pIcon, Icon, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateIconColour(int id, string IconColour = null, bool? redirect = null)
         {
             return Update(id, pIconColour, IconColour, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateIconAndColour(int id, string Icon = null, string IconColour = null, bool redirect = false)
         {
             try
@@ -124,27 +130,30 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect)
                     return RedirectToAction(MVC.Config.DeviceFlag.Index(DeviceFlag.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         [DiscoAuthorize(Claims.Config.DeviceFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateOnAssignmentExpression(int id, string OnAssignmentExpression = null, bool redirect = false)
         {
             return Update(id, pOnAssignmentExpression, OnAssignmentExpression, redirect);
         }
         [DiscoAuthorize(Claims.Config.DeviceFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateOnUnassignmentExpression(int id, string OnUnassignmentExpression = null, bool redirect = false)
         {
             return Update(id, pOnUnassignmentExpression, OnUnassignmentExpression, redirect);
         }
         [DiscoAuthorize(Claims.Config.DeviceFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDevicesLinkedGroup(int id, string GroupId = null, DateTime? FilterBeginDate = null, bool redirect = false)
         {
             try
@@ -167,17 +176,18 @@ namespace Disco.Web.Areas.API.Controllers
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
                     }
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         [DiscoAuthorize(Claims.Config.DeviceFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateAssignedUserLinkedGroup(int id, string GroupId = null, DateTime? FilterBeginDate = null, bool redirect = false)
         {
             try
@@ -200,14 +210,14 @@ namespace Disco.Web.Areas.API.Controllers
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
                     }
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         #endregion
@@ -341,6 +351,7 @@ namespace Disco.Web.Areas.API.Controllers
 
         #region Actions
         [DiscoAuthorizeAll(Claims.Config.DeviceFlag.Configure, Claims.Config.DeviceFlag.Delete)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Delete(int id, bool? redirect = false)
         {
             try
@@ -354,7 +365,7 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect.HasValue && redirect.Value)
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(status.SessionId));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 throw new ArgumentException("Invalid Device Flag Id", nameof(id));
             }
@@ -363,11 +374,12 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         [DiscoAuthorizeAll(Claims.Config.DeviceFlag.Configure, Claims.Device.Actions.AddFlags, Claims.Device.Actions.RemoveFlags, Claims.Device.ShowFlagAssignments)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult BulkAssignDevices(int id, bool Override, string DeviceSerialNumbers = null, string Comments = null)
         {
             if (id < 0)

Disco.Web/Areas/API/Controllers/DeviceModelController.cs

@@ -7,6 +7,7 @@ using Disco.Services.Plugins.Features.WarrantyProvider;
 using Disco.Services.Web;
 using System;
 using System.Collections.Generic;
+using System.Data.Entity;
 using System.Linq;
 using System.Web;
 using System.Web.Mvc;
@@ -24,6 +25,7 @@ namespace Disco.Web.Areas.API.Controllers
         const string pDefaultRepairProvider = "defaultrepairprovider";
 
         [DiscoAuthorize(Claims.Config.DeviceModel.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(int id, string key, string value = null, bool redirect = false)
         {
             Authorization.Require(Claims.Config.DeviceModel.Configure);
@@ -63,19 +65,19 @@ namespace Disco.Web.Areas.API.Controllers
                 }
                 else
                 {
-                    return Json("Invalid Device Model Number", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Invalid Device Model Number");
                 }
                 if (redirect)
                     return RedirectToAction(MVC.Config.DeviceModel.Index(deviceModel.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
@@ -120,12 +122,12 @@ namespace Disco.Web.Areas.API.Controllers
         #endregion
 
         #region Update Properties
-        private void UpdateDescription(DeviceModel deviceModel, string Description)
+        private void UpdateDescription(DeviceModel deviceModel, string description)
         {
-            if (string.IsNullOrWhiteSpace(Description))
+            if (string.IsNullOrWhiteSpace(description))
                 deviceModel.Description = null;
             else
-                deviceModel.Description = Description;
+                deviceModel.Description = description;
             Database.SaveChanges();
         }
         private void UpdateManufacturer(DeviceModel deviceModel, string manufacturer)
@@ -150,15 +152,15 @@ namespace Disco.Web.Areas.API.Controllers
                 deviceModel.Model = model;
             Database.SaveChanges();
         }
-        private void UpdateDefaultPurchaseDate(DeviceModel deviceModel, string DefaultPurchaseDate)
+        private void UpdateDefaultPurchaseDate(DeviceModel deviceModel, string defaultPurchaseDate)
         {
-            if (string.IsNullOrEmpty(DefaultPurchaseDate))
+            if (string.IsNullOrEmpty(defaultPurchaseDate))
             {
                 deviceModel.DefaultPurchaseDate = null;
             }
             else
             {
-                if (DateTime.TryParse(DefaultPurchaseDate, out var d))
+                if (DateTime.TryParse(defaultPurchaseDate, out var d))
                 {
                     deviceModel.DefaultPurchaseDate = d;
                 }
@@ -169,30 +171,30 @@ namespace Disco.Web.Areas.API.Controllers
             }
             Database.SaveChanges();
         }
-        private void UpdateDefaultWarrantyProvider(DeviceModel deviceModel, string DefaultWarrantyProvider)
+        private void UpdateDefaultWarrantyProvider(DeviceModel deviceModel, string defaultWarrantyProvider)
         {
-            if (string.IsNullOrEmpty(DefaultWarrantyProvider))
+            if (string.IsNullOrEmpty(defaultWarrantyProvider))
             {
                 deviceModel.DefaultWarrantyProvider = null;
             }
             else
             {
                 // Validate
-                var WarrantyProvider = Plugins.GetPluginFeature(DefaultWarrantyProvider, typeof(WarrantyProviderFeature));
+                var WarrantyProvider = Plugins.GetPluginFeature(defaultWarrantyProvider, typeof(WarrantyProviderFeature));
                 deviceModel.DefaultWarrantyProvider = WarrantyProvider.Id;
             }
             Database.SaveChanges();
         }
-        private void UpdateDefaultRepairProvider(DeviceModel deviceModel, string DefaultRepairProvider)
+        private void UpdateDefaultRepairProvider(DeviceModel deviceModel, string defaultRepairProvider)
         {
-            if (string.IsNullOrEmpty(DefaultRepairProvider))
+            if (string.IsNullOrEmpty(defaultRepairProvider))
             {
                 deviceModel.DefaultRepairProvider = null;
             }
             else
             {
                 // Validate
-                var RepairProvider = Plugins.GetPluginFeature(DefaultRepairProvider, typeof(RepairProviderFeature));
+                var RepairProvider = Plugins.GetPluginFeature(defaultRepairProvider, typeof(RepairProviderFeature));
                 deviceModel.DefaultRepairProvider = RepairProvider.Id;
             }
             Database.SaveChanges();
@@ -213,12 +215,7 @@ namespace Disco.Web.Areas.API.Controllers
                     var deviceModelImage = m.Image();
                     if (deviceModelImage != null)
                         return File(deviceModelImage, "image/png");
-                    //if ( m.Image != null)
-                    //{
-                    //    return File(m.Image, "image/png");
-                    //}
-                    //else
-                    //{
+
                     // DataStore Failed - Use Generic Images
                     if (m.ModelType != null)
                     {
@@ -228,13 +225,13 @@ namespace Disco.Web.Areas.API.Controllers
                             return File(modelTypePath, "image/png");
                         }
                     }
-                    //}
                 }
             }
             return File(Links.ClientSource.Style.Images.DeviceTypes.Unknown_png, "image/png");
         }
 
-        [DiscoAuthorize(Claims.Config.DeviceModel.Configure), HttpPost]
+        [DiscoAuthorize(Claims.Config.DeviceModel.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Image(int id, bool redirect, HttpPostedFileBase Image)
         {
             if (Image != null && Image.ContentLength > 0)
@@ -248,31 +245,32 @@ namespace Disco.Web.Areas.API.Controllers
                         if (redirect)
                             return RedirectToAction(MVC.Config.DeviceModel.Index(dm.Id));
                         else
-                            return Json("OK", JsonRequestBehavior.AllowGet);
+                            return Ok();
                     }
                     else
                     {
                         if (redirect)
                             return RedirectToAction(MVC.Config.DeviceModel.Index(dm.Id));
                         else
-                            return Json("Invalid Image Format", JsonRequestBehavior.AllowGet);
+                            return BadRequest("Invalid Image Format");
                     }
                 }
                 if (redirect)
                     return RedirectToAction(MVC.Config.DeviceModel.Index());
                 else
-                    return Json("Invalid Device Model Number", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Invalid Device Model Number");
             }
             if (redirect)
                 return RedirectToAction(MVC.Config.DeviceModel.Index());
             else
-                return Json("No Image Supplied", JsonRequestBehavior.AllowGet);
+                return BadRequest("No Image Supplied");
         }
         #endregion
 
         #region Actions
 
         [DiscoAuthorize(Claims.Config.DeviceModel.Delete)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Delete(int id, bool? redirect = false)
         {
             try
@@ -285,7 +283,7 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect.HasValue && redirect.Value)
                         return RedirectToAction(MVC.Config.DeviceModel.Index(null));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 throw new Exception("Invalid Device Model Number");
             }
@@ -294,7 +292,7 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
@@ -303,39 +301,38 @@ namespace Disco.Web.Areas.API.Controllers
         #region Device Model Components
 
         [DiscoAuthorize(Claims.Config.DeviceModel.Show)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Component(int id)
         {
-            var dc = Database.DeviceComponents.Include("JobSubTypes").Where(i => i.Id == id).FirstOrDefault();
-            if (dc != null)
-            {
-                return Json(new Models.DeviceModel.ComponentModel { Result = "OK", Component = Models.DeviceModel._ComponentModel.FromDeviceComponent(dc) }, JsonRequestBehavior.AllowGet);
-            }
-            return Json(new Models.DeviceModel.ComponentModel { Result = "Invalid Device Component Id" }, JsonRequestBehavior.AllowGet);
+            var dc = Database.DeviceComponents.Include(c => c.JobSubTypes).Where(i => i.Id == id).FirstOrDefault();
+            if (dc == null)
+                return BadRequest("Invalid Device Component Id");
+
+            return Json(Models.DeviceModel.ComponentModel.FromDeviceComponent(dc));
         }
 
         [DiscoAuthorize(Claims.Config.DeviceModel.ConfigureComponents)]
-        public virtual ActionResult ComponentAdd(int? id, string Description, string Cost)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult ComponentAdd(int? id, string description, string cost)
         {
             DeviceModel dm = null;
             if (id.HasValue)
             {
                 dm = Database.DeviceModels.Find(id.Value);
                 if (dm == null)
-                {
-                    return Json(new Models.DeviceModel.ComponentModel { Result = "Invalid Device Model Id" }, JsonRequestBehavior.AllowGet);
-                }
+                    return BadRequest("Invalid Device Model Id");
             }
 
-            if (string.IsNullOrEmpty(Description))
-                Description = "?";
-            if (!string.IsNullOrEmpty(Cost) && Cost.Contains("$"))
-                Cost = Cost.Substring(Cost.IndexOf("$") + 1);
-            decimal.TryParse(Cost, out var cost);
+            if (string.IsNullOrEmpty(description))
+                description = "?";
+            if (!string.IsNullOrEmpty(cost) && cost.Contains("$"))
+                cost = cost.Substring(cost.IndexOf("$") + 1);
+            decimal.TryParse(cost, out var costValue);
 
             var dc = new DeviceComponent()
             {
-                Description = Description,
-                Cost = cost
+                Description = description,
+                Cost = costValue
             };
             if (dm != null)
             {
@@ -346,77 +343,77 @@ namespace Disco.Web.Areas.API.Controllers
             Database.DeviceComponents.Add(dc);
             Database.SaveChanges();
 
-            return Json(new Models.DeviceModel.ComponentModel { Result = "OK", Component = Models.DeviceModel._ComponentModel.FromDeviceComponent(dc) }, JsonRequestBehavior.AllowGet);
+            return Json(Models.DeviceModel.ComponentModel.FromDeviceComponent(dc));
         }
 
         [DiscoAuthorize(Claims.Config.DeviceModel.ConfigureComponents)]
-        public virtual ActionResult ComponentUpdateJobSubTypes(int id, List<string> JobSubTypes)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult ComponentUpdateJobSubTypes(int id, List<string> jobSubTypes)
         {
-            var dc = Database.DeviceComponents.Include("JobSubTypes").Where(i => i.Id == id).FirstOrDefault();
-            if (dc != null)
-            {
-                dc.JobSubTypes.Clear();
+            var dc = Database.DeviceComponents.Include(c => c.JobSubTypes).Where(i => i.Id == id).FirstOrDefault();
+            if (dc == null)
+                return BadRequest("Invalid Device Component Id");
 
-                if (JobSubTypes != null)
+            dc.JobSubTypes.Clear();
+
+            if (jobSubTypes != null)
+            {
+                var jsts = Database.JobSubTypes.Where(jst => jobSubTypes.Contains(jst.JobTypeId + "_" + jst.Id));
+                foreach (var jst in jsts)
                 {
-                    var jsts = Database.JobSubTypes.Where(jst => JobSubTypes.Contains(jst.JobTypeId + "_" + jst.Id));
-                    foreach (var jst in jsts)
-                    {
-                        dc.JobSubTypes.Add(jst);
-                    }
+                    dc.JobSubTypes.Add(jst);
                 }
-
-                Database.SaveChanges();
-
-                return Json(new Models.DeviceModel.ComponentModel { Result = "OK", Component = Models.DeviceModel._ComponentModel.FromDeviceComponent(dc) }, JsonRequestBehavior.AllowGet);
             }
-            return Json(new Models.DeviceModel.ComponentModel { Result = "Invalid Device Component Id" }, JsonRequestBehavior.AllowGet);
+
+            Database.SaveChanges();
+
+            return Json(Models.DeviceModel.ComponentModel.FromDeviceComponent(dc));
         }
 
         [DiscoAuthorize(Claims.Config.DeviceModel.ConfigureComponents)]
-        public virtual ActionResult ComponentUpdate(int id, string Description, string Cost)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult ComponentUpdate(int id, string description, string cost)
         {
-            var dc = Database.DeviceComponents.Include("JobSubTypes").Where(i => i.Id == id).FirstOrDefault();
-            if (dc != null)
-            {
+            var dc = Database.DeviceComponents.Include(c => c.JobSubTypes).Where(i => i.Id == id).FirstOrDefault();
+            if (dc == null)
+                return BadRequest("Invalid Device Component Id");
 
-                if (string.IsNullOrEmpty(Description))
-                    Description = "?";
-                if (!string.IsNullOrEmpty(Cost) && Cost.Contains("$"))
-                    Cost = Cost.Substring(Cost.IndexOf("$") + 1);
-                decimal.TryParse(Cost, out var cost);
+            if (string.IsNullOrEmpty(description))
+                description = "?";
+            if (!string.IsNullOrEmpty(cost) && cost.Contains("$"))
+                cost = cost.Substring(cost.IndexOf("$") + 1);
+            decimal.TryParse(cost, out var costValue);
 
-                dc.Description = Description;
-                dc.Cost = cost;
+            dc.Description = description;
+            dc.Cost = costValue;
 
-                Database.SaveChanges();
+            Database.SaveChanges();
 
-                return Json(new Models.DeviceModel.ComponentModel { Result = "OK", Component = Models.DeviceModel._ComponentModel.FromDeviceComponent(dc) }, JsonRequestBehavior.AllowGet);
-            }
-            return Json(new Models.DeviceModel.ComponentModel { Result = "Invalid Device Component Id" }, JsonRequestBehavior.AllowGet);
+            return Json(Models.DeviceModel.ComponentModel.FromDeviceComponent(dc));
         }
 
         [DiscoAuthorize(Claims.Config.DeviceModel.ConfigureComponents)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult ComponentRemove(int id)
         {
-            var dc = Database.DeviceComponents.Include("JobSubTypes").Where(c => c.Id == id).FirstOrDefault();
-            if (dc != null)
-            {
-                dc.JobSubTypes.Clear();
-                Database.DeviceComponents.Remove(dc);
-                Database.SaveChanges();
-                return Json("OK", JsonRequestBehavior.AllowGet);
-            }
-            return Json("Invalid Device Component Id", JsonRequestBehavior.AllowGet);
+            var dc = Database.DeviceComponents.Include(c => c.JobSubTypes).Where(c => c.Id == id).FirstOrDefault();
+            if (dc == null)
+                return BadRequest("Invalid Device Component Id");
+
+            dc.JobSubTypes.Clear();
+            Database.DeviceComponents.Remove(dc);
+            Database.SaveChanges();
+            return Ok();
         }
         #endregion
 
         #region Index
-        [DiscoAuthorize(Claims.Config.DeviceModel.Show)]
+        [DiscoAuthorizeAny(Claims.Config.DeviceModel.Show, Claims.Config.Enrolment.ShowStatus)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Index()
         {
-            var deviceModels = Database.DeviceModels.ToArray().Select(dm => Models.DeviceModel._DeviceModel.FromDeviceModel(dm)).ToArray();
-            return Json(deviceModels, JsonRequestBehavior.AllowGet);
+            var deviceModels = Database.DeviceModels.AsEnumerable().Select(dm => Models.DeviceModel._DeviceModel.FromDeviceModel(dm)).ToList();
+            return Json(deviceModels);
         }
         #endregion
 

Disco.Web/Areas/API/Controllers/DeviceProfileController.cs

@@ -40,6 +40,7 @@ namespace Disco.Web.Areas.API.Controllers
         const string pAssignedUsersLinkedGroup = "assigneduserslinkedgroup";
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(int id, string key, string value = null, bool? redirect = null)
         {
             Authorization.Require(Claims.Config.DeviceProfile.Configure);
@@ -114,62 +115,70 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     return RedirectToAction(MVC.Config.DeviceProfile.Index(deviceProfile.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         #region Update Shortcut Methods
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDescription(int id, string Description = null, bool? redirect = null)
         {
             return Update(id, pDescription, Description, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateName(int id, string ProfileName = null, bool? redirect = null)
         {
             return Update(id, pName, ProfileName, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateShortName(int id, string ShortName = null, bool? redirect = null)
         {
             return Update(id, pShortName, ShortName, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDistributionType(int id, string DistributionType = null, bool? redirect = null)
         {
             return Update(id, pDistributionType, DistributionType, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
-        public virtual ActionResult UpdateCertificateProviders(int id, string CertificateProviders = null, bool? redirect = null)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult UpdateCertificateProviders(int id, string certificateProviders = null, bool? redirect = null)
         {
-            return Update(id, pCertificateProviders, CertificateProviders, redirect);
+            return Update(id, pCertificateProviders, certificateProviders, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
-        public virtual ActionResult UpdateCertificateAuthorityProviders(int id, string CertificateAuthorityProviders = null, bool? redirect = null)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult UpdateCertificateAuthorityProviders(int id, string certificateAuthorityProviders = null, bool? redirect = null)
         {
-            return Update(id, pCertificateAuthorityProviders, CertificateAuthorityProviders, redirect);
+            return Update(id, pCertificateAuthorityProviders, certificateAuthorityProviders, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
-        public virtual ActionResult UpdateWirelessProfileProviders(int id, string WirelessProfileProviders = null, bool? redirect = null)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult UpdateWirelessProfileProviders(int id, string wirelessProfileProviders = null, bool? redirect = null)
         {
-            return Update(id, pWirelessProfileProviders, WirelessProfileProviders, redirect);
+            return Update(id, pWirelessProfileProviders, wirelessProfileProviders, redirect);
         }
 
-        [DiscoAuthorize(Claims.Config.DeviceProfile.Configure), HttpPost, ValidateAntiForgeryToken]
+        [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateOrganisationalUnit(int id, string OrganisationalUnit = null, bool enforce = false, bool? redirect = null)
         {
             var updateResult = Update(id, pOrganisationalUnit, OrganisationalUnit, redirect);
@@ -187,13 +196,14 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDefaultOrganisationAddress(int id, string DefaultOrganisationAddress = null, bool? redirect = null)
         {
             return Update(id, pDefaultOrganisationAddress, DefaultOrganisationAddress, redirect);
         }
 
         [DiscoAuthorizeAll(Claims.Config.DeviceProfile.Configure, Claims.Config.DeviceProfile.ConfigureComputerNameTemplate)]
-        [ValidateAntiForgeryToken]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateComputerNameTemplate(int id, string ComputerNameTemplate = null, bool? redirect = null)
         {
             var deviceProfile = Database.DeviceProfiles.Find(id);
@@ -219,11 +229,11 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect.GetValueOrDefault(false))
                 return RedirectToAction(MVC.Config.DeviceProfile.Index(deviceProfile.Id));
             else
-                return Json("OK");
+                return Ok();
         }
 
         [DiscoAuthorizeAll(Claims.Config.DeviceProfile.Configure, Claims.Config.DeviceProfile.ConfigureComputerNameTemplate)]
-        [ValidateAntiForgeryToken]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult TestComputerNameTemplate(int id, string ComputerNameTemplate = null, string UserSpecifiedDeviceSerialNumber = null)
         {
             Database.Configuration.LazyLoadingEnabled = true;
@@ -317,36 +327,42 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateEnforceComputerNameConvention(int id, string EnforceComputerNameConvention = null, bool? redirect = null)
         {
             return Update(id, pEnforceComputerNameConvention, EnforceComputerNameConvention, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateEnforceOrganisationalUnit(int id, string EnforceOrganisationalUnit = null, bool? redirect = null)
         {
             return Update(id, pEnforceOrganisationalUnit, EnforceOrganisationalUnit, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateProvisionADAccount(int id, string ProvisionADAccount = null, bool? redirect = null)
         {
             return Update(id, pProvisionADAccount, ProvisionADAccount, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateAssignedUserLocalAdmin(int id, string AssignedUserLocalAdmin = null, bool? redirect = null)
         {
             return Update(id, pAssignedUserLocalAdmin, AssignedUserLocalAdmin, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateAllowUntrustedReimageJobEnrolment(int id, string AllowUntrustedReimageJobEnrolment = null, bool? redirect = null)
         {
             return Update(id, pAllowUntrustedReimageJobEnrolment, AllowUntrustedReimageJobEnrolment, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDevicesLinkedGroup(int id, string GroupId = null, bool redirect = false)
         {
             try
@@ -368,17 +384,18 @@ namespace Disco.Web.Areas.API.Controllers
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
                     }
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateAssignedUsersLinkedGroup(int id, string GroupId = null, bool redirect = false)
         {
             try
@@ -400,49 +417,49 @@ namespace Disco.Web.Areas.API.Controllers
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
                     }
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         #endregion
 
         #region Update Properties
-        private void UpdateDescription(DeviceProfile deviceProfile, string Description)
+        private void UpdateDescription(DeviceProfile deviceProfile, string description)
         {
-            if (string.IsNullOrWhiteSpace(Description))
+            if (string.IsNullOrWhiteSpace(description))
                 deviceProfile.Description = null;
             else
-                deviceProfile.Description = Description;
+                deviceProfile.Description = description;
             Database.SaveChanges();
         }
 
-        private void UpdateName(DeviceProfile deviceProfile, string Name)
+        private void UpdateName(DeviceProfile deviceProfile, string name)
         {
-            if (string.IsNullOrWhiteSpace(Name))
+            if (string.IsNullOrWhiteSpace(name))
                 throw new Exception("Profile name cannot be empty");
             else
-                deviceProfile.Name = Name;
+                deviceProfile.Name = name;
             Database.SaveChanges();
         }
 
-        private void UpdateShortName(DeviceProfile deviceProfile, string ShortName)
+        private void UpdateShortName(DeviceProfile deviceProfile, string shortName)
         {
-            if (string.IsNullOrWhiteSpace(ShortName))
+            if (string.IsNullOrWhiteSpace(shortName))
                 throw new Exception("Profile short name cannot be empty");
             else
-                deviceProfile.ShortName = ShortName;
+                deviceProfile.ShortName = shortName;
             Database.SaveChanges();
         }
 
-        private void UpdateDistributionType(DeviceProfile deviceProfile, string DistributionType)
+        private void UpdateDistributionType(DeviceProfile deviceProfile, string distributionType)
         {
-            if (int.TryParse(DistributionType, out var iDt))
+            if (int.TryParse(distributionType, out var iDt))
             {
                 deviceProfile.DistributionType = (DeviceProfile.DistributionTypes)iDt;
                 Database.SaveChanges();
@@ -451,9 +468,9 @@ namespace Disco.Web.Areas.API.Controllers
             throw new Exception("Invalid Distribution Type Number");
         }
 
-        private void UpdateCertificateProviders(DeviceProfile deviceProfile, string CertificateProviderIds)
+        private void UpdateCertificateProviders(DeviceProfile deviceProfile, string certificateProviderIds)
         {
-            if (string.IsNullOrWhiteSpace(CertificateProviderIds))
+            if (string.IsNullOrWhiteSpace(certificateProviderIds))
             {
                 deviceProfile.CertificateProviders = null;
             }
@@ -461,7 +478,7 @@ namespace Disco.Web.Areas.API.Controllers
             {
                 // Validate
                 var validatedProviders = new List<PluginFeatureManifest>();
-                foreach (var certificateProviderId in CertificateProviderIds.Split(new char[] { ',' }, StringSplitOptions.RemoveEmptyEntries))
+                foreach (var certificateProviderId in certificateProviderIds.Split(new char[] { ',' }, StringSplitOptions.RemoveEmptyEntries))
                 {
                     var featureManifest = Plugins.GetPluginFeature(certificateProviderId, typeof(CertificateProviderFeature));
                     if (featureManifest == null)
@@ -487,9 +504,9 @@ namespace Disco.Web.Areas.API.Controllers
             Database.SaveChanges();
         }
 
-        private void UpdateCertificateAuthorityProviders(DeviceProfile deviceProfile, string CertificateAuthorityProviderIds)
+        private void UpdateCertificateAuthorityProviders(DeviceProfile deviceProfile, string certificateAuthorityProviderIds)
         {
-            if (string.IsNullOrWhiteSpace(CertificateAuthorityProviderIds))
+            if (string.IsNullOrWhiteSpace(certificateAuthorityProviderIds))
             {
                 deviceProfile.CertificateAuthorityProviders = null;
             }
@@ -497,7 +514,7 @@ namespace Disco.Web.Areas.API.Controllers
             {
                 // Validate
                 var validatedProviders = new List<PluginFeatureManifest>();
-                foreach (var certificateAuthorityProviderId in CertificateAuthorityProviderIds.Split(new char[] { ',' }, StringSplitOptions.RemoveEmptyEntries))
+                foreach (var certificateAuthorityProviderId in certificateAuthorityProviderIds.Split(new char[] { ',' }, StringSplitOptions.RemoveEmptyEntries))
                 {
                     var featureManifest = Plugins.GetPluginFeature(certificateAuthorityProviderId, typeof(CertificateAuthorityProviderFeature));
                     if (featureManifest == null)
@@ -523,9 +540,9 @@ namespace Disco.Web.Areas.API.Controllers
             Database.SaveChanges();
         }
 
-        private void UpdateWirelessProfileProviders(DeviceProfile deviceProfile, string WirelessProfileProviderIds)
+        private void UpdateWirelessProfileProviders(DeviceProfile deviceProfile, string wirelessProfileProviderIds)
         {
-            if (string.IsNullOrWhiteSpace(WirelessProfileProviderIds))
+            if (string.IsNullOrWhiteSpace(wirelessProfileProviderIds))
             {
                 deviceProfile.WirelessProfileProviders = null;
             }
@@ -533,7 +550,7 @@ namespace Disco.Web.Areas.API.Controllers
             {
                 // Validate
                 var validatedProviders = new List<PluginFeatureManifest>();
-                foreach (var wirelessProfileProviderId in WirelessProfileProviderIds.Split(new char[] { ',' }, StringSplitOptions.RemoveEmptyEntries))
+                foreach (var wirelessProfileProviderId in wirelessProfileProviderIds.Split(new char[] { ',' }, StringSplitOptions.RemoveEmptyEntries))
                 {
                     var featureManifest = Plugins.GetPluginFeature(wirelessProfileProviderId, typeof(WirelessProfileProviderFeature));
                     if (featureManifest == null)
@@ -559,28 +576,28 @@ namespace Disco.Web.Areas.API.Controllers
             Database.SaveChanges();
         }
 
-        private void UpdateOrganisationalUnit(DeviceProfile deviceProfile, string OrganisationalUnit)
+        private void UpdateOrganisationalUnit(DeviceProfile deviceProfile, string organisationalUnit)
         {
-            if (string.IsNullOrWhiteSpace(OrganisationalUnit))
-                OrganisationalUnit = ActiveDirectory.Context.PrimaryDomain.DefaultComputerContainer;
+            if (string.IsNullOrWhiteSpace(organisationalUnit))
+                organisationalUnit = ActiveDirectory.Context.PrimaryDomain.DefaultComputerContainer;
 
-            if (OrganisationalUnit != deviceProfile.OrganisationalUnit)
+            if (organisationalUnit != deviceProfile.OrganisationalUnit)
             {
-                deviceProfile.OrganisationalUnit = OrganisationalUnit;
+                deviceProfile.OrganisationalUnit = organisationalUnit;
                 Database.SaveChanges();
             }
         }
 
-        private void UpdateDefaultOrganisationAddress(DeviceProfile deviceProfile, string DefaultOrganisationAddress)
+        private void UpdateDefaultOrganisationAddress(DeviceProfile deviceProfile, string defaultOrganisationAddress)
         {
-            if (string.IsNullOrEmpty(DefaultOrganisationAddress))
+            if (string.IsNullOrEmpty(defaultOrganisationAddress))
             {
                 deviceProfile.DefaultOrganisationAddress = null;
             }
             else
             {
                 // Validate
-                if (int.TryParse(DefaultOrganisationAddress, out var daoId))
+                if (int.TryParse(defaultOrganisationAddress, out var daoId))
                 {
                     var oa = Database.DiscoConfiguration.OrganisationAddresses.GetAddress(daoId);
                     if (oa != null)
@@ -602,9 +619,9 @@ namespace Disco.Web.Areas.API.Controllers
             Database.SaveChanges();
         }
 
-        private void UpdateEnforceComputerNameConvention(DeviceProfile deviceProfile, string EnforceComputerNameConvention)
+        private void UpdateEnforceComputerNameConvention(DeviceProfile deviceProfile, string enforceComputerNameConvention)
         {
-            if (bool.TryParse(EnforceComputerNameConvention, out var bValue))
+            if (bool.TryParse(enforceComputerNameConvention, out var bValue))
             {
                 deviceProfile.EnforceComputerNameConvention = bValue;
 
@@ -614,9 +631,9 @@ namespace Disco.Web.Areas.API.Controllers
             throw new Exception("Invalid Boolean Value");
         }
 
-        private void UpdateEnforceOrganisationalUnit(DeviceProfile deviceProfile, string EnforceOrganisationalUnit)
+        private void UpdateEnforceOrganisationalUnit(DeviceProfile deviceProfile, string enforceOrganisationalUnit)
         {
-            if (bool.TryParse(EnforceOrganisationalUnit, out var bValue))
+            if (bool.TryParse(enforceOrganisationalUnit, out var bValue))
             {
                 deviceProfile.EnforceOrganisationalUnit = bValue;
 
@@ -626,9 +643,9 @@ namespace Disco.Web.Areas.API.Controllers
             throw new Exception("Invalid Boolean Value");
         }
 
-        private void UpdateProvisionADAccount(DeviceProfile deviceProfile, string ProvisionADAccount)
+        private void UpdateProvisionADAccount(DeviceProfile deviceProfile, string provisionADAccount)
         {
-            if (bool.TryParse(ProvisionADAccount, out var bValue))
+            if (bool.TryParse(provisionADAccount, out var bValue))
             {
                 deviceProfile.ProvisionADAccount = bValue;
 
@@ -638,9 +655,9 @@ namespace Disco.Web.Areas.API.Controllers
             throw new Exception("Invalid Boolean Value");
         }
 
-        private void UpdateAssignedUserLocalAdmin(DeviceProfile deviceProfile, string AssignedUserLocalAdmin)
+        private void UpdateAssignedUserLocalAdmin(DeviceProfile deviceProfile, string assignedUserLocalAdmin)
         {
-            if (bool.TryParse(AssignedUserLocalAdmin, out var bValue))
+            if (bool.TryParse(assignedUserLocalAdmin, out var bValue))
             {
                 deviceProfile.AssignedUserLocalAdmin = bValue;
 
@@ -650,9 +667,9 @@ namespace Disco.Web.Areas.API.Controllers
             throw new Exception("Invalid Boolean Value");
         }
 
-        private void UpdateAllowUntrustedReimageJobEnrolment(DeviceProfile deviceProfile, string AllowUntrustedReimageJobEnrolment)
+        private void UpdateAllowUntrustedReimageJobEnrolment(DeviceProfile deviceProfile, string allowUntrustedReimageJobEnrolment)
         {
-            if (bool.TryParse(AllowUntrustedReimageJobEnrolment, out var bValue))
+            if (bool.TryParse(allowUntrustedReimageJobEnrolment, out var bValue))
             {
                 deviceProfile.AllowUntrustedReimageJobEnrolment = bValue;
 
@@ -662,16 +679,16 @@ namespace Disco.Web.Areas.API.Controllers
             throw new Exception("Invalid Boolean Value");
         }
 
-        private ScheduledTaskStatus UpdateDevicesLinkedGroup(DeviceProfile DeviceProfile, string DevicesLinkedGroup)
+        private ScheduledTaskStatus UpdateDevicesLinkedGroup(DeviceProfile deviceProfile, string devicesLinkedGroup)
         {
-            var configJson = ADManagedGroup.ValidConfigurationToJson(DeviceProfileDevicesManagedGroup.GetKey(DeviceProfile), DevicesLinkedGroup, null);
+            var configJson = ADManagedGroup.ValidConfigurationToJson(DeviceProfileDevicesManagedGroup.GetKey(deviceProfile), devicesLinkedGroup, null);
 
-            if (DeviceProfile.DevicesLinkedGroup != configJson)
+            if (deviceProfile.DevicesLinkedGroup != configJson)
             {
-                DeviceProfile.DevicesLinkedGroup = configJson;
+                deviceProfile.DevicesLinkedGroup = configJson;
                 Database.SaveChanges();
 
-                var managedGroup = DeviceProfileDevicesManagedGroup.Initialize(DeviceProfile);
+                var managedGroup = DeviceProfileDevicesManagedGroup.Initialize(deviceProfile);
                 if (managedGroup != null) // Sync Group
                     return ADManagedGroupsSyncTask.ScheduleSync(managedGroup);
             }
@@ -679,16 +696,16 @@ namespace Disco.Web.Areas.API.Controllers
             return null;
         }
 
-        private ScheduledTaskStatus UpdateAssignedUsersLinkedGroup(DeviceProfile DeviceProfile, string AssignedUsersLinkedGroup)
+        private ScheduledTaskStatus UpdateAssignedUsersLinkedGroup(DeviceProfile deviceProfile, string assignedUsersLinkedGroup)
         {
-            var configJson = ADManagedGroup.ValidConfigurationToJson(DeviceProfileAssignedUsersManagedGroup.GetKey(DeviceProfile), AssignedUsersLinkedGroup, null);
+            var configJson = ADManagedGroup.ValidConfigurationToJson(DeviceProfileAssignedUsersManagedGroup.GetKey(deviceProfile), assignedUsersLinkedGroup, null);
 
-            if (DeviceProfile.AssignedUsersLinkedGroup != configJson)
+            if (deviceProfile.AssignedUsersLinkedGroup != configJson)
             {
-                DeviceProfile.AssignedUsersLinkedGroup = configJson;
+                deviceProfile.AssignedUsersLinkedGroup = configJson;
                 Database.SaveChanges();
 
-                var managedGroup = DeviceProfileAssignedUsersManagedGroup.Initialize(DeviceProfile);
+                var managedGroup = DeviceProfileAssignedUsersManagedGroup.Initialize(deviceProfile);
                 if (managedGroup != null) // Sync Group
                     return ADManagedGroupsSyncTask.ScheduleSync(managedGroup);
             }
@@ -700,6 +717,7 @@ namespace Disco.Web.Areas.API.Controllers
         #region Actions
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Delete)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Delete(int id, bool? redirect = false)
         {
             try
@@ -712,7 +730,7 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect.HasValue && redirect.Value)
                         return RedirectToAction(MVC.Config.DeviceProfile.Index(null));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 throw new Exception("Invalid Device Profile Number");
             }
@@ -721,7 +739,7 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
@@ -730,6 +748,7 @@ namespace Disco.Web.Areas.API.Controllers
         #region Defaults
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.ConfigureDefaults)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Default(int id, bool? redirect = null)
         {
             try
@@ -742,7 +761,7 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect.HasValue && redirect.Value)
                         return RedirectToAction(MVC.Config.DeviceProfile.Index(id));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 throw new Exception("Invalid Device Profile Number");
             }
@@ -751,11 +770,12 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.ConfigureDefaults)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult DefaultAddDeviceOffline(int id, bool? redirect = false)
         {
             try
@@ -778,14 +798,14 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     return RedirectToAction(MVC.Config.DeviceProfile.Index(id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 

Disco.Web/Areas/API/Controllers/DocumentTemplateController.cs

@@ -21,7 +21,7 @@ using System.ComponentModel.DataAnnotations;
 using System.Data.Entity;
 using System.IO;
 using System.Linq;
-using System.Net;
+using System.Text.RegularExpressions;
 using System.Web;
 using System.Web.Mvc;
 using System.Web.UI.WebControls;
@@ -40,6 +40,7 @@ namespace Disco.Web.Areas.API.Controllers
         const string pIsHidden = "ishidden";
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(string id, string key, string value = null, bool redirect = false)
         {
             try
@@ -97,18 +98,19 @@ namespace Disco.Web.Areas.API.Controllers
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(resultTask.SessionId));
                     }
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
-        [DiscoAuthorize(Claims.Config.DocumentTemplate.Upload), HttpGet]
+        [DiscoAuthorize(Claims.Config.DocumentTemplate.Upload)]
+        [HttpGet]
         public virtual ActionResult Template(string id)
         {
             if (string.IsNullOrEmpty(id))
@@ -128,7 +130,8 @@ namespace Disco.Web.Areas.API.Controllers
             }
         }
 
-        [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.Upload, Claims.Config.DocumentTemplate.Configure), HttpPost]
+        [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.Upload, Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Template(string id, bool redirect, HttpPostedFileBase Template)
         {
             try
@@ -144,18 +147,19 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect)
                     return RedirectToAction(MVC.Config.DocumentTemplate.Index(documentTemplate.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
-        [DiscoAuthorize(Claims.Config.DocumentTemplate.Show), HttpGet]
+        [DiscoAuthorize(Claims.Config.DocumentTemplate.Show)]
+        [HttpGet]
         public virtual ActionResult TemplatePreview(string id)
         {
             if (string.IsNullOrEmpty(id))
@@ -180,41 +184,49 @@ namespace Disco.Web.Areas.API.Controllers
 
         #region Update Shortcut Methods
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDescription(string id, string Description = null, bool redirect = false)
         {
             return Update(id, pDescription, Description, redirect);
         }
         [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.Configure, Claims.Config.DocumentTemplate.ConfigureFilterExpression)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateFilterExpression(string id, string FilterExpression = null, bool redirect = false)
         {
             return Update(id, pFilterExpression, FilterExpression, redirect);
         }
         [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.Configure, Claims.Config.DocumentTemplate.ConfigureFilterExpression)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateOnGenerateExpression(string id, string OnGenerateExpression = null, bool redirect = false)
         {
             return Update(id, pOnGenerateExpression, OnGenerateExpression, redirect);
         }
         [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.Configure, Claims.Config.DocumentTemplate.ConfigureFilterExpression)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateOnImportAttachmentExpression(string id, string OnImportAttachmentExpression = null, bool redirect = false)
         {
             return Update(id, pOnImportAttachmentExpression, OnImportAttachmentExpression, redirect);
         }
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateFlattenForm(string id, string FlattenForm = null, bool redirect = false)
         {
             return Update(id, pFlattenForm, FlattenForm, redirect);
         }
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateIsHidden(string id, string IsHidden = null, bool redirect = false)
         {
             return Update(id, pIsHidden, IsHidden, redirect);
         }
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateScope(string id, string Scope = null, bool redirect = false)
         {
             return Update(id, pScope, Scope, redirect);
         }
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateJobSubTypes(string id, List<string> JobSubTypes = null, bool redirect = false)
         {
             try
@@ -228,19 +240,20 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect)
                     return RedirectToAction(MVC.Config.DocumentTemplate.Index(documentTemplate.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
 
         }
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDevicesLinkedGroup(string id, string GroupId = null, DateTime? FilterBeginDate = null, bool redirect = false)
         {
             try
@@ -262,18 +275,19 @@ namespace Disco.Web.Areas.API.Controllers
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
                     }
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateUsersLinkedGroup(string id, string GroupId = null, DateTime? FilterBeginDate = null, bool redirect = false)
         {
             try
@@ -295,14 +309,14 @@ namespace Disco.Web.Areas.API.Controllers
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
                     }
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         #endregion
@@ -493,7 +507,7 @@ namespace Disco.Web.Areas.API.Controllers
         #region Actions
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.UndetectedPages), OutputCache(NoStore = true, Duration = 0)]
-        public virtual ActionResult ImporterThumbnail(string SessionId, int PageNumber)
+        public virtual ActionResult ImporterThumbnail(Guid SessionId, int PageNumber)
         {
             var dataStoreSessionPagesCacheLocation = DataStore.CreateLocation(Database, "Cache\\DocumentDropBox_SessionPages");
             var filename = Path.Combine(dataStoreSessionPagesCacheLocation, $"{SessionId}-{PageNumber}");
@@ -504,6 +518,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.UndetectedPages)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult ImporterUndetectedFiles()
         {
             var undetectedLocation = DataStore.CreateLocation(Database, "DocumentDropBox_Unassigned");
@@ -577,47 +592,51 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.UndetectedPages)]
+        [HttpGet]
         public virtual ActionResult ImporterUndetectedFile(string id, bool? Source, bool? Thumbnail)
         {
-            if (!string.IsNullOrEmpty(id))
+            if (!Regex.IsMatch(id, @"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}_\d+$"))
+                return BadRequest("Invalid page identifier");
+
+            var undetectedLocation = DataStore.CreateLocation(Database, "DocumentDropBox_Unassigned");
+            if (Source.HasValue && Source.Value)
             {
-                var undetectedLocation = DataStore.CreateLocation(Database, "DocumentDropBox_Unassigned");
-                if (Source.HasValue && Source.Value)
+                var filename = Path.Combine(undetectedLocation, $"{id}.pdf");
+                if (System.IO.File.Exists(filename))
+                    return File(filename, DocumentTemplate.PdfMimeType);
+                else
+                    return HttpNotFound();
+            }
+            else
+            {
+                if (Thumbnail.HasValue && Thumbnail.Value)
                 {
-                    var filename = Path.Combine(undetectedLocation, string.Concat(id, ".pdf"));
+                    var filename = Path.Combine(undetectedLocation, $"{id}_thumbnail.png");
                     if (System.IO.File.Exists(filename))
-                        return File(filename, DocumentTemplate.PdfMimeType);
+                        return File(filename, "image/png");
                     else
-                        return HttpNotFound();
+                        return File(Links.ClientSource.Style.Images.Status.fileBroken256_png, "image/png");
                 }
                 else
                 {
-                    if (Thumbnail.HasValue && Thumbnail.Value)
-                    {
-                        var filename = Path.Combine(undetectedLocation, string.Concat(id, "_thumbnail.png"));
-                        if (System.IO.File.Exists(filename))
-                            return File(filename, "image/png");
-                        else
-                            return File(Links.ClientSource.Style.Images.Status.fileBroken256_png, "image/png");
-                    }
+                    var filename = Path.Combine(undetectedLocation, $"{id}.jpg");
+                    if (System.IO.File.Exists(filename))
+                        return File(filename, "image/jpeg");
                     else
-                    {
-                        var filename = Path.Combine(undetectedLocation, string.Concat(id, ".jpg"));
-                        if (System.IO.File.Exists(filename))
-                            return File(filename, "image/jpeg");
-                        else
-                            return File(Links.ClientSource.Style.Images.Status.fileBroken256_png, "image/png");
-                    }
+                        return File(Links.ClientSource.Style.Images.Status.fileBroken256_png, "image/png");
                 }
             }
-            return HttpNotFound();
         }
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.UndetectedPages)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult ImporterUndetectedAssign(string id, string DocumentTemplateId, string DataId)
         {
+            if (!Regex.IsMatch(id, @"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}_\d+$"))
+                return BadRequest("Invalid page identifier");
+
             var undetectedLocation = DataStore.CreateLocation(Database, "DocumentDropBox_Unassigned");
-            var filename = Path.Combine(undetectedLocation, string.Concat(id, ".pdf"));
+            var filename = Path.Combine(undetectedLocation, $"{id}.pdf");
             var identifier = DocumentUniqueIdentifier.Create(Database, DocumentTemplateId, DataId, UserService.CurrentUser.UserId, DateTime.Now, 0);
 
             if (Disco.Services.Documents.AttachmentImport.Importer.ImportPdfAttachment(identifier, Database, filename) != null)
@@ -626,48 +645,53 @@ namespace Disco.Web.Areas.API.Controllers
                 System.IO.File.Delete(filename);
 
                 // Delete Thumbnail/Preview
-                var thumbnailFilename = Path.Combine(undetectedLocation, string.Concat(id, "_thumbnail.png"));
+                var thumbnailFilename = Path.Combine(undetectedLocation, $"{id}_thumbnail.png");
                 if (System.IO.File.Exists(thumbnailFilename))
                     System.IO.File.Delete(thumbnailFilename);
-                var previewFilename = Path.Combine(undetectedLocation, string.Concat(id, ".jpg"));
+                var previewFilename = Path.Combine(undetectedLocation, $"{id}.jpg");
                 if (System.IO.File.Exists(previewFilename))
                     System.IO.File.Delete(previewFilename);
 
-                return Json("OK");
+                return Ok();
             }
             else
             {
-                return Json("Unable to Import File with the supplied parameters");
+                return BadRequest("Unable to Import File with the supplied parameters");
             }
         }
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.UndetectedPages)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult ImporterUndetectedDelete(string id)
         {
+            if (!Regex.IsMatch(id, @"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}_\d+$"))
+                return BadRequest("Invalid page identifier");
+
             var undetectedLocation = DataStore.CreateLocation(Database, "DocumentDropBox_Unassigned");
-            var filename = Path.Combine(undetectedLocation, string.Concat(id, ".pdf"));
+            var filename = Path.Combine(undetectedLocation, $"{id}.pdf");
             if (System.IO.File.Exists(filename))
             {
                 // Delete File
                 System.IO.File.Delete(filename);
 
                 // Delete Thumbnail/Preview
-                var thumbnailFilename = Path.Combine(undetectedLocation, string.Concat(id, "_thumbnail.png"));
+                var thumbnailFilename = Path.Combine(undetectedLocation, $"{id}_thumbnail.png");
                 if (System.IO.File.Exists(thumbnailFilename))
                     System.IO.File.Delete(thumbnailFilename);
-                var previewFilename = Path.Combine(undetectedLocation, string.Concat(id, ".jpg"));
+                var previewFilename = Path.Combine(undetectedLocation, $"{id}.jpg");
                 if (System.IO.File.Exists(previewFilename))
                     System.IO.File.Delete(previewFilename);
 
-                return Json("OK");
+                return Ok();
             }
             else
             {
-                return Json("File Not Found");
+                return BadRequest("File Not Found");
             }
         }
 
         [DiscoAuthorizeAll(Claims.Config.DeviceModel.Show, Claims.Config.DocumentTemplate.BulkGenerate)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult BulkGenerateDeviceModel(string id, int deviceGroupId)
         {
             var template = Database.DocumentTemplates.FirstOrDefault(t => t.Id == id);
@@ -701,6 +725,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorizeAll(Claims.Config.DeviceProfile.Show, Claims.Config.DocumentTemplate.BulkGenerate)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult BulkGenerateDeviceProfile(string id, int deviceGroupId)
         {
             var template = Database.DocumentTemplates.FirstOrDefault(t => t.Id == id);
@@ -734,6 +759,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorizeAll(Claims.Config.DeviceBatch.Show, Claims.Config.DocumentTemplate.BulkGenerate)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult BulkGenerateDeviceBatch(string id, int deviceGroupId)
         {
             var template = Database.DocumentTemplates.FirstOrDefault(t => t.Id == id);
@@ -767,11 +793,12 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.BulkGenerate)]
-        public virtual ActionResult BulkGenerate(string id, string DataIds = null, bool InsertBlankPage = false)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult BulkGenerate(string id, string dataIds = null, bool insertBlankPage = false)
         {
             if (string.IsNullOrEmpty(id))
                 throw new ArgumentNullException("id");
-            if (string.IsNullOrEmpty(DataIds))
+            if (string.IsNullOrEmpty(dataIds))
                 throw new ArgumentNullException("DataIds");
             var documentTemplate = Database.DocumentTemplates.Find(id);
             if (documentTemplate == null)
@@ -792,35 +819,34 @@ namespace Disco.Web.Areas.API.Controllers
                     throw new InvalidOperationException("Unknown DocumentType Scope");
             }
 
-            var dataIds = DataIds.Split(new string[] { Environment.NewLine, ",", ";" }, StringSplitOptions.RemoveEmptyEntries).Select(d => d.Trim()).Where(d => !string.IsNullOrEmpty(d)).ToList();
+            var ids = dataIds.Split(new string[] { Environment.NewLine, ",", ";" }, StringSplitOptions.RemoveEmptyEntries).Select(d => d.Trim()).Where(d => !string.IsNullOrEmpty(d)).ToList();
             var timeStamp = DateTime.Now;
 
-            var taskStatus = DocumentBulkGenerateTask.ScheduleNow(BI.Interop.Pdf.PdfGenerator.GenerateBulkFromTemplate, documentTemplate, UserService.CurrentUser, timeStamp, InsertBlankPage, dataIds);
+            var taskStatus = DocumentBulkGenerateTask.ScheduleNow(BI.Interop.Pdf.PdfGenerator.GenerateBulkFromTemplate, documentTemplate, UserService.CurrentUser, timeStamp, insertBlankPage, ids);
 
             var fileName = $"{documentTemplate.Id}_Bulk_{timeStamp:yyyyMMdd-HHmmss}.pdf";
-            taskStatus.SetFinishedUrl(Url.Action(MVC.Config.DocumentTemplate.Index(documentTemplate.Id, taskStatus.SessionId, fileName)));
+            taskStatus.SetFinishedUrl(Url.Action(MVC.Config.DocumentTemplate.Index(documentTemplate.Id, Guid.Parse(taskStatus.SessionId), fileName)));
 
             if (!taskStatus.WaitUntilFinished(TimeSpan.FromSeconds(1)))
                 return RedirectToAction(MVC.Config.Logging.TaskStatus(taskStatus.SessionId));
 
-            var stream = DocumentBulkGenerateTask.GetCached(Database, taskStatus.SessionId);
+            var stream = DocumentBulkGenerateTask.GetCached(Database, Guid.Parse(taskStatus.SessionId));
             return File(stream, "application/pdf", fileName);
         }
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.BulkGenerate)]
-        public virtual ActionResult BulkGenerateDownload(string id, string fileName)
+        public virtual ActionResult BulkGenerateDownload(Guid id, string fileName)
         {
             var stream = DocumentBulkGenerateTask.GetCached(Database, id);
             return File(stream, "application/pdf", fileName);
         }
 
-
         [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.BulkGenerate, Claims.User.Actions.GenerateDocuments)]
         [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult BulkGenerateAddUsers(string userIds)
         {
             if (string.IsNullOrWhiteSpace(userIds))
-                return new HttpStatusCodeResult(HttpStatusCode.BadRequest);
+                return BadRequest();
 
             var dataIds = userIds.Split(new string[] { Environment.NewLine, ",", ";" }, StringSplitOptions.RemoveEmptyEntries).Select(d => d.Trim()).Where(d => !string.IsNullOrEmpty(d)).ToList();
             var results = new List<BulkGenerateUserModel>(dataIds.Count);
@@ -893,7 +919,7 @@ namespace Disco.Web.Areas.API.Controllers
         public virtual ActionResult BulkGenerateAddGroupMembers(string groupId)
         {
             if (string.IsNullOrWhiteSpace(groupId))
-                return new HttpStatusCodeResult(HttpStatusCode.BadRequest);
+                return BadRequest();
 
             var results = new List<BulkGenerateUserModel>();
             var accountId = ActiveDirectory.ParseDomainAccountId(groupId);
@@ -954,7 +980,7 @@ namespace Disco.Web.Areas.API.Controllers
         public virtual ActionResult BulkGenerateAddUserFlag(int flagId)
         {
             if (flagId <= 0)
-                return new HttpStatusCodeResult(HttpStatusCode.BadRequest);
+                return BadRequest();
 
             var results = new List<BulkGenerateUserModel>();
 
@@ -1008,7 +1034,7 @@ namespace Disco.Web.Areas.API.Controllers
         public virtual ActionResult BulkGenerateAddDeviceProfile(int deviceProfileId)
         {
             if (deviceProfileId <= 0)
-                return new HttpStatusCodeResult(HttpStatusCode.BadRequest);
+                return BadRequest();
 
             var results = new List<BulkGenerateUserModel>();
 
@@ -1062,7 +1088,7 @@ namespace Disco.Web.Areas.API.Controllers
         public virtual ActionResult BulkGenerateAddDeviceBatch(int deviceBatchId)
         {
             if (deviceBatchId <= 0)
-                return new HttpStatusCodeResult(HttpStatusCode.BadRequest);
+                return BadRequest();
 
             var results = new List<BulkGenerateUserModel>();
 
@@ -1116,7 +1142,7 @@ namespace Disco.Web.Areas.API.Controllers
         public virtual ActionResult BulkGenerateAddDocumentAttachment(string documentTemplateId, DateTime? threshold)
         {
             if (string.IsNullOrWhiteSpace(documentTemplateId))
-                return new HttpStatusCodeResult(HttpStatusCode.BadRequest);
+                return BadRequest();
 
             var results = new List<BulkGenerateUserModel>();
 
@@ -1229,7 +1255,7 @@ namespace Disco.Web.Areas.API.Controllers
         public virtual ActionResult BulkGenerateGetUserDetailValues(string key)
         {
             if (string.IsNullOrWhiteSpace(key))
-                return new HttpStatusCodeResult(HttpStatusCode.BadRequest);
+                return BadRequest();
 
             var results = Database.UserDetails.Where(d => d.Scope == "Details" && d.Key == key).Select(d => d.Value).Distinct().ToList();
 
@@ -1241,7 +1267,7 @@ namespace Disco.Web.Areas.API.Controllers
         public virtual ActionResult BulkGenerateAddUserDetail(string key, string value)
         {
             if (string.IsNullOrWhiteSpace(key))
-                return new HttpStatusCodeResult(HttpStatusCode.BadRequest);
+                return BadRequest();
 
             var results = new List<BulkGenerateUserModel>();
 
@@ -1279,9 +1305,10 @@ namespace Disco.Web.Areas.API.Controllers
             return Json(results);
         }
 
-        public virtual ActionResult Generate(string id, string TargetId)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult Generate(string id, string targetId)
         {
-            Disco.Services.DocumentTemplateExtensions.GetTemplateAndTarget(Database, Authorization, id, TargetId, out var template, out var target, out _);
+            Disco.Services.DocumentTemplateExtensions.GetTemplateAndTarget(Database, Authorization, id, targetId, out var template, out var target, out _);
 
             // generate document
             var timestamp = DateTime.Now;
@@ -1296,6 +1323,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Delete)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Delete(string id, bool? redirect = false)
         {
             try
@@ -1308,7 +1336,7 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect.HasValue && redirect.Value)
                         return RedirectToAction(MVC.Config.DocumentTemplate.Index(null));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 throw new Exception("Invalid Document Template Id");
             }
@@ -1317,12 +1345,12 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
-        [HttpPost, ValidateAntiForgeryToken]
         [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.Configure, Claims.Config.UserFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult RemoveOnImportUserFlagRule([Required] string id, Guid? ruleId = null)
         {
             try
@@ -1334,16 +1362,16 @@ namespace Disco.Web.Areas.API.Controllers
 
                 template.RemoveOnImportUserFlagRule(Database, ruleId.Value);
 
-                return new HttpStatusCodeResult(HttpStatusCode.OK);
+                return Ok();
             }
             catch (Exception ex)
             {
-                return new HttpStatusCodeResult(HttpStatusCode.BadRequest, ex.Message);
+                return BadRequest(ex.Message);
             }
         }
 
-        [HttpPost, ValidateAntiForgeryToken]
         [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.Configure, Claims.Config.UserFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult AddOnImportUserFlagRule([Required] string id, bool? addFlag = null, int? userFlagId = null, string comments = null)
         {
             try
@@ -1379,14 +1407,14 @@ namespace Disco.Web.Areas.API.Controllers
             }
             catch (Exception ex)
             {
-                return new HttpStatusCodeResult(HttpStatusCode.BadRequest, ex.Message);
+                return BadRequest(ex.Message);
             }
         }
 
         #endregion
 
         #region Handlers
-        [HttpPost]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult GenerateDocumentHandlerUi(string templateId, string targetId, string handlerId)
         {
             Disco.Services.DocumentTemplateExtensions.GetTemplateAndTarget(Database, Authorization, templateId, targetId, out var template, out var target, out var targetUser);
@@ -1403,15 +1431,13 @@ namespace Disco.Web.Areas.API.Controllers
                 if (handlerPartialView == null)
                     throw new NotSupportedException("Handler does not have a Generation Options UI");
 
-
-
                 var model = handler.GetGenerationOptionsUiModel(template, target, targetUser, CurrentUser);
 
                 return this.PrecompiledPartialView(handlerPartialView, model);
             }
         }
 
-        [HttpPost]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult DocumentHandlers(string templateId, string targetId)
         {
             Disco.Services.DocumentTemplateExtensions.GetTemplateAndTarget(Database, Authorization, templateId, targetId, out var template, out var target, out _);

Disco.Web/Areas/API/Controllers/DocumentTemplatePackageController.cs

@@ -24,6 +24,7 @@ namespace Disco.Web.Areas.API.Controllers
         const string pInsertBlankPages = "insertblankpages";
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(string id, string key, string value = null, bool redirect = false)
         {
             try
@@ -69,24 +70,26 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect)
                     return RedirectToAction(MVC.Config.DocumentTemplate.ShowPackage(package.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         #region Update Shortcut Methods
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDescription(string id, string Description = null, bool redirect = false)
         {
             return Update(id, pDescription, Description, redirect);
         }
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDocumentTemplates(string id, List<string> DocumentTemplates = null, bool redirect = false)
         {
             try
@@ -104,43 +107,49 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect)
                     return RedirectToAction(MVC.Config.DocumentTemplate.ShowPackage(package.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
 
         }
         [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.Configure, Claims.Config.DocumentTemplate.ConfigureFilterExpression)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateFilterExpression(string id, string FilterExpression = null, bool redirect = false)
         {
             return Update(id, pFilterExpression, FilterExpression, redirect);
         }
         [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.Configure, Claims.Config.DocumentTemplate.ConfigureFilterExpression)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateOnGenerateExpression(string id, string OnGenerateExpression = null, bool redirect = false)
         {
             return Update(id, pOnGenerateExpression, OnGenerateExpression, redirect);
         }
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateIsHidden(string id, string IsHidden = null, bool redirect = false)
         {
             return Update(id, pIsHidden, IsHidden, redirect);
         }
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsertBlankPages(string id, string InsertBlankPages = null, bool redirect = false)
         {
             return Update(id, pInsertBlankPages, InsertBlankPages, redirect);
         }
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateScope(string id, string Scope = null, bool redirect = false)
         {
             return Update(id, pScope, Scope, redirect);
         }
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateJobSubTypes(string id, List<string> JobSubTypes = null, bool redirect = false)
         {
             try
@@ -158,32 +167,31 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect)
                     return RedirectToAction(MVC.Config.DocumentTemplate.ShowPackage(package.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
 
         }
         #endregion
 
         #region Update Properties
-        private void UpdateDescription(DocumentTemplatePackage Package, string Description)
+        private void UpdateDescription(DocumentTemplatePackage Package, string description)
         {
-            if (!string.IsNullOrWhiteSpace(Description))
+            if (string.IsNullOrWhiteSpace(description))
+                throw new Exception("Invalid Description");
+
+            description = description.Trim();
+            if (Package.Description != description)
             {
-                var description = Description.Trim();
-                if (Package.Description != description)
-                {
-                    Package.Description = description;
-                    DocumentTemplatePackages.UpdatePackage(Package);
-                }
+                Package.Description = description;
+                DocumentTemplatePackages.UpdatePackage(Package);
             }
-            throw new Exception("Invalid Description");
         }
         private void UpdateDocumentTemplates(DocumentTemplatePackage Package, List<string> DocumentTemplates)
         {
@@ -349,12 +357,13 @@ namespace Disco.Web.Areas.API.Controllers
         #region Actions
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.BulkGenerate)]
-        public virtual ActionResult BulkGenerate(string id, string DataIds = null, bool InsertBlankPage = false)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult BulkGenerate(string id, string dataIds = null)
         {
             if (string.IsNullOrEmpty(id))
                 throw new ArgumentNullException(nameof(id));
-            if (string.IsNullOrEmpty(DataIds))
-                throw new ArgumentNullException(nameof(DataIds));
+            if (string.IsNullOrEmpty(dataIds))
+                throw new ArgumentNullException(nameof(dataIds));
 
             var package = DocumentTemplatePackages.GetPackage(id);
 
@@ -376,19 +385,20 @@ namespace Disco.Web.Areas.API.Controllers
                     throw new InvalidOperationException("Unknown DocumentType Scope");
             }
 
-            var dataIds = DataIds.Split(new string[] { Environment.NewLine, ",", ";" }, StringSplitOptions.RemoveEmptyEntries).Select(d => d.Trim()).Where(d => !string.IsNullOrEmpty(d)).ToList();
+            var ids = dataIds.Split(new string[] { Environment.NewLine, ",", ";" }, StringSplitOptions.RemoveEmptyEntries).Select(d => d.Trim()).Where(d => !string.IsNullOrEmpty(d)).ToList();
             var timeStamp = DateTime.Now;
-            var pdf = package.GeneratePdfPackageBulk(Database, UserService.CurrentUser, timeStamp, InsertBlankPage, dataIds);
+            var pdf = package.GeneratePdfPackageBulk(Database, UserService.CurrentUser, timeStamp, null, ids);
 
             return File(pdf, "application/pdf", $"{package.Id}_Bulk_{timeStamp:yyyyMMdd-HHmmss}.pdf");
         }
 
-        public virtual ActionResult Generate(string id, string TargetId)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult Generate(string id, string targetId)
         {
             if (string.IsNullOrWhiteSpace(id))
                 throw new ArgumentNullException(nameof(id));
-            if (string.IsNullOrWhiteSpace(TargetId))
-                throw new ArgumentNullException(nameof(TargetId));
+            if (string.IsNullOrWhiteSpace(targetId))
+                throw new ArgumentNullException(nameof(targetId));
 
             var package = DocumentTemplatePackages.GetPackage(id);
             if (package == null)
@@ -410,9 +420,9 @@ namespace Disco.Web.Areas.API.Controllers
             }
 
             // resolve target
-            var target = package.ResolveScopeTarget(Database, TargetId);
+            var target = package.ResolveScopeTarget(Database, targetId);
             if (target == null)
-                throw new ArgumentException("Target not found", nameof(TargetId));
+                throw new ArgumentException("Target not found", nameof(targetId));
 
             var timestamp = DateTime.Now;
             var document = default(Stream);
@@ -426,6 +436,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Delete)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Delete(string id, bool? redirect = false)
         {
             try
@@ -445,7 +456,7 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect.HasValue && redirect.Value)
                         return RedirectToAction(MVC.Config.DocumentTemplate.Index(null));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 throw new Exception("Invalid Document Template Package Id");
             }
@@ -454,7 +465,7 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 

Disco.Web/Areas/API/Controllers/EnrolmentController.cs

@@ -8,9 +8,8 @@ namespace Disco.Web.Areas.API.Controllers
 {
     public partial class EnrolmentController : AuthorizedDatabaseController
     {
-        [HttpPost]
-        [ValidateAntiForgeryToken]
         [DiscoAuthorize(Claims.Device.Actions.EnrolDevices)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult ResolveSessionPending(string sessionId, bool approve, int? deviceProfileId, int? deviceBatchId, string reason)
         {
             if (approve && deviceProfileId == null)
@@ -18,11 +17,11 @@ namespace Disco.Web.Areas.API.Controllers
 
             WindowsDeviceEnrolment.ResolvePendingEnrolment(sessionId, approve, CurrentUser.UserId, deviceProfileId, deviceBatchId, reason);
 
-            return new HttpStatusCodeResult(200);
+            return Ok();
         }
 
-        [HttpPost]
         [DiscoAuthorize(Claims.Config.Enrolment.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult PendingTimeoutMinutes(int PendingTimeoutMinutes)
         {
             try
@@ -31,7 +30,7 @@ namespace Disco.Web.Areas.API.Controllers
                 {
                     Database.DiscoConfiguration.Bootstrapper.PendingTimeout = TimeSpan.FromMinutes(PendingTimeoutMinutes);
                     Database.SaveChanges();
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
                 }
                 else
                 {
@@ -40,7 +39,53 @@ namespace Disco.Web.Areas.API.Controllers
             }
             catch (Exception ex)
             {
-                return Json($"Error: {ex.Message}");
+                return BadRequest(ex.Message);
+            }
+        }
+
+        [DiscoAuthorize(Claims.Config.Enrolment.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult MacSshUsername(string MacSshUsername)
+        {
+            try
+            {
+                if (!string.IsNullOrWhiteSpace(MacSshUsername))
+                {
+                    Database.DiscoConfiguration.Bootstrapper.MacSshUsername = MacSshUsername;
+                    Database.SaveChanges();
+                    return Ok();
+                }
+                else
+                {
+                    throw new Exception("The Username cannot be null or empty");
+                }
+            }
+            catch (Exception ex)
+            {
+                return BadRequest(ex.Message);
+            }
+        }
+
+        [DiscoAuthorize(Claims.Config.Enrolment.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult MacSshPassword(string MacSshPassword)
+        {
+            try
+            {
+                if (!string.IsNullOrWhiteSpace(MacSshPassword))
+                {
+                    Database.DiscoConfiguration.Bootstrapper.MacSshPassword = MacSshPassword;
+                    Database.SaveChanges();
+                    return Ok();
+                }
+                else
+                {
+                    throw new Exception("The Password cannot be null or empty");
+                }
+            }
+            catch (Exception ex)
+            {
+                return BadRequest(ex.Message);
             }
         }
     }

Disco.Web/Areas/API/Controllers/ExportController.cs

@@ -33,7 +33,7 @@ namespace Disco.Web.Areas.API.Controllers
             {
                 var errorState = ModelState.First(m => m.Value.Errors.Any());
                 var error = errorState.Value.Errors.First();
-                return new HttpStatusCodeResult(400, $"{errorState.Key}: {error.Exception?.Message ?? error.ErrorMessage}");
+                return BadRequest($"{errorState.Key}: {error.Exception?.Message ?? error.ErrorMessage}");
             }
 
             SavedExports.UpdateSavedExport(Database, model.ToSavedExport());

Disco.Web/Areas/API/Controllers/ExpressionsController.cs

@@ -20,7 +20,7 @@ namespace Disco.Web.Areas.API.Controllers
         public virtual ActionResult TypeDescriptor(string type, bool staticMembersOnly = false)
         {
             if (string.IsNullOrWhiteSpace(type))
-                return new HttpStatusCodeResult(400, "Type is required");
+                return BadRequest("Type is required");
 
             var t = Type.GetType(type, false);
 
@@ -28,15 +28,15 @@ namespace Disco.Web.Areas.API.Controllers
             {
                 var typeNameParts = type.Split(new string[] { ", " }, StringSplitOptions.None);
                 if (typeNameParts.Length < 2)
-                    return Json("Invalid Type Specified");
+                    return BadRequest("Invalid Type Specified");
 
                 if (!ExpressionExtensionProviderFeature.TryGetExtensionAssembly(typeNameParts[1], out var assembly))
-                    return Json("Invalid Type Specified");
+                    return BadRequest("Invalid Type Specified");
 
                 t = assembly.GetType(typeNameParts[0]);
 
                 if (t == null)
-                    return Json("Invalid Type Specified");
+                    return BadRequest("Invalid Type Specified");
             }
 
             return Json(ExpressionTypeDescriptor.Build(t, staticMembersOnly));

Disco.Web/Areas/API/Controllers/JobController.cs

@@ -78,6 +78,7 @@ namespace Disco.Web.Areas.API.Controllers
 
         #endregion
 
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(int id, string key, string value = null, bool? redirect = null)
         {
             try
@@ -287,7 +288,6 @@ namespace Disco.Web.Areas.API.Controllers
                 }
                 if (redirect.HasValue && redirect.Value)
                     return this.RedirectToAction(MVC.Job.Show(job.Id), resultUrlFragment);
-                //return RedirectToAction(MVC.Job.Show(job.Id));
                 else
                 {
                     if (resultData != null)
@@ -296,7 +296,7 @@ namespace Disco.Web.Areas.API.Controllers
                     }
                     else
                     {
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                     }
                 }
             }
@@ -305,22 +305,25 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         #region Update Shortcut Methods
         [DiscoAuthorize(Claims.Job.Properties.ExpectedClosedDate)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateExpectedClosedDate(int id, string ExpectedClosedDate, bool? redirect = null)
         {
             return Update(id, pExpectedClosedDate, ExpectedClosedDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.DeviceHeldLocation)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDeviceHeldLocation(int id, string DeviceHeldLocation, bool? redirect = null)
         {
             return Update(id, pDeviceHeldLocation, DeviceHeldLocation, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.Flags)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateFlags(int id, string Flags, bool? redirect = null)
         {
             return Update(id, pFlags, Flags, redirect);
@@ -328,61 +331,73 @@ namespace Disco.Web.Areas.API.Controllers
 
         #region NonWarranty
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.AccountingChargeRequired)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateNonWarrantyAccountingChargeRequired(int id, string AccountingChargeRequiredDate, bool? redirect = null)
         {
             return Update(id, pNonWarrantyAccountingChargeRequired, AccountingChargeRequiredDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.AccountingChargeAdded)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateNonWarrantyAccountingChargeAdded(int id, string AccountingChargeAddedDate, bool? redirect = null)
         {
             return Update(id, pNonWarrantyAccountingChargeAdded, AccountingChargeAddedDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.AccountingChargePaid)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateNonWarrantyAccountingChargePaid(int id, string AccountingChargePaidDate, bool? redirect = null)
         {
             return Update(id, pNonWarrantyAccountingChargePaid, AccountingChargePaidDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.PurchaseOrderRaised)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateNonWarrantyPurchaseOrderRaised(int id, string PurchaseOrderRaisedDate, bool? redirect = null)
         {
             return Update(id, pNonWarrantyPurchaseOrderRaised, PurchaseOrderRaisedDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.PurchaseOrderReference)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateNonWarrantyPurchaseOrderReference(int id, string PurchaseOrderReference, bool? redirect = null)
         {
             return Update(id, pNonWarrantyPurchaseOrderReference, PurchaseOrderReference, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.PurchaseOrderSent)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateNonWarrantyPurchaseOrderSent(int id, string PurchaseOrderSentDate, bool? redirect = null)
         {
             return Update(id, pNonWarrantyPurchaseOrderSent, PurchaseOrderSentDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InvoiceReceived)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateNonWarrantyInvoiceReceived(int id, string InvoiceReceivedDate, bool? redirect = null)
         {
             return Update(id, pNonWarrantyInvoiceReceived, InvoiceReceivedDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.RepairerName)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateNonWarrantyRepairerName(int id, string RepairerName, bool? redirect = null)
         {
             return Update(id, pNonWarrantyRepairerName, RepairerName, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.RepairerLoggedDate)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateNonWarrantyRepairerLoggedDate(int id, string RepairerLoggedDate, bool? redirect = null)
         {
             return Update(id, pNonWarrantyRepairerLoggedDate, RepairerLoggedDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.RepairerReference)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateNonWarrantyRepairerReference(int id, string RepairerReference, bool? redirect = null)
         {
             return Update(id, pNonWarrantyRepairerReference, RepairerReference, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.RepairerCompletedDate)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateNonWarrantyRepairerCompletedDate(int id, string RepairerCompletedDate, bool? redirect = null)
         {
             return Update(id, pNonWarrantyRepairerCompletedDate, RepairerCompletedDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.IsInsuranceClaim)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateNonWarrantyIsInsuranceClaim(int id, bool IsInsuranceClaim, bool? redirect = null)
         {
             return Update(id, pNonWarrantyIsInsuranceClaim, IsInsuranceClaim.ToString(), redirect);
@@ -392,91 +407,109 @@ namespace Disco.Web.Areas.API.Controllers
         #region Insurance
 
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceLossOrDamageDate(int id, string LossOrDamageDate, bool? redirect = null)
         {
             return Update(id, pInsuranceLossOrDamageDate, LossOrDamageDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceEventLocation(int id, string EventLocation, bool? redirect = null)
         {
             return Update(id, pInsuranceEventLocation, EventLocation, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceDescription(int id, string Description, bool? redirect = null)
         {
             return Update(id, pInsuranceDescription, Description, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceThirdPartyCaused(int id, string ThirdPartyCaused, bool? redirect = null)
         {
             return Update(id, pInsuranceThirdPartyCaused, ThirdPartyCaused, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceThirdPartyCausedName(int id, string ThirdPartyCausedName, bool? redirect = null)
         {
             return Update(id, pInsuranceThirdPartyCausedName, ThirdPartyCausedName, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceThirdPartyCausedWhy(int id, string ThirdPartyCausedWhy, bool? redirect = null)
         {
             return Update(id, pInsuranceThirdPartyCausedWhy, ThirdPartyCausedWhy, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceWitnessesNamesAddresses(int id, string WitnessesNamesAddresses, bool? redirect = null)
         {
             return Update(id, pInsuranceWitnessesNamesAddresses, WitnessesNamesAddresses, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceBurglaryTheftMethodOfEntry(int id, string BurglaryTheftMethodOfEntry, bool? redirect = null)
         {
             return Update(id, pInsuranceBurglaryTheftMethodOfEntry, BurglaryTheftMethodOfEntry, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsurancePropertyLastSeenDate(int id, string PropertyLastSeenDate, bool? redirect = null)
         {
             return Update(id, pInsurancePropertyLastSeenDate, PropertyLastSeenDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsurancePoliceNotified(int id, string PoliceNotified, bool? redirect = null)
         {
             return Update(id, pInsurancePoliceNotified, PoliceNotified, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsurancePoliceNotifiedStation(int id, string PoliceNotifiedStation, bool? redirect = null)
         {
             return Update(id, pInsurancePoliceNotifiedStation, PoliceNotifiedStation, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsurancePoliceNotifiedDate(int id, string PoliceNotifiedDate, bool? redirect = null)
         {
             return Update(id, pInsurancePoliceNotifiedDate, PoliceNotifiedDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsurancePoliceNotifiedCrimeReportNo(int id, string PoliceNotifiedCrimeReportNo, bool? redirect = null)
         {
             return Update(id, pInsurancePoliceNotifiedCrimeReportNo, PoliceNotifiedCrimeReportNo, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceRecoverReduceAction(int id, string RecoverReduceAction, bool? redirect = null)
         {
             return Update(id, pInsuranceRecoverReduceAction, RecoverReduceAction, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceOtherInterestedParties(int id, string OtherInterestedParties, bool? redirect = null)
         {
             return Update(id, pInsuranceOtherInterestedParties, OtherInterestedParties, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceDateOfPurchase(int id, string DateOfPurchase, bool? redirect = null)
         {
             return Update(id, pInsuranceDateOfPurchase, DateOfPurchase, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceClaimFormSent)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceClaimFormSentDate(int id, string ClaimFormSentDate, bool? redirect = null)
         {
             return Update(id, pInsuranceClaimFormSentDate, ClaimFormSentDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceClaimFormSent)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceClaimFormSentUserId(int id, string ClaimFormSentUserId, bool? redirect = null)
         {
             return Update(id, pInsuranceClaimFormSentUserId, ClaimFormSentUserId, redirect);
@@ -486,21 +519,25 @@ namespace Disco.Web.Areas.API.Controllers
 
         #region Warranty
         [DiscoAuthorize(Claims.Job.Properties.WarrantyProperties.ExternalName)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateWarrantyExternalName(int id, string ExternalName, bool? redirect = null)
         {
             return Update(id, pWarrantyExternalName, ExternalName, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.WarrantyProperties.ExternalLoggedDate)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateWarrantyExternalLoggedDate(int id, string ExternalLoggedDate, bool? redirect = null)
         {
             return Update(id, pWarrantyExternalLoggedDate, ExternalLoggedDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.WarrantyProperties.ExternalReference)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateWarrantyExternalReference(int id, string ExternalReference, bool? redirect = null)
         {
             return Update(id, pWarrantyExternalReference, ExternalReference, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.WarrantyProperties.ExternalCompletedDate)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateWarrantyExternalCompletedDate(int id, string ExternalCompletedDate, bool? redirect = null)
         {
             return Update(id, pWarrantyExternalCompletedDate, ExternalCompletedDate, redirect);
@@ -1424,6 +1461,7 @@ namespace Disco.Web.Areas.API.Controllers
         #region Job Actions
 
         [DiscoAuthorize(Claims.Job.Actions.UpdateSubTypes)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateSubTypes(int id, List<string> SubTypes = null, bool? AddComponents = null, bool? redirect = null)
         {
             try
@@ -1448,18 +1486,19 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     return RedirectToAction(MVC.Job.Show(job.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         [DiscoAuthorize(Claims.Job.Properties.Flags)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateFlag(int id, long? Flag, string Reason, bool? redirect = null)
         {
             try
@@ -1508,7 +1547,7 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect.HasValue && redirect.Value)
                         return RedirectToAction(MVC.Job.Show(job.Id));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 else
                 {
@@ -1520,11 +1559,12 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         [DiscoAuthorize(Claims.Job.Properties.WaitingForUserAction)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult WaitingForUserAction(int id, string Reason, bool? redirect = null)
         {
             try
@@ -1544,18 +1584,19 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     return RedirectToAction(MVC.Job.Show(job.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         [DiscoAuthorize(Claims.Job.Properties.NotWaitingForUserAction)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult NotWaitingForUserAction(int id, string Resolution, bool? redirect = null)
         {
             try
@@ -1575,18 +1616,19 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     return RedirectToAction(MVC.Job.Show(job.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         [DiscoAuthorize(Claims.Job.Properties.DeviceReadyForReturn)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult DeviceReadyForReturn(int id, bool redirect)
         {
             Database.Configuration.LazyLoadingEnabled = true;
@@ -1601,17 +1643,18 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect)
                         return RedirectToAction(MVC.Job.Show(id));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 else
                 {
-                    return Json("Job's state doesn't allow this action", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Job's state doesn't allow this action");
                 }
             }
-            return Json("Invalid Job Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Job Number");
         }
 
         [DiscoAuthorize(Claims.Job.Properties.DeviceHeld)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult DeviceHeld(int id, bool redirect)
         {
             var j = Database.Jobs.Find(id);
@@ -1625,17 +1668,18 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect)
                         return RedirectToAction(MVC.Job.Show(id));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 else
                 {
-                    return Json("Job's state doesn't allow this action", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Job's state doesn't allow this action");
                 }
             }
-            return Json("Invalid Job Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Job Number");
         }
 
         [DiscoAuthorize(Claims.Job.Properties.DeviceReturned)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult DeviceReturned(int id, bool redirect)
         {
             var j = Database.Jobs.Find(id);
@@ -1649,17 +1693,18 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect)
                         return RedirectToAction(MVC.Job.Show(id));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 else
                 {
-                    return Json("Job's state doesn't allow this action", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Job's state doesn't allow this action");
                 }
             }
-            return Json("Invalid Job Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Job Number");
         }
 
         [DiscoAuthorize(Claims.Job.Actions.ForceClose)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult ForceClose(int id, string Reason, bool? redirect = null)
         {
             var j = Database.Jobs.Find(id);
@@ -1674,17 +1719,18 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect.HasValue && redirect.Value)
                         return RedirectToAction(MVC.Job.Show(id));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 else
                 {
-                    return Json("Job's state doesn't allow this action", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Job's state doesn't allow this action");
                 }
             }
-            return Json("Invalid Job Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Job Number");
         }
 
         [DiscoAuthorize(Claims.Job.Actions.Close)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Close(int id, bool redirect)
         {
             var j = Database.Jobs.Find(id);
@@ -1699,17 +1745,18 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect)
                         return RedirectToAction(MVC.Job.Show(id));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 else
                 {
-                    return Json("Job's state doesn't allow this action", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Job's state doesn't allow this action");
                 }
             }
-            return Json("Invalid Job Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Job Number");
         }
 
         [DiscoAuthorize(Claims.Job.Actions.Reopen)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Reopen(int id, bool redirect)
         {
             var j = Database.Jobs
@@ -1725,17 +1772,18 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect)
                         return RedirectToAction(MVC.Job.Show(id));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 else
                 {
-                    return Json("Job's state doesn't allow this action", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Job's state doesn't allow this action");
                 }
             }
-            return Json("Invalid Job Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Job Number");
         }
 
         [DiscoAuthorize(Claims.Job.Actions.Delete)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Delete(int id, bool redirect)
         {
             var j = Database.Jobs.Find(id);
@@ -1750,17 +1798,18 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect)
                         return RedirectToAction(MVC.Job.Index());
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 else
                 {
-                    return Json("Job's state doesn't allow this action", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Job's state doesn't allow this action");
                 }
             }
-            return Json("Invalid Job Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Job Number");
         }
 
         [DiscoAuthorize(Claims.Job.Actions.ConvertHWarToHNWar)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult ConvertHWarToHNWar(int id, bool redirect)
         {
             var j = Database.Jobs.Find(id);
@@ -1775,14 +1824,14 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect)
                         return RedirectToAction(MVC.Job.Show(j.Id));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 else
                 {
-                    return Json("Job's state doesn't allow this action", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Job's state doesn't allow this action");
                 }
             }
-            return Json("Invalid Job Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Job Number");
         }
 
         #endregion
@@ -1872,7 +1921,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
         #endregion
 
-        #region Job Attachements
+        #region Job Attachments
 
         [DiscoAuthorize(Claims.Job.ShowAttachments), OutputCache(Location = System.Web.UI.OutputCacheLocation.Client, Duration = 172800)]
         public virtual ActionResult AttachmentDownload(int id)
@@ -1907,7 +1956,8 @@ namespace Disco.Web.Areas.API.Controllers
             return HttpNotFound("Invalid Attachment Number");
         }
 
-        [DiscoAuthorize(Claims.Job.Actions.AddAttachments), ValidateAntiForgeryToken]
+        [DiscoAuthorize(Claims.Job.Actions.AddAttachments)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult AttachmentUpload(int id, string comments)
         {
             var j = Database.Jobs.Find(id);
@@ -1987,6 +2037,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorizeAny(Claims.Job.Actions.RemoveAnyAttachments, Claims.Job.Actions.RemoveOwnAttachments)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult AttachmentRemove(int id)
         {
             var ja = Database.JobAttachments.Include("TechUser").Where(m => m.Id == id).FirstOrDefault();
@@ -1999,9 +2050,9 @@ namespace Disco.Web.Areas.API.Controllers
 
                 ja.OnDelete(Database);
                 Database.SaveChanges();
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
             }
-            return Json("Invalid Attachment Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Attachment Number");
         }
 
         [DiscoAuthorize(Claims.Job.Actions.AddAttachments)]
@@ -2028,11 +2079,7 @@ namespace Disco.Web.Areas.API.Controllers
             }
             catch (InvalidOperationException ex)
             {
-                return Json(new
-                {
-                    Success = false,
-                    ErrorMessage = ex.Message,
-                });
+                return BadRequest(ex.Message);
             }
         }
 
@@ -2041,55 +2088,58 @@ namespace Disco.Web.Areas.API.Controllers
         #region Job Components
 
         [DiscoAuthorizeAll(Claims.Job.Properties.NonWarrantyProperties.AddComponents, Claims.Job.Properties.NonWarrantyProperties.EditComponents)]
-        public virtual ActionResult ComponentAdd(int id, string Description, string Cost)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult ComponentAdd(int id, string description, string cost)
         {
             var j = Database.Jobs.Find(id);
             if (j != null)
             {
-                if (string.IsNullOrEmpty(Description))
-                    Description = "?";
-                if (!string.IsNullOrEmpty(Cost) && Cost.Contains("$"))
-                    Cost = Cost.Substring(Cost.IndexOf("$") + 1);
-                decimal.TryParse(Cost, out var cost);
+                if (string.IsNullOrEmpty(description))
+                    description = "?";
+                if (!string.IsNullOrEmpty(cost) && cost.Contains("$"))
+                    cost = cost.Substring(cost.IndexOf("$") + 1);
+                decimal.TryParse(cost, out var costValue);
 
                 var jc = new JobComponent()
                 {
                     JobId = j.Id,
-                    Description = Description,
-                    Cost = cost,
+                    Description = description,
+                    Cost = costValue,
                     TechUserId = CurrentUser.UserId
                 };
                 Database.JobComponents.Add(jc);
                 Database.SaveChanges();
 
-                return Json(new Models.Job.ComponentModel { Result = "OK", Component = Models.Job._ComponentModel.FromJobComponent(jc) }, JsonRequestBehavior.AllowGet);
+                return Json(Models.Job.ComponentModel.FromJobComponent(jc));
             }
-            return Json(new Models.Job.ComponentModel { Result = "Invalid Job Number" }, JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Job Number");
         }
 
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.EditComponents)]
-        public virtual ActionResult ComponentUpdate(int id, string Description, string Cost)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult ComponentUpdate(int id, string description, string cost)
         {
             var jc = Database.JobComponents.Find(id);
             if (jc != null)
             {
 
-                if (string.IsNullOrEmpty(Description))
-                    Description = "?";
-                if (!string.IsNullOrEmpty(Cost) && Cost.Contains("$"))
-                    Cost = Cost.Substring(Cost.IndexOf("$") + 1);
-                decimal.TryParse(Cost, out var cost);
+                if (string.IsNullOrEmpty(description))
+                    description = "?";
+                if (!string.IsNullOrEmpty(cost) && cost.Contains("$"))
+                    cost = cost.Substring(cost.IndexOf("$") + 1);
+                decimal.TryParse(cost, out var costValue);
 
-                jc.Description = Description;
-                jc.Cost = cost;
+                jc.Description = description;
+                jc.Cost = costValue;
                 Database.SaveChanges();
 
-                return Json(new Models.Job.ComponentModel { Result = "OK", Component = Models.Job._ComponentModel.FromJobComponent(jc) }, JsonRequestBehavior.AllowGet);
+                return Json(Models.Job.ComponentModel.FromJobComponent(jc));
             }
-            return Json(new Models.Job.ComponentModel { Result = "Invalid Job Component Number" }, JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Job Component Number");
         }
 
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.EditComponents)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult ComponentRemove(int id)
         {
             var jc = Database.JobComponents.Find(id);
@@ -2097,9 +2147,9 @@ namespace Disco.Web.Areas.API.Controllers
             {
                 Database.JobComponents.Remove(jc);
                 Database.SaveChanges();
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
             }
-            return Json("Invalid Job Component Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Job Component Number");
         }
 
         #endregion
@@ -2116,30 +2166,6 @@ namespace Disco.Web.Areas.API.Controllers
 
         #endregion
 
-        [DiscoAuthorize(Claims.Job.Actions.GenerateDocuments)]
-        public virtual ActionResult GeneratePdf(int id, string DocumentTemplateId)
-        {
-            if (id <= 0)
-                throw new ArgumentOutOfRangeException(nameof(id));
-            if (string.IsNullOrEmpty(DocumentTemplateId))
-                throw new ArgumentNullException(nameof(DocumentTemplateId));
-
-            // Obsolete: Use API\DocumentTemplate\Generate instead
-            return RedirectToAction(MVC.API.DocumentTemplate.Generate(DocumentTemplateId, id.ToString()));
-        }
-
-        [DiscoAuthorize(Claims.Job.Actions.GenerateDocuments)]
-        public virtual ActionResult GeneratePdfPackage(int id, string DocumentTemplatePackageId)
-        {
-            if (id <= 0)
-                throw new ArgumentOutOfRangeException(nameof(id));
-            if (string.IsNullOrEmpty(DocumentTemplatePackageId))
-                throw new ArgumentNullException(nameof(DocumentTemplatePackageId));
-
-            // Obsolete: Use API\DocumentTemplatePackage\Generate instead
-            return RedirectToAction(MVC.API.DocumentTemplatePackage.Generate(DocumentTemplatePackageId, id.ToString()));
-        }
-
         [DiscoAuthorize(Claims.Job.Properties.DeviceHeldLocation)]
         public virtual ActionResult DeviceHeldLocations()
         {

Disco.Web/Areas/API/Controllers/JobPreferencesController.cs

@@ -12,6 +12,7 @@ namespace Disco.Web.Areas.API.Controllers
     public partial class JobPreferencesController : AuthorizedDatabaseController
     {
         [DiscoAuthorize(Claims.Config.JobPreferences.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInitialCommentsTemplate(string initialCommentsTemplate, bool redirect = false)
         {
             string expression = null;
@@ -32,10 +33,11 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.JobPreferences.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         [DiscoAuthorize(Claims.Config.JobPreferences.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateLongRunningJobDaysThreshold(int LongRunningJobDaysThreshold, bool redirect = false)
         {
             Database.DiscoConfiguration.JobPreferences.LongRunningJobDaysThreshold = LongRunningJobDaysThreshold;
@@ -44,10 +46,11 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.JobPreferences.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         [DiscoAuthorize(Claims.Config.JobPreferences.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateStaleJobMinutesThreshold(int StaleJobMinutesThreshold, bool redirect = false)
         {
             Database.DiscoConfiguration.JobPreferences.StaleJobMinutesThreshold = StaleJobMinutesThreshold;
@@ -56,10 +59,11 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.JobPreferences.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         [DiscoAuthorize(Claims.Config.JobPreferences.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateLodgmentIncludeAllAttachmentsByDefault(bool includeAllAttachmentsByDefault, bool redirect = false)
         {
             Database.DiscoConfiguration.JobPreferences.LodgmentIncludeAllAttachmentsByDefault = includeAllAttachmentsByDefault;
@@ -68,10 +72,11 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.JobPreferences.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         [DiscoAuthorize(Claims.Config.JobPreferences.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDefaultNoticeboardTheme(string DefaultNoticeboardTheme, bool redirect = false)
         {
             Database.DiscoConfiguration.JobPreferences.DefaultNoticeboardTheme = DefaultNoticeboardTheme;
@@ -82,10 +87,11 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.JobPreferences.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         [DiscoAuthorize(Claims.Config.JobPreferences.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateLocationMode(LocationModes LocationMode, bool redirect = false)
         {
             Database.DiscoConfiguration.JobPreferences.LocationMode = LocationMode;
@@ -94,13 +100,14 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.JobPreferences.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         [DiscoAuthorize(Claims.Config.JobPreferences.Configure)]
-        public virtual ActionResult UpdateLocationList(string[] LocationList, bool redirect = false)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult UpdateLocationList(string[] locationList, bool redirect = false)
         {
-            var list = LocationList
+            var list = locationList
                 .Where(i => !string.IsNullOrWhiteSpace(i))
                 .Select(i => i.Trim())
                 .Distinct(StringComparer.OrdinalIgnoreCase)
@@ -112,10 +119,11 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.JobPreferences.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         [DiscoAuthorize(Claims.Config.JobPreferences.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult ImportLocationList(string LocationList, bool AutomaticList = false, bool Override = false, bool redirect = false)
         {
             IEnumerable<string> list;
@@ -152,10 +160,11 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.JobPreferences.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         [DiscoAuthorize(Claims.Config.JobPreferences.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateOnCreateExpression(string OnCreateExpression, bool redirect = false)
         {
             string expression = null;
@@ -176,10 +185,11 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.JobPreferences.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         [DiscoAuthorize(Claims.Config.JobPreferences.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateOnDeviceReadyForReturnExpression(string OnDeviceReadyForReturnExpression, bool redirect = false)
         {
             string expression = null;
@@ -200,10 +210,11 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.JobPreferences.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         [DiscoAuthorize(Claims.Config.JobPreferences.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateOnCloseExpression(string OnCloseExpression, bool redirect = false)
         {
             string expression = null;
@@ -224,7 +235,7 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.JobPreferences.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
     }
 }

Disco.Web/Areas/API/Controllers/JobQueueController.cs

@@ -20,6 +20,7 @@ namespace Disco.Web.Areas.API.Controllers
         const string pDefaultSLAExpiry = "defaultslaexpiry";
 
         [DiscoAuthorize(Claims.Config.JobQueue.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(int id, string key, string value = null, bool? redirect = null)
         {
             Authorization.Require(Claims.Config.JobQueue.Configure);
@@ -64,55 +65,62 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     return RedirectToAction(MVC.Config.JobQueue.Index(jobQueue.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         #region Update Shortcut Methods
         [DiscoAuthorize(Claims.Config.JobQueue.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateName(int id, string QueueName = null, bool? redirect = null)
         {
             return Update(id, pName, QueueName, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.JobQueue.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDescription(int id, string Description = null, bool? redirect = null)
         {
             return Update(id, pDescription, Description, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.JobQueue.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdatePriority(int id, string Priority = null, bool? redirect = null)
         {
             return Update(id, pPriority, Priority, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.JobQueue.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDefaultSLAExpiry(int id, string DefaultSLAExpiry = null, bool? redirect = null)
         {
             return Update(id, pDefaultSLAExpiry, DefaultSLAExpiry, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.JobQueue.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateIcon(int id, string Icon = null, bool? redirect = null)
         {
             return Update(id, pIcon, Icon, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.JobQueue.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateIconColour(int id, string IconColour = null, bool? redirect = null)
         {
             return Update(id, pIconColour, IconColour, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.JobQueue.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateIconAndColour(int id, string Icon = null, string IconColour = null, bool redirect = false)
         {
             try
@@ -127,23 +135,24 @@ namespace Disco.Web.Areas.API.Controllers
                 }
                 else
                 {
-                    return Json("Invalid Job Queue Id", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Invalid Job Queue Id");
                 }
                 if (redirect)
                     return RedirectToAction(MVC.Config.JobQueue.Index(jobQueue.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         [DiscoAuthorize(Claims.Config.JobQueue.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateSubjects(int id, string[] Subjects = null, bool redirect = false)
         {
             try
@@ -158,23 +167,24 @@ namespace Disco.Web.Areas.API.Controllers
                 }
                 else
                 {
-                    return Json("Invalid Job Queue Id", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Invalid Job Queue Id");
                 }
                 if (redirect)
                     return RedirectToAction(MVC.Config.JobQueue.Index(jobQueue.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         [DiscoAuthorize(Claims.Config.JobQueue.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateJobSubTypes(int id, List<string> JobSubTypes = null, bool redirect = false)
         {
             try
@@ -186,50 +196,50 @@ namespace Disco.Web.Areas.API.Controllers
                 }
                 else
                 {
-                    return Json("Invalid Job Queue Id", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Invalid Job Queue Id");
                 }
 
                 if (redirect)
                     return RedirectToAction(MVC.Config.JobQueue.Index(jobQueue.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         #endregion
 
         #region Update Properties
-        private void UpdateIconAndColour(JobQueue jobQueue, string Icon, string IconColour)
+        private void UpdateIconAndColour(JobQueue jobQueue, string icon, string iconColour)
         {
-            if (string.IsNullOrWhiteSpace(Icon))
-                throw new ArgumentNullException("Icon");
-            if (string.IsNullOrWhiteSpace(IconColour))
-                throw new ArgumentNullException("IconColour");
+            if (string.IsNullOrWhiteSpace(icon))
+                throw new ArgumentNullException(nameof(icon));
+            if (string.IsNullOrWhiteSpace(iconColour))
+                throw new ArgumentNullException(nameof(iconColour));
 
-            jobQueue.Icon = Icon;
-            jobQueue.IconColour = IconColour;
+            jobQueue.Icon = icon;
+            jobQueue.IconColour = iconColour;
             JobQueueService.UpdateJobQueue(Database, jobQueue);
         }
-        private void UpdateIcon(JobQueue jobQueue, string Icon)
+        private void UpdateIcon(JobQueue jobQueue, string icon)
         {
-            if (string.IsNullOrWhiteSpace(Icon))
+            if (string.IsNullOrWhiteSpace(icon))
                 throw new ArgumentNullException("Icon");
 
-            jobQueue.Icon = Icon;
+            jobQueue.Icon = icon;
             JobQueueService.UpdateJobQueue(Database, jobQueue);
         }
-        private void UpdateIconColour(JobQueue jobQueue, string IconColour)
+        private void UpdateIconColour(JobQueue jobQueue, string iconColour)
         {
-            if (string.IsNullOrWhiteSpace(IconColour))
+            if (string.IsNullOrWhiteSpace(iconColour))
                 throw new ArgumentNullException("IconColour");
 
-            jobQueue.IconColour = IconColour;
+            jobQueue.IconColour = iconColour;
             JobQueueService.UpdateJobQueue(Database, jobQueue);
         }
 
@@ -277,25 +287,25 @@ namespace Disco.Web.Areas.API.Controllers
             JobQueueService.UpdateJobQueue(Database, jobQueue);
         }
 
-        private void UpdateSubjects(JobQueue jobQueue, string[] Subjects)
+        private void UpdateSubjects(JobQueue jobQueue, string[] subjects)
         {
             string subjectIds = null;
 
             // Validate Subjects
-            if (Subjects != null && Subjects.Length > 0)
+            if (subjects != null && subjects.Length > 0)
             {
-                var subjects = Subjects
+                var subjectRecords = subjects
                     .Where(s => !string.IsNullOrWhiteSpace(s))
                     .Select(s => s.Trim())
                     .Select(s => Tuple.Create(s, ActiveDirectory.RetrieveADObject(s, Quick: true)))
                     .Where(s => s.Item2 is ADUserAccount || s.Item2 is ADGroup)
                     .ToList();
-                var invalidSubjects = subjects.Where(s => s.Item2 == null).ToList();
+                var invalidSubjects = subjectRecords.Where(s => s.Item2 == null).ToList();
 
                 if (invalidSubjects.Count > 0)
                     throw new ArgumentException($"Subjects not found: {string.Join(", ", invalidSubjects)}", "Subjects");
 
-                var proposedSubjects = subjects.Select(s => s.Item2.Id).OrderBy(s => s).ToArray();
+                var proposedSubjects = subjectRecords.Select(s => s.Item2.Id).OrderBy(s => s).ToArray();
 
                 subjectIds = string.Join(",", proposedSubjects);
 
@@ -340,6 +350,7 @@ namespace Disco.Web.Areas.API.Controllers
 
         #region Actions
         [DiscoAuthorize(Claims.Config.JobQueue.Delete)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Delete(int id, bool? redirect = false)
         {
             try
@@ -353,7 +364,7 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect.HasValue && redirect.Value)
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(status.SessionId));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 throw new Exception("Invalid Job Queue Id");
             }
@@ -362,7 +373,7 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         #endregion

Disco.Web/Areas/API/Controllers/JobQueueJobController.cs

@@ -16,6 +16,7 @@ namespace Disco.Web.Areas.API.Controllers
         const string pSla = "sla";
         const string pPriority = "priority";
 
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(int id, string key, string value = null, bool? redirect = null)
         {
             try
@@ -52,40 +53,45 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     return Redirect($"{Url.Action(MVC.Job.Show(jobQueueJob.JobId))}#jobDetailTab-Queues");
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         #region Update Shortcut Methods
         [DiscoAuthorizeAny(Claims.Job.Properties.JobQueueProperties.EditAnyComments, Claims.Job.Properties.JobQueueProperties.EditOwnComments)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateAddedComment(int id, string AddedComment = null, bool? redirect = null)
         {
             return Update(id, pAddedComment, AddedComment, redirect);
         }
         [DiscoAuthorizeAny(Claims.Job.Properties.JobQueueProperties.EditAnyComments, Claims.Job.Properties.JobQueueProperties.EditOwnComments)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateRemovedComment(int id, string RemovedComment = null, bool? redirect = null)
         {
             return Update(id, pRemovedComment, RemovedComment, redirect);
         }
         [DiscoAuthorizeAny(Claims.Job.Properties.JobQueueProperties.EditAnySLA, Claims.Job.Properties.JobQueueProperties.EditOwnSLA)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateSla(int id, string SLA = null, bool? redirect = null)
         {
             return Update(id, pSla, SLA, redirect);
         }
         [DiscoAuthorizeAny(Claims.Job.Properties.JobQueueProperties.EditAnyPriority, Claims.Job.Properties.JobQueueProperties.EditOwnPriority)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdatePriority(int id, string Priority = null, bool? redirect = null)
         {
             return Update(id, pPriority, Priority, redirect);
         }
         [DiscoAuthorizeAny(Claims.Job.Properties.JobQueueProperties.EditAnySLA, Claims.Job.Properties.JobQueueProperties.EditOwnSLA,
             Claims.Job.Properties.JobQueueProperties.EditAnyPriority, Claims.Job.Properties.JobQueueProperties.EditOwnPriority)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateSlaAndPriority(int id, string Sla = null, string Priority = null, bool? redirect = null)
         {
             try
@@ -106,14 +112,14 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     return Redirect($"{Url.Action(MVC.Job.Show(jobQueueJob.JobId))}#jobDetailTab-Queues");
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         #endregion
@@ -175,6 +181,7 @@ namespace Disco.Web.Areas.API.Controllers
         #region Actions
 
         [DiscoAuthorizeAny(Claims.Job.Actions.AddAnyQueues, Claims.Job.Actions.AddOwnQueues)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult AddJob(int id, int JobId, string Comment, int? SLAExpiresMinutes, JobQueuePriority Priority)
         {
             DateTime? SLAExpires = (SLAExpiresMinutes.HasValue && SLAExpiresMinutes.Value > 0) ? DateTime.Now.AddMinutes(SLAExpiresMinutes.Value) : (DateTime?)null;
@@ -197,6 +204,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorizeAny(Claims.Job.Actions.RemoveAnyQueues, Claims.Job.Actions.RemoveOwnQueues)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult RemoveJob(int id, string Comment, bool? CloseJob = null)
         {
             Database.Configuration.LazyLoadingEnabled = true;

Disco.Web/Areas/API/Controllers/LoggingController.cs

@@ -21,7 +21,8 @@ namespace Disco.Web.Areas.API.Controllers
             return Json(m, JsonRequestBehavior.AllowGet);
         }
 
-        [HttpPost, ValidateAntiForgeryToken, DiscoAuthorize(Claims.Config.Logging.Show)]
+        [DiscoAuthorize(Claims.Config.Logging.Show)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult RetrieveEvents(string Format, DateTime? Start = null, DateTime? End = null, int? ModuleId = null, List<int> EventTypeIds = null, int? Take = null)
         {
             if (string.Equals(Format, "json", StringComparison.OrdinalIgnoreCase))

Disco.Web/Areas/API/Controllers/PluginController.cs

@@ -31,7 +31,8 @@ namespace Disco.Web.Areas.API.Controllers
             }
         }
 
-        [HttpPost, DiscoAuthorize(Claims.Config.Plugin.Install), ValidateAntiForgeryToken]
+        [DiscoAuthorize(Claims.Config.Plugin.Install)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateAll()
         {
             var status = UpdatePluginTask.UpdateAllPlugins();
@@ -39,7 +40,8 @@ namespace Disco.Web.Areas.API.Controllers
             return RedirectToAction(MVC.Config.Logging.TaskStatus(status.SessionId));
         }
 
-        [HttpPost, DiscoAuthorize(Claims.Config.Plugin.Install), ValidateAntiForgeryToken]
+        [DiscoAuthorize(Claims.Config.Plugin.Install)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(string pluginId)
         {
             if (string.IsNullOrEmpty(pluginId))
@@ -50,7 +52,8 @@ namespace Disco.Web.Areas.API.Controllers
             return RedirectToAction(MVC.Config.Logging.TaskStatus(status.SessionId));
         }
 
-        [HttpPost, DiscoAuthorize(Claims.Config.Plugin.Uninstall), ValidateAntiForgeryToken]
+        [DiscoAuthorize(Claims.Config.Plugin.Uninstall)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Uninstall(string id, bool uninstallData)
         {
             if (string.IsNullOrEmpty(id))
@@ -63,7 +66,8 @@ namespace Disco.Web.Areas.API.Controllers
             return RedirectToAction(MVC.Config.Logging.TaskStatus(status.SessionId));
         }
 
-        [HttpPost, DiscoAuthorize(Claims.Config.Plugin.Install), ValidateAntiForgeryToken]
+        [DiscoAuthorize(Claims.Config.Plugin.Install)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Install(string pluginId)
         {
             if (string.IsNullOrEmpty(pluginId))
@@ -92,7 +96,8 @@ namespace Disco.Web.Areas.API.Controllers
             return RedirectToAction(MVC.Config.Logging.TaskStatus(status.SessionId));
         }
 
-        [HttpPost, DiscoAuthorizeAll(Claims.Config.Plugin.Install, Claims.Config.Plugin.InstallLocal), ValidateAntiForgeryToken]
+        [DiscoAuthorizeAll(Claims.Config.Plugin.Install, Claims.Config.Plugin.InstallLocal)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult InstallLocal(HttpPostedFileBase plugin, bool immediateRestart = false)
         {
             if (plugin == null || plugin.ContentLength <= 0 || string.IsNullOrWhiteSpace(plugin.FileName))

Disco.Web/Areas/API/Controllers/SystemController.cs

@@ -19,6 +19,7 @@ namespace Disco.Web.Areas.API.Controllers
     public partial class SystemController : AuthorizedDatabaseController
     {
         [DiscoAuthorize(Claims.Config.System.Show)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateLastNetworkLogonDates()
         {
             var taskStatus = ADNetworkLogonDatesUpdateTask.ScheduleImmediately();
@@ -27,6 +28,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.DiscoAdminAccount)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateAttachmentThumbnails()
         {
             var ts = Disco.Services.Documents.AttachmentImport.ThumbnailUpdateTask.ScheduleImmediately();
@@ -35,6 +37,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.DiscoAdminAccount)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateADDeviceDescriptions()
         {
             var ts = ADDeviceDescriptionUpdateTask.ScheduleImmediately();
@@ -63,6 +66,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.Config.System.Show)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateCheck()
         {
             var ts = UpdateQueryTask.ScheduleNow();
@@ -70,7 +74,8 @@ namespace Disco.Web.Areas.API.Controllers
             return RedirectToAction(MVC.Config.Logging.TaskStatus(ts.SessionId));
         }
 
-        [HttpPost, ValidateAntiForgeryToken, DiscoAuthorize(Claims.Config.System.Show)]
+        [DiscoAuthorize(Claims.Config.System.Show)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult OnlineServicesConnectStart()
         {
             OnlineServicesConnect.QueueStart();
@@ -82,6 +87,7 @@ namespace Disco.Web.Areas.API.Controllers
 
         #region Organisation Name
         [DiscoAuthorize(Claims.Config.Organisation.ConfigureName)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateOrganisationName(string OrganisationName, bool redirect = false)
         {
             if (string.IsNullOrWhiteSpace(OrganisationName))
@@ -96,7 +102,7 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.Organisation.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
         #endregion
 
@@ -117,7 +123,8 @@ namespace Disco.Web.Areas.API.Controllers
                 }
             }
         }
-        [DiscoAuthorize(Claims.Config.Organisation.ConfigureLogo), HttpPost]
+        [DiscoAuthorize(Claims.Config.Organisation.ConfigureLogo)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult OrganisationLogo(bool redirect, HttpPostedFileBase Image, bool? ResetLogo = null)
         {
             if (ResetLogo.HasValue && ResetLogo.Value)
@@ -127,7 +134,7 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect)
                     return RedirectToAction(MVC.Config.Organisation.Index());
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
 
             if (Image != null && Image.ContentLength > 0)
@@ -139,25 +146,26 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect)
                         return RedirectToAction(MVC.Config.Organisation.Index());
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 else
                 {
                     if (redirect)
                         return RedirectToAction(MVC.Config.Organisation.Index());
                     else
-                        return Json("Invalid Content Type", JsonRequestBehavior.AllowGet);
+                        return BadRequest("Invalid Content Type");
                 }
             }
             if (redirect)
                 return RedirectToAction(MVC.Config.Organisation.Index());
             else
-                return Json("No Image Supplied", JsonRequestBehavior.AllowGet);
+                return BadRequest("No Image Supplied");
         }
         #endregion
 
         #region Organisation Addresses
-        [HttpPost, ValidateAntiForgeryToken, DiscoAuthorize(Claims.Config.Organisation.ConfigureAddresses)]
+        [DiscoAuthorize(Claims.Config.Organisation.ConfigureAddresses)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateOrganisationAddress(Disco.Models.BI.Config.OrganisationAddress organisationAddress, bool redirect = false)
         {
             if (organisationAddress == null)
@@ -171,7 +179,7 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect)
                     return RedirectToAction(MVC.Config.Organisation.Index());
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             else
             {
@@ -193,7 +201,8 @@ namespace Disco.Web.Areas.API.Controllers
                     return Json(em.ToString(), JsonRequestBehavior.AllowGet);
             }
         }
-        [HttpPost, ValidateAntiForgeryToken, DiscoAuthorize(Claims.Config.Organisation.ConfigureAddresses)]
+        [DiscoAuthorize(Claims.Config.Organisation.ConfigureAddresses)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult DeleteOrganisationAddress(int id, bool redirect = false)
         {
             // Remove References in Device Profiles
@@ -207,7 +216,7 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.Organisation.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         #endregion
@@ -215,6 +224,7 @@ namespace Disco.Web.Areas.API.Controllers
         #region MultiSiteMode
 
         [DiscoAuthorize(Claims.Config.Organisation.ConfigureMultiSiteMode)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateMultiSiteMode(bool MultiSiteMode, bool redirect = false)
         {
             Database.DiscoConfiguration.MultiSiteMode = MultiSiteMode;
@@ -226,7 +236,7 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.Organisation.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         #endregion
@@ -236,6 +246,7 @@ namespace Disco.Web.Areas.API.Controllers
         #region Active Directory
 
         [DiscoAuthorize(Claims.Config.System.ConfigureActiveDirectory)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateActiveDirectorySearchScope(List<string> Containers, bool redirect = false)
         {
             ActiveDirectory.Context.UpdateSearchContainers(Database, Containers);
@@ -244,10 +255,11 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.SystemConfig.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         [DiscoAuthorize(Claims.Config.System.ConfigureActiveDirectory)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateActiveDirectorySearchAllServers(bool SearchAllServers, bool redirect = false)
         {
             try
@@ -268,18 +280,19 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect)
                     return RedirectToAction(MVC.Config.SystemConfig.Index());
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         [DiscoAuthorize(Claims.Config.System.ConfigureActiveDirectory)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateActiveDirectorySearchWildcardSuffixOnly(bool SearchWildcardSuffixOnly, bool redirect = false)
         {
             ActiveDirectory.Context.UpdateWildcardSearchSuffixOnly(Database, SearchWildcardSuffixOnly);
@@ -289,7 +302,7 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.SystemConfig.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         [DiscoAuthorizeAny(Claims.Config.System.ConfigureActiveDirectory, Claims.Config.DeviceProfile.Configure)]
@@ -341,7 +354,8 @@ namespace Disco.Web.Areas.API.Controllers
                 return Json(Models.Shared.SubjectDescriptorModel.FromActiveDirectoryObject(subject), JsonRequestBehavior.AllowGet);
         }
 
-        [DiscoAuthorizeAny(Claims.Config.UserFlag.Configure)]
+        [DiscoAuthorizeAny(Claims.Config.UserFlag.Configure, Claims.Config.DeviceFlag.Configure, Claims.Config.DeviceProfile.Configure, Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult SyncActiveDirectoryManagedGroup(string id, string redirectUrl = null)
         {
 
@@ -361,6 +375,7 @@ namespace Disco.Web.Areas.API.Controllers
         #region Proxy Settings
 
         [DiscoAuthorize(Claims.Config.System.ConfigureProxy)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateProxySettings(string ProxyAddress, int? ProxyPort, string ProxyUsername, string ProxyPassword, bool redirect = false)
         {
             // Default Proxy Port
@@ -387,14 +402,15 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.SystemConfig.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         #endregion
 
         #region Email Settings
 
-        [DiscoAuthorize(Claims.Config.System.ConfigureEmail), ValidateInput(false), ValidateAntiForgeryToken]
+        [DiscoAuthorize(Claims.Config.System.ConfigureEmail), ValidateInput(false)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateEmailSettings(string SmtpServer, int? SmtpPort, string FromAddress, string ReplyToAddress, bool EnableSsl, string Username, string Password, bool redirect = false)
         {
             // Default Port
@@ -419,10 +435,11 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.SystemConfig.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
-        [DiscoAuthorize(Claims.Config.System.ConfigureEmail), ValidateAntiForgeryToken]
+        [DiscoAuthorize(Claims.Config.System.ConfigureEmail)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult SendTestEmail(string Recipient, bool redirect = false)
         {
             if (string.IsNullOrWhiteSpace(Recipient))
@@ -433,7 +450,7 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.SystemConfig.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         #endregion

Disco.Web/Areas/API/Controllers/UserController.cs

@@ -139,7 +139,8 @@ namespace Disco.Web.Areas.API.Controllers
             return HttpNotFound("Invalid Attachment Number");
         }
 
-        [DiscoAuthorize(Claims.User.Actions.AddAttachments), ValidateAntiForgeryToken]
+        [DiscoAuthorize(Claims.User.Actions.AddAttachments)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult AttachmentUpload(string id, string domain, string comments)
         {
             id = ActiveDirectory.ParseDomainAccountId(id, domain);
@@ -224,6 +225,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorizeAny(Claims.User.Actions.RemoveAnyAttachments, Claims.User.Actions.RemoveOwnAttachments)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult AttachmentRemove(int id)
         {
             var ua = Database.UserAttachments.Include("TechUser").Where(m => m.Id == id).FirstOrDefault();
@@ -236,9 +238,9 @@ namespace Disco.Web.Areas.API.Controllers
 
                 ua.OnDelete(Database);
                 Database.SaveChanges();
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
             }
-            return Json("Invalid Attachment Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Attachment Number");
         }
 
         [DiscoAuthorize(Claims.User.Actions.AddAttachments)]
@@ -267,44 +269,12 @@ namespace Disco.Web.Areas.API.Controllers
             }
             catch (InvalidOperationException ex)
             {
-                return Json(new
-                {
-                    Success = false,
-                    ErrorMessage = ex.Message,
-                });
+                return BadRequest(ex.Message);
             }
         }
 
         #endregion
 
-        [DiscoAuthorize(Claims.User.Actions.GenerateDocuments)]
-        public virtual ActionResult GeneratePdf(string id, string domain, string DocumentTemplateId)
-        {
-            if (string.IsNullOrEmpty(id))
-                throw new ArgumentNullException(nameof(id));
-            if (string.IsNullOrEmpty(DocumentTemplateId))
-                throw new ArgumentNullException(nameof(DocumentTemplateId));
-
-            var userId = ActiveDirectory.ParseDomainAccountId(id, domain);
-
-            // Obsolete: Use API\DocumentTemplate\Generate instead
-            return RedirectToAction(MVC.API.DocumentTemplate.Generate(DocumentTemplateId, userId));
-        }
-
-        [DiscoAuthorize(Claims.User.Actions.GenerateDocuments)]
-        public virtual ActionResult GeneratePdfPackage(string id, string domain, string DocumentTemplatePackageId)
-        {
-            if (string.IsNullOrEmpty(id))
-                throw new ArgumentNullException(nameof(id));
-            if (string.IsNullOrEmpty(DocumentTemplatePackageId))
-                throw new ArgumentNullException(nameof(DocumentTemplatePackageId));
-
-            var userId = ActiveDirectory.ParseDomainAccountId(id, domain);
-
-            // Obsolete: Use API\DocumentTemplatePackage\Generate instead
-            return RedirectToAction(MVC.API.DocumentTemplatePackage.Generate(DocumentTemplatePackageId, userId));
-        }
-
         public virtual ActionResult Photo(string userId)
         {
             if (string.IsNullOrEmpty(userId))

Disco.Web/Areas/API/Controllers/UserFlagAssignmentController.cs

@@ -40,14 +40,14 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     return Redirect($"{Url.Action(MVC.User.Show(userFlagAssignment.UserId))}#UserDetailTab-Flags");
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 

Disco.Web/Areas/API/Controllers/UserFlagController.cs

@@ -24,6 +24,7 @@ namespace Disco.Web.Areas.API.Controllers
         const string pOnUnassignmentExpression = "onunassignmentexpression";
 
         [DiscoAuthorize(Claims.Config.UserFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(int id, string key, string value = null, bool? redirect = null)
         {
             Authorization.Require(Claims.Config.UserFlag.Configure);
@@ -68,93 +69,101 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     return RedirectToAction(MVC.Config.UserFlag.Index(flag.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         #region Update Shortcut Methods
         [DiscoAuthorize(Claims.Config.UserFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateName(int id, string FlagName = null, bool? redirect = null)
         {
             return Update(id, pName, FlagName, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.UserFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDescription(int id, string Description = null, bool? redirect = null)
         {
             return Update(id, pDescription, Description, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.UserFlag.Configure)]
-        public virtual ActionResult UpdateIcon(int id, string Icon = null, bool? redirect = null)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult UpdateIcon(int id, string icon = null, bool? redirect = null)
         {
-            return Update(id, pIcon, Icon, redirect);
+            return Update(id, pIcon, icon, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.UserFlag.Configure)]
-        public virtual ActionResult UpdateIconColour(int id, string IconColour = null, bool? redirect = null)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult UpdateIconColour(int id, string iconColour = null, bool? redirect = null)
         {
-            return Update(id, pIconColour, IconColour, redirect);
+            return Update(id, pIconColour, iconColour, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.UserFlag.Configure)]
-        public virtual ActionResult UpdateIconAndColour(int id, string Icon = null, string IconColour = null, bool redirect = false)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult UpdateIconAndColour(int id, string icon = null, string iconColour = null, bool redirect = false)
         {
             try
             {
                 if (id < 0)
-                    throw new ArgumentOutOfRangeException("id");
+                    throw new ArgumentOutOfRangeException(nameof(id));
 
                 var UserFlag = Database.UserFlags.Find(id);
                 if (UserFlag != null)
                 {
-                    UpdateIconAndColour(UserFlag, Icon, IconColour);
+                    UpdateIconAndColour(UserFlag, icon, iconColour);
                 }
                 else
                 {
-                    throw new ArgumentException("Invalid User Flag Id", "id");
+                    throw new ArgumentException("Invalid User Flag Id", nameof(id));
                 }
                 if (redirect)
                     return RedirectToAction(MVC.Config.UserFlag.Index(UserFlag.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         [DiscoAuthorize(Claims.Config.UserFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateOnAssignmentExpression(int id, string OnAssignmentExpression = null, bool redirect = false)
         {
             return Update(id, pOnAssignmentExpression, OnAssignmentExpression, redirect);
         }
         [DiscoAuthorize(Claims.Config.UserFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateOnUnassignmentExpression(int id, string OnUnassignmentExpression = null, bool redirect = false)
         {
             return Update(id, pOnUnassignmentExpression, OnUnassignmentExpression, redirect);
         }
         [DiscoAuthorize(Claims.Config.UserFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateAssignedUsersLinkedGroup(int id, string GroupId = null, DateTime? FilterBeginDate = null, bool redirect = false)
         {
             try
             {
                 if (id < 0)
-                    throw new ArgumentOutOfRangeException("id");
+                    throw new ArgumentOutOfRangeException(nameof(id));
 
                 var UserFlag = Database.UserFlags.Find(id);
                 if (UserFlag == null)
-                    throw new ArgumentException("Invalid User Flag Id", "id");
+                    throw new ArgumentException("Invalid User Flag Id", nameof(id));
 
 
                 var syncTaskStatus = UpdateAssignedUsersLinkedGroup(UserFlag, GroupId, FilterBeginDate);
@@ -167,27 +176,28 @@ namespace Disco.Web.Areas.API.Controllers
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
                     }
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         [DiscoAuthorize(Claims.Config.UserFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateAssignedUserDevicesLinkedGroup(int id, string GroupId = null, DateTime? FilterBeginDate = null, bool redirect = false)
         {
             try
             {
                 if (id < 0)
-                    throw new ArgumentOutOfRangeException("id");
+                    throw new ArgumentOutOfRangeException(nameof(id));
 
                 var UserFlag = Database.UserFlags.Find(id);
                 if (UserFlag == null)
-                    throw new ArgumentException("Invalid User Flag Id", "id");
+                    throw new ArgumentException("Invalid User Flag Id", nameof(id));
 
 
                 var syncTaskStatus = UpdateAssignedUserDevicesLinkedGroup(UserFlag, GroupId, FilterBeginDate);
@@ -200,14 +210,14 @@ namespace Disco.Web.Areas.API.Controllers
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
                     }
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         #endregion
@@ -347,6 +357,7 @@ namespace Disco.Web.Areas.API.Controllers
 
         #region Actions
         [DiscoAuthorizeAll(Claims.Config.UserFlag.Configure, Claims.Config.UserFlag.Delete)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Delete(int id, bool? redirect = false)
         {
             try
@@ -360,7 +371,7 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect.HasValue && redirect.Value)
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(status.SessionId));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 throw new Exception("Invalid User Flag Id");
             }
@@ -369,11 +380,12 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         [DiscoAuthorizeAll(Claims.Config.UserFlag.Configure, Claims.User.Actions.AddFlags, Claims.User.Actions.RemoveFlags, Claims.User.ShowFlagAssignments)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult BulkAssignUsers(int id, bool Override, string UserIds = null, string Comments = null)
         {
             if (id < 0)

Disco.Web/Areas/API/Models/DeviceModel/ComponentModel.cs

@@ -1,8 +1,25 @@
-namespace Disco.Web.Areas.API.Models.DeviceModel
+using System.Collections.Generic;
+using System.Linq;
+
+namespace Disco.Web.Areas.API.Models.DeviceModel
 {
     public class ComponentModel
     {
-        public _ComponentModel Component { get; set; }
-        public string Result { get; set; }
+        public int Id { get; set; }
+        public string Description { get; set; }
+        public string Cost { get; set; }
+        public List<string> JobSubTypes { get; set; }
+
+        public static ComponentModel FromDeviceComponent(Disco.Models.Repository.DeviceComponent dc)
+        {
+            return new ComponentModel
+            {
+                Id = dc.Id,
+                Description = dc.Description,
+                Cost = dc.Cost.ToString("C"),
+                JobSubTypes = dc.JobSubTypes.Select(j => $"{j.JobTypeId}_{j.Id}").ToList()
+            };
+
+        }
     }
-}
+}

Disco.Web/Areas/API/Models/DeviceModel/_ComponentModel.cs

@@ -1,25 +0,0 @@
-using System.Collections.Generic;
-using System.Linq;
-
-namespace Disco.Web.Areas.API.Models.DeviceModel
-{
-    public class _ComponentModel
-    {
-        public int Id { get; set; }
-        public string Description { get; set; }
-        public string Cost { get; set; }
-        public List<string> JobSubTypes { get; set; }
-
-        public static _ComponentModel FromDeviceComponent(Disco.Models.Repository.DeviceComponent dc)
-        {
-            return new _ComponentModel
-            {
-                Id = dc.Id,
-                Description = dc.Description,
-                Cost = dc.Cost.ToString("C"),
-                JobSubTypes = dc.JobSubTypes.Select(j => $"{j.JobTypeId}_{j.Id}").ToList()
-            };
-
-        }
-    }
-}

Disco.Web/Areas/API/Models/Job/ComponentModel.cs

@@ -2,7 +2,18 @@
 {
     public class ComponentModel
     {
-        public _ComponentModel Component { get; set; }
-        public string Result { get; set; }
+        public int Id { get; set; }
+        public string Description { get; set; }
+        public string Cost { get; set; }
+
+        public static ComponentModel FromJobComponent(Disco.Models.Repository.JobComponent jc)
+        {
+            return new ComponentModel
+            {
+                Id = jc.Id,
+                Description = jc.Description,
+                Cost = jc.Cost.ToString("C")
+            };
+        }
     }
 }

Disco.Web/Areas/API/Models/Job/_ComponentModel.cs

@@ -1,19 +0,0 @@
-namespace Disco.Web.Areas.API.Models.Job
-{
-    public class _ComponentModel
-    {
-        public int Id { get; set; }
-        public string Description { get; set; }
-        public string Cost { get; set; }
-
-        public static _ComponentModel FromJobComponent(Disco.Models.Repository.JobComponent jc)
-        {
-            return new _ComponentModel
-            {
-                Id = jc.Id,
-                Description = jc.Description,
-                Cost = jc.Cost.ToString("C")
-            };
-        }
-    }
-}

Disco.Web/Areas/Config/Controllers/AuthorizationRoleController.cs

@@ -17,6 +17,7 @@ namespace Disco.Web.Areas.Config.Controllers
     [DiscoAuthorize(Claims.DiscoAdminAccount)]
     public partial class AuthorizationRoleController : AuthorizedDatabaseController
     {
+        [HttpGet]
         public virtual ActionResult Index(int? id)
         {
             if (id.HasValue)
@@ -72,13 +73,11 @@ namespace Disco.Web.Areas.Config.Controllers
             }
         }
 
+        [HttpGet]
         public virtual ActionResult Create()
         {
             // Default Role
-            var m = new Models.AuthorizationRole.CreateModel()
-            {
-                AuthorizationRole = new Disco.Models.Repository.AuthorizationRole()
-            };
+            var m = new Models.AuthorizationRole.CreateModel();
 
             // UI Extensions
             UIExtensions.ExecuteExtensions<ConfigAuthorizationRoleCreateModel>(ControllerContext, m);
@@ -86,16 +85,16 @@ namespace Disco.Web.Areas.Config.Controllers
             return View(m);
         }
 
-        [HttpPost]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Create(Models.AuthorizationRole.CreateModel model)
         {
             if (ModelState.IsValid)
             {
                 // Check for Existing
-                var existing = Database.AuthorizationRoles.Where(m => m.Name == model.AuthorizationRole.Name).FirstOrDefault();
+                var existing = Database.AuthorizationRoles.Where(m => m.Name == model.Name).FirstOrDefault();
                 if (existing == null)
                 {
-                    var roleId = UserService.CreateAuthorizationRole(Database, model.AuthorizationRole);
+                    var roleId = UserService.CreateAuthorizationRole(Database, model.Name);
 
                     return RedirectToAction(MVC.Config.AuthorizationRole.Index(roleId));
                 }

Disco.Web/Areas/Config/Controllers/DeviceBatchController.cs

@@ -6,6 +6,7 @@ using Disco.Services.Devices;
 using Disco.Services.Devices.ManagedGroups;
 using Disco.Services.Plugins.Features.UIExtension;
 using Disco.Services.Web;
+using Disco.Web.Areas.Config.Models.DeviceBatch;
 using System;
 using System.Linq;
 using System.Web.Mvc;
@@ -24,7 +25,7 @@ namespace Disco.Web.Areas.Config.Controllers
                 var m = Database.DeviceBatches
                     .Include(nameof(DeviceBatch.DeviceBatchAttachments))
                     .Where(db => db.Id == id.Value)
-                    .Select(db => new Models.DeviceBatch.ShowModel()
+                    .Select(db => new ShowModel()
                     {
                         DeviceBatch = db,
                         DeviceCount = db.Devices.Count(),
@@ -34,7 +35,7 @@ namespace Disco.Web.Areas.Config.Controllers
                 if (m == null || m.DeviceBatch == null)
                     throw new ArgumentException("Invalid Device Batch Id", "id");
 
-                m.DeviceModelMembers = m.DeviceBatch.Devices.GroupBy(d => d.DeviceModel).Select(dG => new Models.DeviceBatch._ShowModelMembership()
+                m.DeviceModelMembers = m.DeviceBatch.Devices.GroupBy(d => d.DeviceModel).Select(dG => new _ShowModelMembership()
                 {
                     DeviceModel = dG.Key,
                     DeviceCount = dG.Count(),
@@ -82,9 +83,9 @@ namespace Disco.Web.Areas.Config.Controllers
         public virtual ActionResult Create()
         {
             // Default Batch
-            var m = new Models.DeviceBatch.CreateModel()
+            var m = new CreateModel()
             {
-                DeviceBatch = DeviceBatches.DefaultNewDeviceBatch(Database)
+                PurchaseDate = DateTime.Today,
             };
 
             // UI Extensions
@@ -93,22 +94,28 @@ namespace Disco.Web.Areas.Config.Controllers
             return View(m);
         }
 
-        [DiscoAuthorizeAll(Claims.Config.DeviceBatch.Create, Claims.Config.DeviceBatch.Configure), HttpPost]
-        public virtual ActionResult Create(Models.DeviceBatch.CreateModel model)
+        [DiscoAuthorizeAll(Claims.Config.DeviceBatch.Create, Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult Create(CreateModel model)
         {
             if (ModelState.IsValid)
             {
                 // Check for Existing
-                var existing = Database.DeviceBatches.Where(m => m.Name == model.DeviceBatch.Name).FirstOrDefault();
-                if (existing == null)
+                var alreadyExists = Database.DeviceBatches.Any(m => m.Name == model.Name);
+                if (!alreadyExists)
                 {
-                    Database.DeviceBatches.Add(model.DeviceBatch);
+                    var batch = new DeviceBatch()
+                    {
+                        Name = model.Name,
+                        PurchaseDate = model.PurchaseDate,
+                    };
+                    Database.DeviceBatches.Add(batch);
                     Database.SaveChanges();
-                    return RedirectToAction(MVC.Config.DeviceBatch.Index(model.DeviceBatch.Id));
+                    return RedirectToAction(MVC.Config.DeviceBatch.Index(batch.Id));
                 }
                 else
                 {
-                    ModelState.AddModelError("Name", "A Device Batch with this name already exists.");
+                    ModelState.AddModelError(nameof(CreateModel.Name), "A Device Batch with this name already exists.");
                 }
             }
 
@@ -121,7 +128,7 @@ namespace Disco.Web.Areas.Config.Controllers
         [DiscoAuthorize(Claims.Config.DeviceBatch.ShowTimeline)]
         public virtual ActionResult Timeline()
         {
-            var m = new Models.DeviceBatch.TimelineModel();
+            var m = new TimelineModel();
 
             // UI Extensions
             UIExtensions.ExecuteExtensions<ConfigDeviceBatchTimelineModel>(ControllerContext, m);

Disco.Web/Areas/Config/Controllers/DeviceFlagController.cs

@@ -79,14 +79,7 @@ namespace Disco.Web.Areas.Config.Controllers
         public virtual ActionResult Create()
         {
             // Default Queue
-            var m = new CreateModel()
-            {
-                DeviceFlag = new DeviceFlag()
-                {
-                    Icon = DeviceFlagService.RandomUnusedIcon(),
-                    IconColour = DeviceFlagService.RandomUnusedThemeColour()
-                }
-            };
+            var m = new CreateModel();
 
             // UI Extensions
             UIExtensions.ExecuteExtensions<ConfigDeviceFlagCreateModel>(ControllerContext, m);
@@ -94,16 +87,17 @@ namespace Disco.Web.Areas.Config.Controllers
             return View(m);
         }
 
-        [DiscoAuthorizeAll(Claims.Config.DeviceFlag.Create, Claims.Config.DeviceFlag.Configure), HttpPost]
+        [DiscoAuthorizeAll(Claims.Config.DeviceFlag.Create, Claims.Config.DeviceFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Create(CreateModel model)
         {
             if (ModelState.IsValid)
             {
                 // Check for Existing
-                var existing = Database.DeviceFlags.Where(m => m.Name == model.DeviceFlag.Name).FirstOrDefault();
+                var existing = Database.DeviceFlags.Where(m => m.Name == model.Name).FirstOrDefault();
                 if (existing == null)
                 {
-                    var flag = DeviceFlagService.CreateDeviceFlag(Database, model.DeviceFlag);
+                    var flag = DeviceFlagService.CreateDeviceFlag(Database, model.Name, model.Description);
 
                     return RedirectToAction(MVC.Config.DeviceFlag.Index(flag.Id));
                 }

Disco.Web/Areas/Config/Controllers/DeviceProfileController.cs

@@ -105,18 +105,10 @@ namespace Disco.Web.Areas.Config.Controllers
         }
 
         [DiscoAuthorizeAll(Claims.Config.DeviceProfile.Create, Claims.Config.DeviceProfile.Configure)]
+        [HttpGet]
         public virtual ActionResult Create()
         {
-            var m = new Models.DeviceProfile.CreateModel()
-            {
-                DeviceProfile = new DeviceProfile()
-                {
-                    ComputerNameTemplate = DeviceProfile.DefaultComputerNameTemplate,
-                    ProvisionADAccount = true,
-                    DistributionType = DeviceProfile.DistributionTypes.OneToMany,
-                    OrganisationalUnit = ActiveDirectory.Context.PrimaryDomain.DefaultComputerContainer
-                }
-            };
+            var m = new Models.DeviceProfile.CreateModel();
 
             // UI Extensions
             UIExtensions.ExecuteExtensions<ConfigDeviceProfileCreateModel>(ControllerContext, m);
@@ -124,20 +116,30 @@ namespace Disco.Web.Areas.Config.Controllers
             return View(m);
         }
 
-        [DiscoAuthorizeAll(Claims.Config.DeviceProfile.Create, Claims.Config.DeviceProfile.Configure), HttpPost]
+        [DiscoAuthorizeAll(Claims.Config.DeviceProfile.Create, Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Create(Models.DeviceProfile.CreateModel model)
         {
             if (ModelState.IsValid)
             {
                 // Check for Existing
-                var existing = Database.DeviceProfiles.Where(m => m.Name == model.DeviceProfile.Name).FirstOrDefault();
-                if (existing == null)
+                var existingName = Database.DeviceProfiles.Any(m => m.Name.Equals(model.Name, StringComparison.OrdinalIgnoreCase));
+                if (!existingName)
                 {
-                    model.DeviceProfile.ProvisionADAccount = true;
+                    var deviceProfile = new DeviceProfile()
+                    {
+                        Name = model.Name,
+                        ShortName = model.ShortName,
+                        Description = model.Description,
+                        ProvisionADAccount = true,
+                        ComputerNameTemplate = DeviceProfile.DefaultComputerNameTemplate,
+                        DistributionType = DeviceProfile.DistributionTypes.OneToMany,
+                        OrganisationalUnit = ActiveDirectory.Context.PrimaryDomain.DefaultComputerContainer
+                    };
 
-                    Database.DeviceProfiles.Add(model.DeviceProfile);
+                    Database.DeviceProfiles.Add(deviceProfile);
                     Database.SaveChanges();
-                    return RedirectToAction(MVC.Config.DeviceProfile.Index(model.DeviceProfile.Id));
+                    return RedirectToAction(MVC.Config.DeviceProfile.Index(deviceProfile.Id));
                 }
                 else
                 {

Disco.Web/Areas/Config/Controllers/DocumentTemplateController.cs

@@ -23,7 +23,7 @@ namespace Disco.Web.Areas.Config.Controllers
     public partial class DocumentTemplateController : AuthorizedDatabaseController
     {
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Show)]
-        public virtual ActionResult Index(string id, string bulkGenerateId = null, string bulkGenerateFilename = null)
+        public virtual ActionResult Index(string id, Guid? bulkGenerateId = null, string bulkGenerateFilename = null)
         {
             if (string.IsNullOrEmpty(id))
             {
@@ -76,6 +76,7 @@ namespace Disco.Web.Areas.Config.Controllers
             }
         }
 
+        [DiscoAuthorize(Claims.Config.DocumentTemplate.Show)]
         public virtual ActionResult ShowPackage(string id)
         {
             // Document Template Package
@@ -139,7 +140,8 @@ namespace Disco.Web.Areas.Config.Controllers
             return View(m);
         }
 
-        [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.Create, Claims.Config.DocumentTemplate.Configure), HttpPost]
+        [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.Create, Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Create(CreateModel model)
         {
             model.UpdateModel(Database);
@@ -147,27 +149,30 @@ namespace Disco.Web.Areas.Config.Controllers
             if (ModelState.IsValid)
             {
                 // Check for Existing
-                var existing = Database.DocumentTemplates.Where(m => m.Id == model.DocumentTemplate.Id).FirstOrDefault();
+                var existing = Database.DocumentTemplates.Where(m => m.Id == model.Id).FirstOrDefault();
                 if (existing == null)
                 {
-
-                    Database.DocumentTemplates.Add(model.DocumentTemplate);
-
-                    if (model.DocumentTemplate.Scope == DocumentTemplate.DocumentTemplateScopes.Job)
+                    var template = new DocumentTemplate()
                     {
-                        model.DocumentTemplate.JobSubTypes = model.GetJobSubTypes();
-                    }
+                        Id = model.Id,
+                        Description = model.Description,
+                        Scope = model.Scope,
+                    };
 
+                    if (model.Scope == DocumentTemplate.DocumentTemplateScopes.Job)
+                        template.JobSubTypes = model.GetJobSubTypes();
+
+                    Database.DocumentTemplates.Add(template);
                     Database.SaveChanges();
 
                     // Save Template
-                    model.DocumentTemplate.SavePdfTemplate(Database, model.Template.InputStream);
+                    template.SavePdfTemplate(Database, model.Template.InputStream);
 
-                    return RedirectToAction(MVC.Config.DocumentTemplate.Index(model.DocumentTemplate.Id));
+                    return RedirectToAction(MVC.Config.DocumentTemplate.Index(template.Id));
                 }
                 else
                 {
-                    ModelState.AddModelError("Id", "A Document Template with this Id already exists.");
+                    ModelState.AddModelError(nameof(DocumentTemplate.Id), "A Document Template with this Id already exists.");
                 }
             }
 
@@ -188,18 +193,19 @@ namespace Disco.Web.Areas.Config.Controllers
             return View(m);
         }
 
-        [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.Create, Claims.Config.DocumentTemplate.Configure), HttpPost]
+        [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.Create, Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult CreatePackage(CreatePackageModel model)
         {
             if (ModelState.IsValid)
             {
                 // Check for Existing
-                var existing = DocumentTemplatePackages.GetPackage(model.Package.Id);
+                var existing = DocumentTemplatePackages.GetPackage(model.Id);
                 if (existing == null)
                 {
-                    DocumentTemplatePackages.CreatePackage(model.Package);
+                    DocumentTemplatePackages.CreatePackage(model.Id, model.Description, model.Scope);
 
-                    return RedirectToAction(MVC.Config.DocumentTemplate.ShowPackage(model.Package.Id));
+                    return RedirectToAction(MVC.Config.DocumentTemplate.ShowPackage(model.Id));
                 }
                 else
                 {

Disco.Web/Areas/Config/Controllers/JobQueueController.cs

@@ -78,18 +78,11 @@ namespace Disco.Web.Areas.Config.Controllers
         }
 
         [DiscoAuthorizeAll(Claims.Config.JobQueue.Create, Claims.Config.JobQueue.Configure)]
+        [HttpGet]
         public virtual ActionResult Create()
         {
             // Default Queue
-            var m = new Models.JobQueue.CreateModel()
-            {
-                JobQueue = new JobQueue()
-                {
-                    Icon = JobQueueService.RandomUnusedIcon(),
-                    IconColour = JobQueueService.RandomUnusedThemeColour(),
-                    Priority = JobQueuePriority.Normal
-                }
-            };
+            var m = new Models.JobQueue.CreateModel();
 
             // UI Extensions
             UIExtensions.ExecuteExtensions<ConfigJobQueueCreateModel>(ControllerContext, m);
@@ -97,16 +90,17 @@ namespace Disco.Web.Areas.Config.Controllers
             return View(m);
         }
 
-        [DiscoAuthorizeAll(Claims.Config.JobQueue.Create, Claims.Config.JobQueue.Configure), HttpPost]
+        [DiscoAuthorizeAll(Claims.Config.JobQueue.Create, Claims.Config.JobQueue.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Create(Models.JobQueue.CreateModel model)
         {
             if (ModelState.IsValid)
             {
                 // Check for Existing
-                var existing = Database.JobQueues.Where(m => m.Name == model.JobQueue.Name).FirstOrDefault();
-                if (existing == null)
+                var nameExists = Database.JobQueues.Any(m => m.Name.Equals(model.Name, StringComparison.Ordinal));
+                if (!nameExists)
                 {
-                    var token = JobQueueService.CreateJobQueue(Database, model.JobQueue);
+                    var token = JobQueueService.CreateJobQueue(Database, model.Name, model.Description);
 
                     return RedirectToAction(MVC.Config.JobQueue.Index(token.JobQueue.Id));
                 }

Disco.Web/Areas/Config/Controllers/PluginsController.cs

@@ -23,7 +23,8 @@ namespace Disco.Web.Areas.Config.Controllers
         }
 
         #region Plugin Configuration
-        [DiscoAuthorize(Claims.Config.Plugin.Configure), HttpPost, ValidateInput(false)]
+        [DiscoAuthorize(Claims.Config.Plugin.Configure), ValidateInput(false)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Configure(string PluginId, FormCollection form)
         {
             if (string.IsNullOrEmpty(PluginId))

Disco.Web/Areas/Config/Controllers/UserFlagController.cs

@@ -1,5 +1,4 @@
 using Disco.Models.Areas.Config.UI.UserFlag;
-using Disco.Models.Repository;
 using Disco.Models.Services.Users.UserFlags;
 using Disco.Models.UI.Config.UserFlag;
 using Disco.Services.Authorization;
@@ -76,17 +75,11 @@ namespace Disco.Web.Areas.Config.Controllers
         }
 
         [DiscoAuthorizeAll(Claims.Config.UserFlag.Create, Claims.Config.UserFlag.Configure)]
+        [HttpGet]
         public virtual ActionResult Create()
         {
             // Default Queue
-            var m = new CreateModel()
-            {
-                UserFlag = new UserFlag()
-                {
-                    Icon = UserFlagService.RandomUnusedIcon(),
-                    IconColour = UserFlagService.RandomUnusedThemeColour()
-                }
-            };
+            var m = new CreateModel();
 
             // UI Extensions
             UIExtensions.ExecuteExtensions<ConfigUserFlagCreateModel>(ControllerContext, m);
@@ -94,22 +87,23 @@ namespace Disco.Web.Areas.Config.Controllers
             return View(m);
         }
 
-        [DiscoAuthorizeAll(Claims.Config.UserFlag.Create, Claims.Config.UserFlag.Configure), HttpPost]
+        [DiscoAuthorizeAll(Claims.Config.UserFlag.Create, Claims.Config.UserFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Create(CreateModel model)
         {
             if (ModelState.IsValid)
             {
                 // Check for Existing
-                var existing = Database.UserFlags.Where(m => m.Name == model.UserFlag.Name).FirstOrDefault();
-                if (existing == null)
+                var nameExists = Database.UserFlags.Any(m => m.Name.Equals(model.Name, StringComparison.Ordinal));
+                if (!nameExists)
                 {
-                    var flag = UserFlagService.CreateUserFlag(Database, model.UserFlag);
+                    var flag = UserFlagService.CreateUserFlag(Database, model.Name, model.Description);
 
                     return RedirectToAction(MVC.Config.UserFlag.Index(flag.Id));
                 }
                 else
                 {
-                    ModelState.AddModelError("Name", "A User Flag with this name already exists.");
+                    ModelState.AddModelError(nameof(CreateModel.Name), "A User Flag with this name already exists.");
                 }
             }
 

Disco.Web/Areas/Config/Models/AuthorizationRole/CreateModel.cs

@@ -1,9 +1,11 @@
 using Disco.Models.UI.Config.AuthorizationRole;
+using System.ComponentModel.DataAnnotations;
 
 namespace Disco.Web.Areas.Config.Models.AuthorizationRole
 {
     public class CreateModel : ConfigAuthorizationRoleCreateModel
     {
-        public Disco.Models.Repository.AuthorizationRole AuthorizationRole { get; set; }
+        [Required, StringLength(100)]
+        public string Name { get; set; }
     }
 }

Disco.Web/Areas/Config/Models/DeviceBatch/CreateModel.cs

@@ -1,9 +1,15 @@
 using Disco.Models.UI.Config.DeviceBatch;
+using System;
+using System.ComponentModel.DataAnnotations;
 
 namespace Disco.Web.Areas.Config.Models.DeviceBatch
 {
     public class CreateModel : ConfigDeviceBatchCreateModel
     {
-        public Disco.Models.Repository.DeviceBatch DeviceBatch { get; set; }
+        [Required, StringLength(500)]
+        public string Name { get; set; }
+
+        [Required, DisplayFormat(ApplyFormatInEditMode = true, ConvertEmptyStringToNull = true, DataFormatString = "{0:yyyy/MM/dd}", HtmlEncode = false)]
+        public DateTime PurchaseDate { get; set; }
     }
 }

Disco.Web/Areas/Config/Models/DeviceFlag/CreateModel.cs

@@ -1,9 +1,14 @@
 using Disco.Models.UI.Config.DeviceFlag;
+using System.ComponentModel.DataAnnotations;
 
 namespace Disco.Web.Areas.Config.Models.DeviceFlag
 {
     public class CreateModel : ConfigDeviceFlagCreateModel
     {
-        public Disco.Models.Repository.DeviceFlag DeviceFlag { get; set; }
+        [Required, StringLength(100)]
+        public string Name { get; set; }
+
+        [StringLength(500), DataType(DataType.MultilineText)]
+        public string Description { get; set; }
     }
 }

Disco.Web/Areas/Config/Models/DeviceProfile/CreateModel.cs

@@ -1,9 +1,17 @@
 using Disco.Models.UI.Config.DeviceProfile;
+using System.ComponentModel.DataAnnotations;
 
 namespace Disco.Web.Areas.Config.Models.DeviceProfile
 {
     public class CreateModel : ConfigDeviceProfileCreateModel
     {
-        public Disco.Models.Repository.DeviceProfile DeviceProfile { get; set; }
+        [Required, StringLength(100)]
+        public string Name { get; set; }
+
+        [Required, StringLength(10)]
+        public string ShortName { get; set; }
+
+        [StringLength(500), DataType(DataType.MultilineText)]
+        public string Description { get; set; }
     }
 }

Disco.Web/Areas/Config/Models/DocumentTemplate/CreateModel.cs

@@ -10,7 +10,13 @@ namespace Disco.Web.Areas.Config.Models.DocumentTemplate
     [CustomValidation(typeof(CreateModelValidation), "ValidateCreateModel")]
     public class CreateModel : ConfigDocumentTemplateCreateModel
     {
-        public Disco.Models.Repository.DocumentTemplate DocumentTemplate { get; set; }
+        [StringLength(30), Required]
+        public string Id { get; set; }
+
+        [StringLength(250), Required]
+        public string Description { get; set; }
+        [Required, StringLength(6)]
+        public string Scope { get; set; }
 
         [Required]
         public HttpPostedFileBase Template { get; set; }
@@ -21,13 +27,8 @@ namespace Disco.Web.Areas.Config.Models.DocumentTemplate
         public List<Disco.Models.Repository.JobType> JobTypes { get; set; }
         public List<Disco.Models.Repository.JobSubType> JobSubTypes { get; set; }
 
-        public List<string> Scopes
-        {
-            get
-            {
-                return Disco.Models.Repository.DocumentTemplate.DocumentTemplateScopes.ToList();
-            }
-        }
+        public List<string> Scopes =>
+            Disco.Models.Repository.DocumentTemplate.DocumentTemplateScopes.ToList();
 
         public List<Disco.Models.Repository.JobType> GetJobTypes()
         {
@@ -63,7 +64,7 @@ namespace Disco.Web.Areas.Config.Models.DocumentTemplate
         public static ValidationResult ValidateCreateModel(CreateModel model)
         {
 
-            if (model.DocumentTemplate != null && model.DocumentTemplate.Scope == Disco.Models.Repository.DocumentTemplate.DocumentTemplateScopes.Job)
+            if (model.Scope == Disco.Models.Repository.DocumentTemplate.DocumentTemplateScopes.Job)
             {
                 if (model.Types != null && model.SubTypes != null)
                 {

Disco.Web/Areas/Config/Models/DocumentTemplate/CreatePackageModel.cs

@@ -1,20 +1,21 @@
-using Disco.Models.Services.Documents;
+using Disco.Models.Repository;
 using Disco.Models.UI.Config.DocumentTemplate;
 using System.Collections.Generic;
+using System.ComponentModel.DataAnnotations;
 
 namespace Disco.Web.Areas.Config.Models.DocumentTemplate
 {
     public class CreatePackageModel : ConfigDocumentTemplateCreatePackageModel
     {
-        public DocumentTemplatePackage Package { get; set; }
+        [StringLength(30), Required]
+        public string Id { get; set; }
+        [StringLength(250), Required]
+        public string Description { get; set; }
+        [Required]
+        public AttachmentTypes Scope { get; set; }
 
         public List<string> Scopes
-        {
-            get
-            {
-                return Disco.Models.Repository.DocumentTemplate.DocumentTemplateScopes.ToList();
-            }
-        }
+            => Disco.Models.Repository.DocumentTemplate.DocumentTemplateScopes.ToList();
 
     }
 

Disco.Web/Areas/Config/Models/DocumentTemplate/ShowModel.cs

@@ -5,6 +5,7 @@ using Disco.Models.UI.Config.DocumentTemplate;
 using Disco.Services;
 using Disco.Services.Documents.ManagedGroups;
 using Disco.Services.Expressions;
+using System;
 using System.Collections.Generic;
 using System.Linq;
 
@@ -36,7 +37,7 @@ namespace Disco.Web.Areas.Config.Models.DocumentTemplate
         public DocumentTemplateDevicesManagedGroup DevicesLinkedGroup { get; set; }
         public DocumentTemplateUsersManagedGroup UsersLinkedGroup { get; set; }
 
-        public string BulkGenerateDownloadId { get; set; }
+        public Guid? BulkGenerateDownloadId { get; set; }
 
         public string BulkGenerateDownloadFilename { get; set; }
 

Disco.Web/Areas/Config/Models/JobQueue/CreateModel.cs

@@ -1,9 +1,13 @@
 using Disco.Models.UI.Config.JobQueue;
+using System.ComponentModel.DataAnnotations;
 
 namespace Disco.Web.Areas.Config.Models.JobQueue
 {
     public class CreateModel : ConfigJobQueueCreateModel
     {
-        public Disco.Models.Repository.JobQueue JobQueue { get; set; }
+        [Required, StringLength(100)]
+        public string Name { get; set; }
+        [StringLength(500), DataType(DataType.MultilineText)]
+        public string Description { get; set; }
     }
 }

Disco.Web/Areas/Config/Models/UserFlag/CreateModel.cs

@@ -1,9 +1,14 @@
 using Disco.Models.UI.Config.UserFlag;
+using System.ComponentModel.DataAnnotations;
 
 namespace Disco.Web.Areas.Config.Models.UserFlag
 {
     public class CreateModel : ConfigUserFlagCreateModel
     {
-        public Disco.Models.Repository.UserFlag UserFlag { get; set; }
+        [Required, StringLength(100)]
+        public string Name { get; set; }
+
+        [StringLength(500), DataType(DataType.MultilineText)]
+        public string Description { get; set; }
     }
 }

Disco.Web/Areas/Config/Views/AuthorizationRole/Create.cshtml

@@ -4,7 +4,8 @@
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Authorization Roles", MVC.Config.AuthorizationRole.Index(null), "Create");
 }
 @using (Html.BeginForm())
-{ 
+{
+    @Html.AntiForgeryToken()
     <div class="form" style="width: 450px">
         <table>
             <tr>
@@ -12,7 +13,7 @@
                     Name:
                 </th>
                 <td>
-                    @Html.EditorFor(model => model.AuthorizationRole.Name)<br />@Html.ValidationMessageFor(model => model.AuthorizationRole.Name)
+                    @Html.EditorFor(model => model.Name)<br />@Html.ValidationMessageFor(model => model.Name)
                 </td>
             </tr>
         </table>
@@ -22,7 +23,7 @@
     </div>
     <script type="text/javascript">
         $(function () {
-            $('#AuthorizationRole_Name').focus().select();
+            $('#Name').focus().select();
         });
     </script>
 }

Disco.Web/Areas/Config/Views/AuthorizationRole/Create.generated.cs

@@ -57,7 +57,21 @@ WriteLiteral("\r\n");
             
             #line 6 "..\..\Areas\Config\Views\AuthorizationRole\Create.cshtml"
  using (Html.BeginForm())
-{ 
+{
+    
+            
+            #line default
+            #line hidden
+            
+            #line 8 "..\..\Areas\Config\Views\AuthorizationRole\Create.cshtml"
+Write(Html.AntiForgeryToken());
+
+            
+            #line default
+            #line hidden
+            
+            #line 8 "..\..\Areas\Config\Views\AuthorizationRole\Create.cshtml"
+                            
 
             
             #line default
@@ -74,8 +88,8 @@ WriteLiteral(">\r\n        <table>\r\n            <tr>\r\n                <th>\r
 WriteLiteral("                    ");
 
             
-            #line 15 "..\..\Areas\Config\Views\AuthorizationRole\Create.cshtml"
-               Write(Html.EditorFor(model => model.AuthorizationRole.Name));
+            #line 16 "..\..\Areas\Config\Views\AuthorizationRole\Create.cshtml"
+               Write(Html.EditorFor(model => model.Name));
 
             
             #line default
@@ -83,8 +97,8 @@ WriteLiteral("                    ");
 WriteLiteral("<br />");
 
             
-            #line 15 "..\..\Areas\Config\Views\AuthorizationRole\Create.cshtml"
-                                                                           Write(Html.ValidationMessageFor(model => model.AuthorizationRole.Name));
+            #line 16 "..\..\Areas\Config\Views\AuthorizationRole\Create.cshtml"
+                                                         Write(Html.ValidationMessageFor(model => model.Name));
 
             
             #line default
@@ -107,11 +121,11 @@ WriteLiteral("    <script");
 
 WriteLiteral(" type=\"text/javascript\"");
 
-WriteLiteral(">\r\n        $(function () {\r\n            $(\'#AuthorizationRole_Name\').focus().sele" +
-"ct();\r\n        });\r\n    </script>\r\n");
+WriteLiteral(">\r\n        $(function () {\r\n            $(\'#Name\').focus().select();\r\n        });" +
+"\r\n    </script>\r\n");
 
             
-            #line 28 "..\..\Areas\Config\Views\AuthorizationRole\Create.cshtml"
+            #line 29 "..\..\Areas\Config\Views\AuthorizationRole\Create.cshtml"
 }
 
             

Disco.Web/Areas/Config/Views/AuthorizationRole/Index.cshtml

@@ -7,15 +7,17 @@
 {
     <div class="form" style="width: 450px; padding: 100px 0;">
         <h2>No authorization roles are configured</h2>
-    </div>  
+    </div>
 }
 else
 {
     <table class="tableData">
         <tr>
-            <th>Name
+            <th>
+                Name
             </th>
-            <th>Linked Groups/Users
+            <th>
+                Linked Groups/Users
             </th>
         </tr>
         @foreach (var item in Model.Tokens)
@@ -39,58 +41,75 @@ else
     </table>
 }
 <!-- #region Administrator Subjects -->
-<div id="Config_AuthRoles_Subjects_Update_Dialog" class="dialog" title="Disco ICT Administrators">
-    <div id="Config_AuthRoles_Subjects_Update_Dialog_ListContainer">
-        <span id="Config_AuthRoles_Subjects_Update_Dialog_None" class="smallMessage">None Associated</span>
-        <ul id="Config_AuthRoles_Subjects_Update_Dialog_List" class="none">
-            @foreach (var sg in Model.AdministratorSubjects)
-            {
-                var displayName = sg.Id == sg.Name ? sg.Id : string.Format("{0} [{1}]", sg.Name, sg.Id);
-                <li class="@(sg.IsGroup ? "group" : "user")" data-subjectid="@sg.Id">@if (sg.IsGroup)
-                                                                                     {
-                    <i class="fa fa-users fa-lg"></i>@displayName
-                                                                                     }
-                                                                                     else
-                                                                                     {
-                    <i class="fa fa-user fa-lg"></i>@displayName
-                                                                                     }<i class="fa fa-times-circle remove"></i></li>
-            }
-        </ul>
-    </div>
+<div id="Config_AuthRoles_Subjects_Update_Dialog" class="dialog" title="Disco ICT Administrators" data-searchsubjectsurl="@(Url.Action(MVC.API.System.SearchSubjects()))" data-subjecturl="@Url.Action(MVC.API.System.Subject())">
+    @using (Html.BeginForm(MVC.API.AuthorizationRole.UpdateAdministratorSubjects(null, true)))
+    {
+        @Html.AntiForgeryToken()
+        <div id="Config_AuthRoles_Subjects_Update_Dialog_ListContainer">
+            <span id="Config_AuthRoles_Subjects_Update_Dialog_None" class="smallMessage">None Associated</span>
+            <ul id="Config_AuthRoles_Subjects_Update_Dialog_List" class="none">
+                @foreach (var sg in Model.AdministratorSubjects)
+                {
+                    var displayName = sg.Id == sg.Name ? sg.Id : string.Format("{0} [{1}]", sg.Name, sg.Id);
+                    <li class="@(sg.IsGroup ? "group" : "user")" data-subjectid="@sg.Id">
+                        <input type="hidden" name="subjects" value="@sg.Id" />
+                        @if (sg.IsGroup)
+                        {
+                            <i class="fa fa-users fa-lg"></i>@displayName
+                        }
+                        else
+                        {
+                            <i class="fa fa-user fa-lg"></i>@displayName
+                        }<i class="fa fa-times-circle remove"></i>
+                    </li>
+                }
+            </ul>
+        </div>
+    }
     <div id="Config_AuthRoles_Subjects_Update_Dialog_AddContainer">
         <input type="text" id="Config_AuthRoles_Subjects_Update_Dialog_TextAdd" />
-        <a id="Config_AuthRoles_Subjects_Update_Dialog_Add" href="#" class="button small">Add</a>
+        <button id="Config_AuthRoles_Subjects_Update_Dialog_Add" type="button" class="button small">Add</button>
     </div>
-    <form id="Config_AuthRoles_Subjects_Update_Dialog_Form" action="@(Url.Action(MVC.API.AuthorizationRole.UpdateAdministratorSubjects(null, true)))" method="post"></form>
 </div>
 <script>
     (function () {
-        var dialog, textAdd, list, noSubjects, form;
+        let dialog = null;
+        let originalList = null;
+        let list = null;
+        let textAdd = null;
+        let noSubjects = null;
 
         function showDialog() {
             if (!dialog) {
+                list = $('#Config_AuthRoles_Subjects_Update_Dialog_List');
+                originalList = list.html();
+                noSubjects = $('#Config_AuthRoles_Subjects_Update_Dialog_None');
+                textAdd = $('#Config_AuthRoles_Subjects_Update_Dialog_TextAdd');
+
                 dialog = $('#Config_AuthRoles_Subjects_Update_Dialog').dialog({
                     resizable: false,
                     modal: true,
                     autoOpen: false,
                     width: 350,
-                    height: 420,
                     buttons: {
                         "Save Changes": saveChanges,
-                        Cancel: cancel
+                        Cancel: function () {
+                            $(this).dialog("close");
+                        }
+                    },
+                    close: function () {
+                        list.html(originalList);
                     }
                 });
 
-                dialog.on('click', '.remove', remove);
-
-                list = $('#Config_AuthRoles_Subjects_Update_Dialog_List');
-                noSubjects = $('#Config_AuthRoles_Subjects_Update_Dialog_None');
-
-                textAdd = $('#Config_AuthRoles_Subjects_Update_Dialog_TextAdd');
+                dialog.on('click', '.remove', function () {
+                    $(this).closest('li').remove();
+                    updateNoSubjects();
+                });
 
                 textAdd.watermark('Search Subjects')
                     .autocomplete({
-                        source: '@(Url.Action(MVC.API.System.SearchSubjects()))',
+                        source: dialog.attr('data-searchsubjectsurl'),
                         minLength: 2,
                         focus: function (e, ui) {
                             textAdd.val(ui.item.Id);
@@ -98,6 +117,7 @@ else
                         },
                         select: function (e, ui) {
                             textAdd.val(ui.item.Id).blur();
+                            $('#Config_AuthRoles_Subjects_Update_Dialog_Add').trigger('click');
                             return false;
                         }
                     }).data('ui-autocomplete')._renderItem = function (ul, item) {
@@ -107,7 +127,7 @@ else
                             .appendTo(ul);
                     };
 
-                $('#Config_AuthRoles_Subjects_Update_Dialog_Add').click(add);
+                $('#Config_AuthRoles_Subjects_Update_Dialog_Add').on('click', add);
             }
 
             dialog.dialog('open');
@@ -116,79 +136,61 @@ else
             return false;
         }
 
-        function cancel() {
-            $(this).dialog("close");
+        async function add() {
+            const id = textAdd.val();
 
-            list.find('li').each(function () {
-                $this = $(this);
-                if ($this.is('[data-subjectstatus="new"]')) {
-                    $this.remove();
-                } else {
-                    if ($this.is('[data-subjectstatus="removed"]')) {
-                        $this.show();
+            try {
+                const body = new FormData();
+                body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                body.append('id', id);
+                const response = await fetch(dialog.attr('data-subjecturl'), {
+                    method: 'POST',
+                    body: body
+                });
+
+                if (response.ok) {
+                    const data = await response.json();
+
+                    if (!data)
+                        throw 'Unknown user id';
+
+                    if (!data.IsGroup && !data.IsUserAccount)
+                        throw data.Name + ' [' + data.Id + '] is a ' + data.Type + '. Only users and groups can be added.';
+
+                    if (list.find('li[data-subjectid="' + data.Id.replace('\\', '\\\\') + '"]').length != 0) {
+                        throw 'That subject has already been added';
                     }
+
+                    const liIcon = $('<i>').addClass('fa fa-lg');
+                    if (data.Type === 'user')
+                        liIcon.addClass('fa-user');
+                    else
+                        liIcon.addClass('fa-users');
+
+                    const li = $('<li>')
+                        .append($('<input>').attr({ type: 'hidden', name: 'subjects', value: data.Id }))
+                        .append(liIcon)
+                        .append($('<span>').text(data.Id == data.Name ? data.Id : data.Name + ' [' + data.Id + ']'))
+                        .append($('<i>').addClass('fa fa-times-circle remove'))
+                        .addClass(data.Type)
+                        .attr('data-subjectid', data.Id)
+                        .attr('data-subjectstatus', 'new');
+
+                    list.append(li);
+                    textAdd.val('');
+
+                    updateNoSubjects();
+                } else {
+                    alert('Error: ' + response.statusText);
                 }
-            });
-        }
 
-        function remove() {
-            $this = $(this).closest('li');
-
-            if ($this.is('[data-subjectstatus="new"]')) {
-                $this.remove();
-            } else {
-                $this.attr('data-subjectstatus', 'removed').hide();
+            } catch (e) {
+                alert('Error: ' + e);
             }
 
-            updateNoSubjects();
             return false;
         }
 
-        function add() {
-            var id = textAdd.val();
-
-            $.ajax({
-                url: '@Url.Action(MVC.API.System.Subject())',
-                method: 'post',
-                data: { Id: id }
-            }).done(function (response) {
-                if (response) {
-                    if (response.IsGroup || response.IsUserAccount) {
-                        if (list.find('li[data-subjectid="' + response.Id.replace('\\', '\\\\') + '"]').length == 0) {
-
-                            var liIcon = $('<i>').addClass('fa fa-lg');
-                            if (response.Type === 'user')
-                                liIcon.addClass('fa-user');
-                            else
-                                liIcon.addClass('fa-users');
-
-                            var li = $('<li>')
-                                .append(liIcon)
-                                .append($('<span>').text(response.Id == response.Name ? response.Id : response.Name + ' [' + response.Id + ']'))
-                                .append($('<i>').addClass('fa fa-times-circle remove'))
-                                .addClass(response.Type)
-                                .attr('data-subjectid', response.Id)
-                                .attr('data-subjectstatus', 'new');
-
-                            list.append(li);
-
-                            updateNoSubjects();
-                        } else {
-                            alert('That subject has already been added');
-                        }
-                    }
-                    else {
-                        alert(response.Name + ' ['+response.Id+'] is a ' + response.Type + '. Only users and groups can be added.');
-                    }
-                } else {
-                    alert('Unknown Id');
-                }
-            }).fail(function (jqXHR, textStatus, errorThrown) {
-                alert('Error: ' + errorThrown);
-            });
-                return false;
-            }
-
         function updateNoSubjects() {
             if (list.find('li:visible').length > 0)
                 noSubjects.hide();
@@ -197,22 +199,9 @@ else
         }
 
         function saveChanges() {
-            var form = $('#Config_AuthRoles_Subjects_Update_Dialog_Form').empty();
-
-            list.find('li[data-subjectstatus!="removed"]').each(function () {
-                var subjectId = $(this).attr('data-subjectid');
-
-                form.append($('<input>').attr({
-                    'name': 'Subjects',
-                    'type': 'hidden'
-                }).val(subjectId));
-
-            }).get();
-
-            form.submit();
-
-            dialog.dialog("disable");
-            dialog.dialog("option", "buttons", null);
+            dialog
+                .dialog("option", "buttons", null)
+                .find('form').trigger('submit');
         }
 
         $(function () {

Disco.Web/Areas/Config/Views/AuthorizationRole/Index.generated.cs

@@ -68,7 +68,7 @@ WriteLiteral(" class=\"form\"");
 
 WriteLiteral(" style=\"width: 450px; padding: 100px 0;\"");
 
-WriteLiteral(">\r\n        <h2>No authorization roles are configured</h2>\r\n    </div>  \r\n");
+WriteLiteral(">\r\n        <h2>No authorization roles are configured</h2>\r\n    </div>\r\n");
 
             
             #line 11 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
@@ -83,17 +83,18 @@ WriteLiteral("    <table");
 
 WriteLiteral(" class=\"tableData\"");
 
-WriteLiteral(">\r\n        <tr>\r\n            <th>Name\r\n            </th>\r\n            <th>Linked " +
-"Groups/Users\r\n            </th>\r\n        </tr>\r\n");
+WriteLiteral(">\r\n        <tr>\r\n            <th>\r\n                Name\r\n            </th>\r\n     " +
+"       <th>\r\n                Linked Groups/Users\r\n            </th>\r\n        </t" +
+"r>\r\n");
 
             
-            #line 21 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+            #line 23 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
         
             
             #line default
             #line hidden
             
-            #line 21 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+            #line 23 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
          foreach (var item in Model.Tokens)
         {
 
@@ -105,7 +106,7 @@ WriteLiteral("            <tr>\r\n                <td>\r\n");
 WriteLiteral("                    ");
 
             
-            #line 25 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+            #line 27 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
                Write(Html.ActionLink(item.Role.Name, MVC.Config.AuthorizationRole.Index(item.Role.Id)));
 
             
@@ -114,13 +115,13 @@ WriteLiteral("                    ");
 WriteLiteral("\r\n                </td>\r\n                <td>\r\n");
 
             
-            #line 28 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+            #line 30 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
                     
             
             #line default
             #line hidden
             
-            #line 28 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+            #line 30 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
                      if (item.SubjectIds.Count == 0)
                     {
 
@@ -134,7 +135,7 @@ WriteLiteral(" class=\"smallMessage\"");
 WriteLiteral(">&lt;None&gt;</span>\r\n");
 
             
-            #line 31 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+            #line 33 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
                     }
                     else
                     {
@@ -143,14 +144,14 @@ WriteLiteral(">&lt;None&gt;</span>\r\n");
             #line default
             #line hidden
             
-            #line 34 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+            #line 36 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
                     Write(string.Join(", ", item.SubjectIds.OrderBy(i => i)));
 
             
             #line default
             #line hidden
             
-            #line 34 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+            #line 36 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
                                                                              
                     }
 
@@ -160,7 +161,7 @@ WriteLiteral(">&lt;None&gt;</span>\r\n");
 WriteLiteral("                </td>\r\n            </tr>\r\n");
 
             
-            #line 38 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+            #line 40 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
         }
 
             
@@ -169,7 +170,7 @@ WriteLiteral("                </td>\r\n            </tr>\r\n");
 WriteLiteral("    </table>\r\n");
 
             
-            #line 40 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+            #line 42 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
 }
 
             
@@ -183,17 +184,69 @@ WriteLiteral(" class=\"dialog\"");
 
 WriteLiteral(" title=\"Disco ICT Administrators\"");
 
-WriteLiteral(">\r\n    <div");
+WriteLiteral(" data-searchsubjectsurl=\"");
+
+            
+            #line 44 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                                                                                                                      Write(Url.Action(MVC.API.System.SearchSubjects()));
+
+            
+            #line default
+            #line hidden
+WriteLiteral("\"");
+
+WriteLiteral(" data-subjecturl=\"");
+
+            
+            #line 44 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                                                                                                                                                                                      Write(Url.Action(MVC.API.System.Subject()));
+
+            
+            #line default
+            #line hidden
+WriteLiteral("\"");
+
+WriteLiteral(">\r\n");
+
+            
+            #line 45 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+    
+            
+            #line default
+            #line hidden
+            
+            #line 45 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+     using (Html.BeginForm(MVC.API.AuthorizationRole.UpdateAdministratorSubjects(null, true)))
+    {
+        
+            
+            #line default
+            #line hidden
+            
+            #line 47 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+   Write(Html.AntiForgeryToken());
+
+            
+            #line default
+            #line hidden
+            
+            #line 47 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                                
+
+            
+            #line default
+            #line hidden
+WriteLiteral("        <div");
 
 WriteLiteral(" id=\"Config_AuthRoles_Subjects_Update_Dialog_ListContainer\"");
 
-WriteLiteral(">\r\n        <span");
+WriteLiteral(">\r\n            <span");
 
 WriteLiteral(" id=\"Config_AuthRoles_Subjects_Update_Dialog_None\"");
 
 WriteLiteral(" class=\"smallMessage\"");
 
-WriteLiteral(">None Associated</span>\r\n        <ul");
+WriteLiteral(">None Associated</span>\r\n            <ul");
 
 WriteLiteral(" id=\"Config_AuthRoles_Subjects_Update_Dialog_List\"");
 
@@ -202,105 +255,127 @@ WriteLiteral(" class=\"none\"");
 WriteLiteral(">\r\n");
 
             
-            #line 46 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-            
+            #line 51 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                
             
             #line default
             #line hidden
             
-            #line 46 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-             foreach (var sg in Model.AdministratorSubjects)
-            {
-                var displayName = sg.Id == sg.Name ? sg.Id : string.Format("{0} [{1}]", sg.Name, sg.Id);
+            #line 51 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                 foreach (var sg in Model.AdministratorSubjects)
+                {
+                    var displayName = sg.Id == sg.Name ? sg.Id : string.Format("{0} [{1}]", sg.Name, sg.Id);
 
             
             #line default
             #line hidden
-WriteLiteral("                <li");
+WriteLiteral("                    <li");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 1809), Tuple.Create("\"", 1849)
+WriteAttribute("class", Tuple.Create(" class=\"", 2136), Tuple.Create("\"", 2176)
             
-            #line 49 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-, Tuple.Create(Tuple.Create("", 1817), Tuple.Create<System.Object, System.Int32>(sg.IsGroup ? "group" : "user"
+            #line 54 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+, Tuple.Create(Tuple.Create("", 2144), Tuple.Create<System.Object, System.Int32>(sg.IsGroup ? "group" : "user"
             
             #line default
             #line hidden
-, 1817), false)
+, 2144), false)
 );
 
 WriteLiteral(" data-subjectid=\"");
 
             
-            #line 49 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-                                                                        Write(sg.Id);
+            #line 54 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                                                                            Write(sg.Id);
 
             
             #line default
             #line hidden
 WriteLiteral("\"");
 
-WriteLiteral(">");
+WriteLiteral(">\r\n                        <input");
+
+WriteLiteral(" type=\"hidden\"");
+
+WriteLiteral(" name=\"subjects\"");
+
+WriteAttribute("value", Tuple.Create(" value=\"", 2264), Tuple.Create("\"", 2278)
+            
+            #line 55 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+, Tuple.Create(Tuple.Create("", 2272), Tuple.Create<System.Object, System.Int32>(sg.Id
+            
+            #line default
+            #line hidden
+, 2272), false)
+);
+
+WriteLiteral(" />\r\n");
 
             
-            #line 49 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-                                                                                      if (sg.IsGroup)
-                                                                                     {
+            #line 56 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                        
+            
+            #line default
+            #line hidden
+            
+            #line 56 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                         if (sg.IsGroup)
+                        {
 
             
             #line default
             #line hidden
-WriteLiteral("                    <i");
+WriteLiteral("                            <i");
 
 WriteLiteral(" class=\"fa fa-users fa-lg\"");
 
 WriteLiteral("></i>");
 
             
-            #line 51 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-                                                     
+            #line 58 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                                                             
             
             #line default
             #line hidden
             
-            #line 51 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-                                                Write(displayName);
+            #line 58 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                                                        Write(displayName);
 
             
             #line default
             #line hidden
             
-            #line 51 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-                                                                 
-                                                                                     }
-                                                                                     else
-                                                                                     {
+            #line 58 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                                                                         
+                        }
+                        else
+                        {
 
             
             #line default
             #line hidden
-WriteLiteral("                    <i");
+WriteLiteral("                            <i");
 
 WriteLiteral(" class=\"fa fa-user fa-lg\"");
 
 WriteLiteral("></i>");
 
             
-            #line 55 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-                                                    
+            #line 62 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                                                            
             
             #line default
             #line hidden
             
-            #line 55 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-                                               Write(displayName);
+            #line 62 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                                                       Write(displayName);
 
             
             #line default
             #line hidden
             
-            #line 55 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-                                                                
-                                                                                     }
+            #line 62 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                                                                        
+                        }
             
             #line default
             #line hidden
@@ -308,16 +383,25 @@ WriteLiteral("<i");
 
 WriteLiteral(" class=\"fa fa-times-circle remove\"");
 
-WriteLiteral("></i></li>\r\n");
+WriteLiteral("></i>\r\n                    </li>\r\n");
 
             
-            #line 57 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-            }
+            #line 65 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                }
 
             
             #line default
             #line hidden
-WriteLiteral("        </ul>\r\n    </div>\r\n    <div");
+WriteLiteral("            </ul>\r\n        </div>\r\n");
+
+            
+            #line 68 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+    }
+
+            
+            #line default
+            #line hidden
+WriteLiteral("    <div");
 
 WriteLiteral(" id=\"Config_AuthRoles_Subjects_Update_Dialog_AddContainer\"");
 
@@ -327,136 +411,81 @@ WriteLiteral(" type=\"text\"");
 
 WriteLiteral(" id=\"Config_AuthRoles_Subjects_Update_Dialog_TextAdd\"");
 
-WriteLiteral(" />\r\n        <a");
+WriteLiteral(" />\r\n        <button");
 
 WriteLiteral(" id=\"Config_AuthRoles_Subjects_Update_Dialog_Add\"");
 
-WriteLiteral(" href=\"#\"");
+WriteLiteral(" type=\"button\"");
 
 WriteLiteral(" class=\"button small\"");
 
-WriteLiteral(">Add</a>\r\n    </div>\r\n    <form");
-
-WriteLiteral(" id=\"Config_AuthRoles_Subjects_Update_Dialog_Form\"");
-
-WriteAttribute("action", Tuple.Create(" action=\"", 2880), Tuple.Create("\"", 2969)
-            
-            #line 64 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-, Tuple.Create(Tuple.Create("", 2889), Tuple.Create<System.Object, System.Int32>(Url.Action(MVC.API.AuthorizationRole.UpdateAdministratorSubjects(null, true))
-            
-            #line default
-            #line hidden
-, 2889), false)
-);
-
-WriteLiteral(" method=\"post\"");
-
-WriteLiteral(@"></form>
-</div>
-<script>
-    (function () {
-        var dialog, textAdd, list, noSubjects, form;
-
-        function showDialog() {
-            if (!dialog) {
-                dialog = $('#Config_AuthRoles_Subjects_Update_Dialog').dialog({
-                    resizable: false,
-                    modal: true,
-                    autoOpen: false,
-                    width: 350,
-                    height: 420,
-                    buttons: {
-                        ""Save Changes"": saveChanges,
-                        Cancel: cancel
-                    }
-                });
-
-                dialog.on('click', '.remove', remove);
-
-                list = $('#Config_AuthRoles_Subjects_Update_Dialog_List');
-                noSubjects = $('#Config_AuthRoles_Subjects_Update_Dialog_None');
-
-                textAdd = $('#Config_AuthRoles_Subjects_Update_Dialog_TextAdd');
-
-                textAdd.watermark('Search Subjects')
-                    .autocomplete({
-                        source: '");
-
-            
-            #line 93 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-                             Write(Url.Action(MVC.API.System.SearchSubjects()));
-
-            
-            #line default
-            #line hidden
-WriteLiteral("\',\r\n                        minLength: 2,\r\n                        focus: functio" +
-"n (e, ui) {\r\n                            textAdd.val(ui.item.Id);\r\n             " +
-"               return false;\r\n                        },\r\n                      " +
-"  select: function (e, ui) {\r\n                            textAdd.val(ui.item.Id" +
-").blur();\r\n                            return false;\r\n                        }\r" +
-"\n                    }).data(\'ui-autocomplete\')._renderItem = function (ul, item" +
-") {\r\n                        return $(\"<li></li>\")\r\n                            " +
-".data(\"item.autocomplete\", item)\r\n                            .append(\"<a><stron" +
-"g>\" + item.Name + \"</strong><br>\" + item.Id + \" (\" + item.Type + \")</a>\")\r\n     " +
-"                       .appendTo(ul);\r\n                    };\r\n\r\n               " +
-" $(\'#Config_AuthRoles_Subjects_Update_Dialog_Add\').click(add);\r\n            }\r\n\r" +
-"\n            dialog.dialog(\'open\');\r\n\r\n            updateNoSubjects();\r\n        " +
-"    return false;\r\n        }\r\n\r\n        function cancel() {\r\n            $(this)" +
-".dialog(\"close\");\r\n\r\n            list.find(\'li\').each(function () {\r\n           " +
-"     $this = $(this);\r\n                if ($this.is(\'[data-subjectstatus=\"new\"]\'" +
-")) {\r\n                    $this.remove();\r\n                } else {\r\n           " +
-"         if ($this.is(\'[data-subjectstatus=\"removed\"]\')) {\r\n                    " +
-"    $this.show();\r\n                    }\r\n                }\r\n            });\r\n  " +
-"      }\r\n\r\n        function remove() {\r\n            $this = $(this).closest(\'li\'" +
-");\r\n\r\n            if ($this.is(\'[data-subjectstatus=\"new\"]\')) {\r\n               " +
-" $this.remove();\r\n            } else {\r\n                $this.attr(\'data-subject" +
-"status\', \'removed\').hide();\r\n            }\r\n\r\n            updateNoSubjects();\r\n " +
-"           return false;\r\n        }\r\n\r\n        function add() {\r\n            var" +
-" id = textAdd.val();\r\n\r\n            $.ajax({\r\n                url: \'");
-
-            
-            #line 151 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-                 Write(Url.Action(MVC.API.System.Subject()));
-
-            
-            #line default
-            #line hidden
-WriteLiteral("\',\r\n                method: \'post\',\r\n                data: { Id: id }\r\n          " +
-"  }).done(function (response) {\r\n                if (response) {\r\n              " +
-"      if (response.IsGroup || response.IsUserAccount) {\r\n                       " +
-" if (list.find(\'li[data-subjectid=\"\' + response.Id.replace(\'\\\\\', \'\\\\\\\\\') + \'\"]\')" +
-".length == 0) {\r\n\r\n                            var liIcon = $(\'<i>\').addClass(\'f" +
-"a fa-lg\');\r\n                            if (response.Type === \'user\')\r\n         " +
-"                       liIcon.addClass(\'fa-user\');\r\n                            " +
-"else\r\n                                liIcon.addClass(\'fa-users\');\r\n\r\n          " +
-"                  var li = $(\'<li>\')\r\n                                .append(li" +
-"Icon)\r\n                                .append($(\'<span>\').text(response.Id == r" +
-"esponse.Name ? response.Id : response.Name + \' [\' + response.Id + \']\'))\r\n       " +
-"                         .append($(\'<i>\').addClass(\'fa fa-times-circle remove\'))" +
-"\r\n                                .addClass(response.Type)\r\n                    " +
-"            .attr(\'data-subjectid\', response.Id)\r\n                              " +
-"  .attr(\'data-subjectstatus\', \'new\');\r\n\r\n                            list.append" +
-"(li);\r\n\r\n                            updateNoSubjects();\r\n                      " +
-"  } else {\r\n                            alert(\'That subject has already been add" +
-"ed\');\r\n                        }\r\n                    }\r\n                    els" +
-"e {\r\n                        alert(response.Name + \' [\'+response.Id+\'] is a \' + " +
-"response.Type + \'. Only users and groups can be added.\');\r\n                    }" +
-"\r\n                } else {\r\n                    alert(\'Unknown Id\');\r\n          " +
-"      }\r\n            }).fail(function (jqXHR, textStatus, errorThrown) {\r\n      " +
-"          alert(\'Error: \' + errorThrown);\r\n            });\r\n                retu" +
-"rn false;\r\n            }\r\n\r\n        function updateNoSubjects() {\r\n            i" +
-"f (list.find(\'li:visible\').length > 0)\r\n                noSubjects.hide();\r\n    " +
-"        else\r\n                noSubjects.show();\r\n        }\r\n\r\n        function " +
-"saveChanges() {\r\n            var form = $(\'#Config_AuthRoles_Subjects_Update_Dia" +
-"log_Form\').empty();\r\n\r\n            list.find(\'li[data-subjectstatus!=\"removed\"]\'" +
-").each(function () {\r\n                var subjectId = $(this).attr(\'data-subject" +
-"id\');\r\n\r\n                form.append($(\'<input>\').attr({\r\n                    \'n" +
-"ame\': \'Subjects\',\r\n                    \'type\': \'hidden\'\r\n                }).val(" +
-"subjectId));\r\n\r\n            }).get();\r\n\r\n            form.submit();\r\n\r\n         " +
-"   dialog.dialog(\"disable\");\r\n            dialog.dialog(\"option\", \"buttons\", nul" +
-"l);\r\n        }\r\n\r\n        $(function () {\r\n            $(\'#Config_AuthRoles_Upda" +
-"teAdministrators\').click(showDialog);\r\n        });\r\n\r\n    })();\r\n</script>\r\n<!--" +
-" #endregion -->\r\n<div");
+WriteLiteral(">Add</button>\r\n    </div>\r\n</div>\r\n<script>\r\n    (function () {\r\n        let dial" +
+"og = null;\r\n        let originalList = null;\r\n        let list = null;\r\n        " +
+"let textAdd = null;\r\n        let noSubjects = null;\r\n\r\n        function showDial" +
+"og() {\r\n            if (!dialog) {\r\n                list = $(\'#Config_AuthRoles_" +
+"Subjects_Update_Dialog_List\');\r\n                originalList = list.html();\r\n   " +
+"             noSubjects = $(\'#Config_AuthRoles_Subjects_Update_Dialog_None\');\r\n " +
+"               textAdd = $(\'#Config_AuthRoles_Subjects_Update_Dialog_TextAdd\');\r" +
+"\n\r\n                dialog = $(\'#Config_AuthRoles_Subjects_Update_Dialog\').dialog" +
+"({\r\n                    resizable: false,\r\n                    modal: true,\r\n   " +
+"                 autoOpen: false,\r\n                    width: 350,\r\n            " +
+"        buttons: {\r\n                        \"Save Changes\": saveChanges,\r\n      " +
+"                  Cancel: function () {\r\n                            $(this).dia" +
+"log(\"close\");\r\n                        }\r\n                    },\r\n              " +
+"      close: function () {\r\n                        list.html(originalList);\r\n  " +
+"                  }\r\n                });\r\n\r\n                dialog.on(\'click\', \'" +
+".remove\', function () {\r\n                    $(this).closest(\'li\').remove();\r\n  " +
+"                  updateNoSubjects();\r\n                });\r\n\r\n                te" +
+"xtAdd.watermark(\'Search Subjects\')\r\n                    .autocomplete({\r\n       " +
+"                 source: dialog.attr(\'data-searchsubjectsurl\'),\r\n               " +
+"         minLength: 2,\r\n                        focus: function (e, ui) {\r\n     " +
+"                       textAdd.val(ui.item.Id);\r\n                            ret" +
+"urn false;\r\n                        },\r\n                        select: function" +
+" (e, ui) {\r\n                            textAdd.val(ui.item.Id).blur();\r\n       " +
+"                     $(\'#Config_AuthRoles_Subjects_Update_Dialog_Add\').trigger(\'" +
+"click\');\r\n                            return false;\r\n                        }\r\n" +
+"                    }).data(\'ui-autocomplete\')._renderItem = function (ul, item)" +
+" {\r\n                        return $(\"<li></li>\")\r\n                            ." +
+"data(\"item.autocomplete\", item)\r\n                            .append(\"<a><strong" +
+">\" + item.Name + \"</strong><br>\" + item.Id + \" (\" + item.Type + \")</a>\")\r\n      " +
+"                      .appendTo(ul);\r\n                    };\r\n\r\n                " +
+"$(\'#Config_AuthRoles_Subjects_Update_Dialog_Add\').on(\'click\', add);\r\n           " +
+" }\r\n\r\n            dialog.dialog(\'open\');\r\n\r\n            updateNoSubjects();\r\n   " +
+"         return false;\r\n        }\r\n\r\n        async function add() {\r\n           " +
+" const id = textAdd.val();\r\n\r\n            try {\r\n                const body = ne" +
+"w FormData();\r\n                body.append(\'__RequestVerificationToken\', documen" +
+"t.body.dataset.antiforgery);\r\n                body.append(\'id\', id);\r\n          " +
+"      const response = await fetch(dialog.attr(\'data-subjecturl\'), {\r\n          " +
+"          method: \'POST\',\r\n                    body: body\r\n                });\r\n" +
+"\r\n                if (response.ok) {\r\n                    const data = await res" +
+"ponse.json();\r\n\r\n                    if (!data)\r\n                        throw \'" +
+"Unknown user id\';\r\n\r\n                    if (!data.IsGroup && !data.IsUserAccoun" +
+"t)\r\n                        throw data.Name + \' [\' + data.Id + \'] is a \' + data." +
+"Type + \'. Only users and groups can be added.\';\r\n\r\n                    if (list." +
+"find(\'li[data-subjectid=\"\' + data.Id.replace(\'\\\\\', \'\\\\\\\\\') + \'\"]\').length != 0) " +
+"{\r\n                        throw \'That subject has already been added\';\r\n       " +
+"             }\r\n\r\n                    const liIcon = $(\'<i>\').addClass(\'fa fa-lg" +
+"\');\r\n                    if (data.Type === \'user\')\r\n                        liIc" +
+"on.addClass(\'fa-user\');\r\n                    else\r\n                        liIco" +
+"n.addClass(\'fa-users\');\r\n\r\n                    const li = $(\'<li>\')\r\n           " +
+"             .append($(\'<input>\').attr({ type: \'hidden\', name: \'subjects\', value" +
+": data.Id }))\r\n                        .append(liIcon)\r\n                        " +
+".append($(\'<span>\').text(data.Id == data.Name ? data.Id : data.Name + \' [\' + dat" +
+"a.Id + \']\'))\r\n                        .append($(\'<i>\').addClass(\'fa fa-times-cir" +
+"cle remove\'))\r\n                        .addClass(data.Type)\r\n                   " +
+"     .attr(\'data-subjectid\', data.Id)\r\n                        .attr(\'data-subje" +
+"ctstatus\', \'new\');\r\n\r\n                    list.append(li);\r\n                    " +
+"textAdd.val(\'\');\r\n\r\n                    updateNoSubjects();\r\n                } e" +
+"lse {\r\n                    alert(\'Error: \' + response.statusText);\r\n            " +
+"    }\r\n\r\n            } catch (e) {\r\n                alert(\'Error: \' + e);\r\n     " +
+"       }\r\n\r\n            return false;\r\n        }\r\n\r\n        function updateNoSub" +
+"jects() {\r\n            if (list.find(\'li:visible\').length > 0)\r\n                " +
+"noSubjects.hide();\r\n            else\r\n                noSubjects.show();\r\n      " +
+"  }\r\n\r\n        function saveChanges() {\r\n            dialog\r\n                .di" +
+"alog(\"option\", \"buttons\", null)\r\n                .find(\'form\').trigger(\'submit\')" +
+";\r\n        }\r\n\r\n        $(function () {\r\n            $(\'#Config_AuthRoles_Update" +
+"Administrators\').click(showDialog);\r\n        });\r\n\r\n    })();\r\n</script>\r\n<!-- #" +
+"endregion -->\r\n<div");
 
 WriteLiteral(" class=\"actionBar\"");
 
@@ -471,7 +500,7 @@ WriteLiteral(" class=\"button\"");
 WriteLiteral(">Update Disco ICT Administrators [");
 
             
-            #line 226 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+            #line 215 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
                                                                                                       Write(Model.AdministratorSubjects.Count);
 
             
@@ -482,7 +511,7 @@ WriteLiteral("]</a>\r\n");
 WriteLiteral("    ");
 
             
-            #line 227 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+            #line 216 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
 Write(Html.ActionLinkButton("Create Authorization Role", MVC.Config.AuthorizationRole.Create()));
 
             

Disco.Web/Areas/Config/Views/AuthorizationRole/Show.cshtml

@@ -11,16 +11,19 @@
 <div id="Config_AuthRoles_Show" class="form" style="width: 550px">
     <table>
         <tr>
-            <th style="width: 150px">Id:
+            <th style="width: 150px">
+                Id:
             </th>
             <td>
                 @Html.DisplayFor(model => model.Token.Role.Id)
             </td>
         </tr>
         <tr>
-            <th>Name:
+            <th>
+                Name:
             </th>
-            <td>@Html.EditorFor(model => model.Token.Role.Name)
+            <td>
+                @Html.EditorFor(model => model.Token.Role.Name)
                 @AjaxHelpers.AjaxSave()
                 @AjaxHelpers.AjaxLoader()
                 <script type="text/javascript">
@@ -48,71 +51,87 @@
                         @foreach (var sg in Model.Subjects)
                         {
                             var displayName = sg.Id == sg.Name ? sg.Id : string.Format("{0} [{1}]", sg.Name, sg.Id);
-                            <li class="@(sg.IsGroup ? "group" : "user")">@if (sg.IsGroup)
-                                                                         {
-                                <i class="fa fa-users fa-lg"></i>@displayName
-                                                                         }
-                                                                         else
-                                                                         {
-                                <a href="@(Url.Action(MVC.User.Show(sg.Id)))#UserDetailTab-Authorization"><i class="fa fa-user fa-lg"></i>@displayName</a>
-                                                                         }</li>
+                            <li class="@(sg.IsGroup ? "group" : "user")">
+                                @if (sg.IsGroup)
+                                {
+                                    <i class="fa fa-users fa-lg"></i>@displayName
+                                }
+                                else
+                                {
+                                    <a href="@(Url.Action(MVC.User.Show(sg.Id)))#UserDetailTab-Authorization"><i class="fa fa-user fa-lg"></i>@displayName</a>
+                                }
+                            </li>
                         }
                     </ul>
                 }
                 <div>
                     <a id="Config_AuthRoles_Subjects_Update" href="#" class="button small">Update</a>
-                    <div id="Config_AuthRoles_Subjects_Update_Dialog" class="dialog" title="Authorization Role Linked Groups/Users">
-                        <div id="Config_AuthRoles_Subjects_Update_Dialog_ListContainer">
-                            <span id="Config_AuthRoles_Subjects_Update_Dialog_None" class="smallMessage">None Associated</span>
-                            <ul id="Config_AuthRoles_Subjects_Update_Dialog_List" class="none">
-                                @foreach (var sg in Model.Subjects)
-                                {
-                                    var displayName = sg.Id == sg.Name ? sg.Id : string.Format("{0} [{1}]", sg.Name, sg.Id);
-                                    <li class="@(sg.IsGroup ? "group" : "user")" data-subjectid="@sg.Id">@if (sg.IsGroup)
-                                                                                                         {
-                                        <i class="fa fa-users fa-lg"></i>@displayName
-                                                                                                         }
-                                                                                                         else
-                                                                                                         {
-                                        <i class="fa fa-user fa-lg"></i>@displayName
-                                                                                                         }<i class="fa fa-times-circle remove"></i></li>
-                                }
-                            </ul>
-                        </div>
+                    <div id="Config_AuthRoles_Subjects_Update_Dialog" class="dialog" title="Authorization Role Linked Groups/Users" data-searchsubjectsurl="@(Url.Action(MVC.API.System.SearchSubjects()))" data-subjecturl="@Url.Action(MVC.API.System.Subject())">
+                        @using (Html.BeginForm(MVC.API.AuthorizationRole.UpdateSubjects(Model.Token.Role.Id, null, true)))
+                        {
+                            @Html.AntiForgeryToken()
+                            <div id="Config_AuthRoles_Subjects_Update_Dialog_ListContainer">
+                                <span id="Config_AuthRoles_Subjects_Update_Dialog_None" class="smallMessage">None Associated</span>
+                                <ul id="Config_AuthRoles_Subjects_Update_Dialog_List" class="none">
+                                    @foreach (var sg in Model.Subjects)
+                                    {
+                                        var displayName = sg.Id == sg.Name ? sg.Id : string.Format("{0} [{1}]", sg.Name, sg.Id);
+                                        <li class="@(sg.IsGroup ? "group" : "user")" data-subjectid="@sg.Id">
+                                            <input type="hidden" name="subjects" value="@sg.Id" />
+                                            @if (sg.IsGroup)
+                                            {
+                                                <i class="fa fa-users fa-lg"></i>@displayName
+                                            }
+                                            else
+                                            {
+                                                <i class="fa fa-user fa-lg"></i>@displayName
+                                            }<i class="fa fa-times-circle remove"></i>
+                                        </li>
+                                    }
+                                </ul>
+                            </div>
+                        }
                         <div id="Config_AuthRoles_Subjects_Update_Dialog_AddContainer">
                             <input type="text" id="Config_AuthRoles_Subjects_Update_Dialog_TextAdd" />
-                            <a id="Config_AuthRoles_Subjects_Update_Dialog_Add" href="#" class="button small">Add</a>
+                            <button id="Config_AuthRoles_Subjects_Update_Dialog_Add" type="button" class="button small">Add</button>
                         </div>
-                        <form id="Config_AuthRoles_Subjects_Update_Dialog_Form" action="@(Url.Action(MVC.API.AuthorizationRole.UpdateSubjects(Model.Token.Role.Id, null, true)))" method="post"></form>
                     </div>
                     <script>
-                        (function(){
-                            var dialog, textAdd, list, noSubjects, form;
-                            
-                            function showDialog(){
-                                if (!dialog){
+                        (function () {
+                            let dialog, textAdd, list, originalList, noSubjects;
+
+                            function showDialog() {
+                                if (!dialog) {
+                                    list = $('#Config_AuthRoles_Subjects_Update_Dialog_List');
+                                    originalList = list.html();
+                                    noSubjects = $('#Config_AuthRoles_Subjects_Update_Dialog_None');
+                                    textAdd = $('#Config_AuthRoles_Subjects_Update_Dialog_TextAdd');
+
                                     dialog = $('#Config_AuthRoles_Subjects_Update_Dialog').dialog({
                                         resizable: false,
                                         modal: true,
                                         autoOpen: false,
                                         width: 350,
-                                        height: 420,
                                         buttons: {
                                             "Save Changes": saveChanges,
-                                            Cancel: cancel
+                                            Cancel: function () {
+                                                $(this).dialog("close");
+                                            }
+                                        },
+                                        close: function () {
+                                            list.html(originalList);
                                         }
                                     });
 
-                                    dialog.on('click', '.remove', remove);
+                                    dialog.on('click', '.remove', function () {
+                                        $(this).closest('li').remove();
+                                        updateNoSubjects();
+                                    });
 
-                                    list = $('#Config_AuthRoles_Subjects_Update_Dialog_List');
-                                    noSubjects = $('#Config_AuthRoles_Subjects_Update_Dialog_None');
-
-                                    textAdd = $('#Config_AuthRoles_Subjects_Update_Dialog_TextAdd');
 
                                     textAdd.watermark('Search Subjects')
                                         .autocomplete({
-                                            source: '@(Url.Action(MVC.API.System.SearchSubjects()))',
+                                            source: dialog.attr('data-searchsubjectsurl'),
                                             minLength: 2,
                                             focus: function (e, ui) {
                                                 textAdd.val(ui.item.Id);
@@ -120,6 +139,7 @@
                                             },
                                             select: function (e, ui) {
                                                 textAdd.val(ui.item.Id).blur();
+                                                $('#Config_AuthRoles_Subjects_Update_Dialog_Add').trigger('click');
                                                 return false;
                                             }
                                         }).data('ui-autocomplete')._renderItem = function (ul, item) {
@@ -129,7 +149,7 @@
                                                 .appendTo(ul);
                                         };
 
-                                    $('#Config_AuthRoles_Subjects_Update_Dialog_Add').click(add);
+                                    $('#Config_AuthRoles_Subjects_Update_Dialog_Add').on('click', add);
                                 }
 
                                 dialog.dialog('open');
@@ -138,106 +158,75 @@
                                 return false;
                             }
 
-                            function cancel(){
-                                $(this).dialog("close");
+                            async function add() {
+                                const id = textAdd.val();
 
-                                list.find('li').each(function(){
-                                    $this = $(this);
-                                    if ($this.is('[data-subjectstatus="new"]')){
-                                        $this.remove();
-                                    }else{
-                                        if ($this.is('[data-subjectstatus="removed"]')){
-                                            $this.show();
+                                try {
+                                    const body = new FormData();
+                                    body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                                    body.append('id', id);
+                                    const response = await fetch(dialog.attr('data-subjecturl'), {
+                                        method: 'POST',
+                                        body: body
+                                    });
+
+                                    if (response.ok) {
+                                        const data = await response.json();
+
+                                        if (!data)
+                                            throw 'Unknown user id';
+
+                                        if (!data.IsGroup && !data.IsUserAccount)
+                                            throw data.Name + ' [' + data.Id + '] is a ' + data.Type + '. Only users and groups can be added.';
+
+                                        if (list.find('li[data-subjectid="' + data.Id.replace('\\', '\\\\') + '"]').length != 0) {
+                                            throw 'That subject has already been added';
                                         }
+
+                                        const liIcon = $('<i>').addClass('fa fa-lg');
+                                        if (data.Type === 'user')
+                                            liIcon.addClass('fa-user');
+                                        else
+                                            liIcon.addClass('fa-users');
+
+                                        const li = $('<li>')
+                                            .append($('<input>').attr({ type: 'hidden', name: 'subjects', value: data.Id }))
+                                            .append(liIcon)
+                                            .append($('<span>').text(data.Id == data.Name ? data.Id : data.Name + ' [' + data.Id + ']'))
+                                            .append($('<i>').addClass('fa fa-times-circle remove'))
+                                            .addClass(data.Type)
+                                            .attr('data-subjectid', data.Id)
+                                            .attr('data-subjectstatus', 'new');
+
+                                        list.append(li);
+                                        textAdd.val('');
+
+                                        updateNoSubjects();
+                                    } else {
+                                        alert('Error: ' + response.statusText);
                                     }
-                                });
-                            }
 
-                            function remove(){
-                                $this = $(this).closest('li');
-
-                                if ($this.is('[data-subjectstatus="new"]')){
-                                    $this.remove();
-                                }else{
-                                    $this.attr('data-subjectstatus', 'removed').hide();
+                                } catch (e) {
+                                    alert('Error: ' + e);
                                 }
 
-                                updateNoSubjects();
+                                return false;
                             }
 
-                            function add(){
-                                var id = textAdd.val();
-
-                                $.ajax({
-                                    url: '@Url.Action(MVC.API.System.Subject())',
-                                    method: 'post',
-                                    data: { Id: id }
-                                }).done(function(response){
-                                    if (response){
-                                        if (response.IsGroup || response.IsUserAccount) {
-                                            if (list.find('li[data-subjectid="'+response.Id.replace('\\', '\\\\')+'"]').length == 0){
-                                            
-                                                var liIcon = $('<i>').addClass('fa fa-lg');
-                                                if (response.Type === 'user')
-                                                    liIcon.addClass('fa-user');
-                                                else
-                                                    liIcon.addClass('fa-users');
-
-                                                var li = $('<li>')
-                                                    .append(liIcon)
-                                                    .append($('<span>').text(response.Id == response.Name ?  response.Id : response.Name + ' [' + response.Id + ']'))
-                                                    .append($('<i>').addClass('fa fa-times-circle remove'))
-                                                    .addClass(response.Type)
-                                                    .attr('data-subjectid', response.Id)
-                                                    .attr('data-subjectstatus', 'new');
-
-                                                list.append(li);
-
-                                                updateNoSubjects();                                        
-                                            }else{
-                                                alert('That subject has already been added');
-                                            }
-                                        }else{
-                                            alert(response.Name + ' ['+response.Id+'] is a ' + response.Type + '. Only users and groups can be added.');
-                                        }
-                                    }else{
-                                        alert('Unknown Id');
-                                    }
-                                }).fail(function(jqXHR, textStatus, errorThrown){
-                                    alert('Error: ' + errorThrown);
-                                });
-                                }
-
-                            function updateNoSubjects(){
+                            function updateNoSubjects() {
                                 if (list.find('li:visible').length > 0)
                                     noSubjects.hide();
                                 else
                                     noSubjects.show();
                             }
 
-                            function saveChanges(){
-                                var form = $('#Config_AuthRoles_Subjects_Update_Dialog_Form').empty();
-
-                                list.find('li[data-subjectstatus!="removed"]').each(function(){
-                                    var subjectId = $(this).attr('data-subjectid');
-                                    
-                                    form.append($('<input>').attr({
-                                        'name': 'Subjects',
-                                        'type': 'hidden'
-                                    }).val(subjectId));
-
-                                }).get();
-
-                                form.submit();
-
-                                dialog.dialog("disable");
-                                dialog.dialog("option", "buttons", null);
+                            function saveChanges() {
+                                dialog
+                                    .dialog("option", "buttons", null)
+                                    .find('form').trigger('submit');
                             }
 
-                            $(function(){
-                                $('#Config_AuthRoles_Subjects_Update').click(showDialog);
-                            });
-
+                            $('#Config_AuthRoles_Subjects_Update').click(showDialog);
                         })();
                     </script>
                 </div>
@@ -248,13 +237,16 @@
                 <div id="Config_AuthRoles_Claims_Tree">
                 </div>
                 <div>
-                    <a href="#" id="Config_AuthRoles_Claims_SaveChanges" class="button small disabled">Save Changes</a>@AjaxHelpers.AjaxLoader()
+                    <button type="button" id="Config_AuthRoles_Claims_SaveChanges" class="button small disabled" data-saveurl="@Url.Action(MVC.API.AuthorizationRole.UpdateClaims(Model.Token.Role.Id))">Save Changes</button>@AjaxHelpers.AjaxLoader()
                 </div>
+                <script id="Config_AuthRoles_Claims_NodesJson" type="application/json">
+                    @Html.Raw(Newtonsoft.Json.JsonConvert.SerializeObject(Model.ClaimNavigatorFancyTreeNodes))
+                </script>
                 <script>
-                    (function(){
-                        var claimNodes = @(new HtmlString(Newtonsoft.Json.JsonConvert.SerializeObject(Model.ClaimNavigatorFancyTreeNodes)));
+                    (function () {
+                        var claimNodes = JSON.parse($('#Config_AuthRoles_Claims_NodesJson').html());
 
-                        $(function(){
+                        $(function () {
                             var saveButton = $('#Config_AuthRoles_Claims_SaveChanges');
                             var ajaxLoading = saveButton.next('.ajaxLoading');
 
@@ -262,43 +254,45 @@
                                 source: claimNodes,
                                 checkbox: true,
                                 selectMode: 3,
-                                select: function(){
+                                select: function () {
                                     saveButton.removeClass('disabled');
                                 },
                                 keyboard: false
                             });
 
-                            saveButton.click(function(){
-                                if (!saveButton.is('.disabled')){
-                                    var selectedNodes = tree.fancytree('getTree').getSelectedNodes();
+                            saveButton.on('click', async function () {
+                                if (!saveButton.is('.disabled')) {
+                                    ajaxLoading.show();
 
-                                    var selectedKeys = [];
-                                    for (var i = 0; i < selectedNodes.length; i++) {
-                                        var node = selectedNodes[i];
-                                        if (!node.folder)
-                                            selectedKeys.push(node.key);
-                                    }
+                                    try {
+                                        const body = new FormData();
+                                        body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
 
-                                    ajaxLoading.show()
+                                        var selectedNodes = tree.fancytree('getTree').getSelectedNodes();
 
-                                    $.ajax({
-                                        url: '@Url.Action(MVC.API.AuthorizationRole.UpdateClaims(Model.Token.Role.Id))',
-                                        method: 'post',
-                                        data: { ClaimKeys: selectedKeys },
-                                        traditional: true
-                                    }).done(function(response, result){
-                                        if (result != 'success' || response != 'OK') {
-                                            alert('Unable to save changes:\n' + response);
-                                            ajaxLoading.hide();
-                                        } else {
-                                            saveButton.addClass('disabled');
-                                            ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
+                                        var selectedKeys = [];
+                                        for (var i = 0; i < selectedNodes.length; i++) {
+                                            var node = selectedNodes[i];
+                                            if (!node.folder)
+                                                body.append('claimKeys', node.key);
                                         }
-                                    }).fail(function(jqXHR, textStatus, errorThrown){
-                                        alert('Error: ' + errorThrown);
-                                    });
+
+                                        const response = await fetch(saveButton.attr('data-saveurl'), {
+                                            method: 'POST',
+                                            body: body
+                                        });
+
+                                        if (response.ok) {
+                                            saveButton.addClass('disabled');
+                                            ajaxLoading.next('.ajaxOk').show().delay('fast').fadeOut('slow');
+                                        } else {
+                                            alert('Unable to save changes:\n' + response);
+                                        }
+                                    } catch (e) {
+                                        alert('Error: ' + e);
+                                    }
+                                    ajaxLoading.hide();
                                 }
-                                return false;
                             });
                         });
                     })();
@@ -308,8 +302,12 @@
     </table>
 </div>
 <div class="actionBar">
-    @Html.ActionLinkButton("Delete", MVC.API.AuthorizationRole.Delete(Model.Token.Role.Id, true), "Config_AuthRoles_Actions_Delete_Button")
-    <div id="Config_AuthRoles_Actions_Delete_Dialog" title="Delete this Authorization Role?">
+    <button id="Config_AuthRoles_Actions_Delete_Button" type="button" class="button">Delete</button>
+    <div id="Config_AuthRoles_Actions_Delete_Dialog" class="dialog" title="Delete this Authorization Role?">
+        @using (Html.BeginForm(MVC.API.AuthorizationRole.Delete(Model.Token.Role.Id, true)))
+        {
+            @Html.AntiForgeryToken()
+        }
         <p>
             <i class="fa fa-exclamation-triangle fa-lg warning"></i>
             This item will be permanently deleted and cannot be recovered.<br />
@@ -319,30 +317,28 @@
     </div>
     <script type="text/javascript">
         $(function () {
-            var button = $('#Config_AuthRoles_Actions_Delete_Button');
-            var buttonDialog = $('#Config_AuthRoles_Actions_Delete_Dialog');
-            var buttonLink = button.attr('href');
-            button.attr('href', '#');
-            button.click(function () {
-                buttonDialog.dialog('open');
-                return false;
-            });
-            buttonDialog.dialog({
-                resizable: false,
-                modal: true,
-                autoOpen: false,
-                buttons: {
-                    "Delete": function () {
-                        var $this = $(this);
-                        $this.dialog("disable");
-                        $this.dialog("option", "buttons", null);
-                        window.location.href = buttonLink;
-                    },
-                    Cancel: function () {
-                        $(this).dialog("close");
-                    }
+            let buttonDialog = null;
+            $('#Config_AuthRoles_Actions_Delete_Button').click(function () {
+                if (!buttonDialog) {
+                    buttonDialog = $('#Config_AuthRoles_Actions_Delete_Dialog').dialog({
+                        resizable: false,
+                        modal: true,
+                        autoOpen: false,
+                        buttons: {
+                            "Delete": function () {
+                                $(this)
+                                    .dialog("option", "buttons", null)
+                                    .find('form').trigger('submit');
+                            },
+                            Cancel: function () {
+                                $(this).dialog("close");
+                            }
+                        }
+                    });
                 }
+                buttonDialog.dialog('open');
             });
+
         });
     </script>
 </div>

Disco.Web/Areas/Config/Views/DeviceBatch/Create.cshtml

@@ -4,20 +4,21 @@
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Device Batches", MVC.Config.DeviceBatch.Index(null), "Create");
 }
 @using (Html.BeginForm())
-{ 
+{
+    @Html.AntiForgeryToken()
     @Html.ValidationSummary(false)
     <div class="form" style="width: 450px">
         <table>
             <tr>
                 <th>Name:</th>
                 <td>
-                    @Html.EditorFor(model => model.DeviceBatch.Name)<br />@Html.ValidationMessageFor(model => model.DeviceBatch.Name)
+                    @Html.EditorFor(model => model.Name)<br />@Html.ValidationMessageFor(model => model.Name)
                 </td>
             </tr>
             <tr>
                 <th>Purchase Date:</th>
                 <td>
-                    @Html.EditorFor(model => model.DeviceBatch.PurchaseDate)<br />@Html.ValidationMessageFor(model => model.DeviceBatch.PurchaseDate)
+                    @Html.EditorFor(model => model.PurchaseDate)<br />@Html.ValidationMessageFor(model => model.PurchaseDate)
                 </td>
             </tr>
         </table>
@@ -29,6 +30,7 @@
         $(function () {
             $('#Name').focus().select();
             $('#PurchaseDate').datepicker({
+                minDate: new Date(1900, 1-1, 1),
                 changeYear: true,
                 changeMonth: true,
                 dateFormat: 'yy/mm/dd'

Disco.Web/Areas/Config/Views/DeviceBatch/Create.generated.cs

@@ -57,20 +57,34 @@ WriteLiteral("\r\n");
             
             #line 6 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
  using (Html.BeginForm())
-{ 
+{
     
             
             #line default
             #line hidden
             
             #line 8 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
-Write(Html.ValidationSummary(false));
+Write(Html.AntiForgeryToken());
 
             
             #line default
             #line hidden
             
             #line 8 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
+                            
+    
+            
+            #line default
+            #line hidden
+            
+            #line 9 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
+Write(Html.ValidationSummary(false));
+
+            
+            #line default
+            #line hidden
+            
+            #line 9 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
                                   
 
             
@@ -88,8 +102,8 @@ WriteLiteral(">\r\n        <table>\r\n            <tr>\r\n                <th>Na
 WriteLiteral("                    ");
 
             
-            #line 14 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
-               Write(Html.EditorFor(model => model.DeviceBatch.Name));
+            #line 15 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
+               Write(Html.EditorFor(model => model.Name));
 
             
             #line default
@@ -97,8 +111,8 @@ WriteLiteral("                    ");
 WriteLiteral("<br />");
 
             
-            #line 14 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
-                                                                     Write(Html.ValidationMessageFor(model => model.DeviceBatch.Name));
+            #line 15 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
+                                                         Write(Html.ValidationMessageFor(model => model.Name));
 
             
             #line default
@@ -109,8 +123,8 @@ WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>
 WriteLiteral("                    ");
 
             
-            #line 20 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
-               Write(Html.EditorFor(model => model.DeviceBatch.PurchaseDate));
+            #line 21 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
+               Write(Html.EditorFor(model => model.PurchaseDate));
 
             
             #line default
@@ -118,8 +132,8 @@ WriteLiteral("                    ");
 WriteLiteral("<br />");
 
             
-            #line 20 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
-                                                                             Write(Html.ValidationMessageFor(model => model.DeviceBatch.PurchaseDate));
+            #line 21 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
+                                                                 Write(Html.ValidationMessageFor(model => model.PurchaseDate));
 
             
             #line default
@@ -146,6 +160,7 @@ WriteLiteral(@">
         $(function () {
             $('#Name').focus().select();
             $('#PurchaseDate').datepicker({
+                minDate: new Date(1900, 1-1, 1),
                 changeYear: true,
                 changeMonth: true,
                 dateFormat: 'yy/mm/dd'
@@ -155,7 +170,7 @@ WriteLiteral(@">
 ");
 
             
-            #line 38 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
+            #line 40 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
 }
 
             

Disco.Web/Areas/Config/Views/DeviceBatch/Show.cshtml

@@ -285,7 +285,7 @@
                         </td>
                     </tr>
                 </table>
-                <div id="DeviceBatch_PurchaseDetails_Container">
+                <div id="DeviceBatch_PurchaseDetails_Container" data-updateurl="@(Url.Action(MVC.API.DeviceBatch.UpdatePurchaseDetails(Model.DeviceBatch.Id)))">
                     <div>
                         Details @AjaxHelpers.AjaxLoader("ajaxPurchaseDetails")
                     </div>
@@ -294,50 +294,39 @@
                         @Html.EditorFor(model => model.DeviceBatch.PurchaseDetails)
                         <script type="text/javascript">
                             $(function () {
-                                var model = {
-                                    $field: $('#DeviceBatch_PurchaseDetails'),
-                                    fieldName: 'PurchaseDetails',
-                                    $ajax_loading: null,
-                                    $ajax_ok: null,
-                                    updated: function () {
-                                        if (!model.$ajax_loading)
-                                            model.$ajax_loading = $('#ajax' + model.fieldName + '_loading');
-                                        if (!model.$ajax_ok)
-                                            model.$ajax_ok = $('#ajax' + model.fieldName + '_ok');
-                                        model.$ajax_loading.show();
-                                        var data = {};
-                                        data[model.fieldName] = model.$field.tinymce().getContent();
-                                        $.ajax({
-                                            url: '@(Url.Action(MVC.API.DeviceBatch.UpdatePurchaseDetails(Model.DeviceBatch.Id)))',
-                                            dataType: 'json',
-                                            data: data,
-                                            traditional: true,
-                                            type: 'POST',
-                                            success: function (d) {
-                                                if (d == 'OK') {
-                                                    model.$ajax_loading.hide();
-                                                    model.$ajax_ok.show().delay('fast').fadeOut('slow');
-                                                } else {
-                                                    model.$ajax_loading.hide();
-                                                    alert('Unable to update purchase details: ' + d);
-                                                }
-                                            },
-                                            error: function (jqXHR, textStatus, errorThrown) {
-                                                alert('Unable to update purchase details: ' + errorThrown);
-                                                model.$ajax_loading.hide();
-                                            }
-                                        })
-                                    }
-                                };
+                                const $field = $('#DeviceBatch_PurchaseDetails');
 
-                                model.$field.tinymce({
+                                async function updated() {
+                                    $('#ajaxPurchaseDetails_loading').show();
+                                    try {
+                                        const body = new FormData();
+                                        body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                                        body.append('purchaseDetails', $field.tinymce().getContent())
+
+                                        const response = await fetch($('#DeviceBatch_PurchaseDetails_Container').attr('data-updateurl'), {
+                                            method: 'POST',
+                                            body: body
+                                        });
+
+                                        if (response.ok) {
+                                            $('#ajaxPurchaseDetails_ok').show().delay('fast').fadeOut('slow');
+                                        } else {
+                                            alert('Unable to update purchase details: ' + response.statusText);
+                                        }
+                                    } catch (e) {
+                                        alert('Unable to update purchase details: ' + e);
+                                    }
+                                    $('#ajaxPurchaseDetails_loading').hide();
+                                }
+
+                                $field.tinymce({
                                     theme: 'simple',
                                     add_unload_trigger: false,
                                     schema: "html5",
                                     statusbar: false,
                                     setup: function (ed) {
                                         ed.on('init', function () {
-                                            $(ed.getWin()).blur(model.updated);
+                                            $(ed.getWin()).blur(function () { updated(); });
                                         });
                                     }
                                 });
@@ -390,7 +379,7 @@
                         </td>
                     </tr>
                 </table>
-                <div id="DeviceBatch_WarrantyDetails_Container">
+                <div id="DeviceBatch_WarrantyDetails_Container" data-updateurl="@(Url.Action(MVC.API.DeviceBatch.UpdateWarrantyDetails(Model.DeviceBatch.Id)))">
                     <div>
                         Details @AjaxHelpers.AjaxLoader("ajaxWarrantyDetails")
                     </div>
@@ -399,50 +388,39 @@
                         @Html.EditorFor(model => model.DeviceBatch.WarrantyDetails)
                         <script type="text/javascript">
                             $(function () {
-                                var model = {
-                                    $field: $('#DeviceBatch_WarrantyDetails'),
-                                    fieldName: 'WarrantyDetails',
-                                    $ajax_loading: null,
-                                    $ajax_ok: null,
-                                    updated: function () {
-                                        if (!model.$ajax_loading)
-                                            model.$ajax_loading = $('#ajax' + model.fieldName + '_loading');
-                                        if (!model.$ajax_ok)
-                                            model.$ajax_ok = $('#ajax' + model.fieldName + '_ok');
-                                        model.$ajax_loading.show();
-                                        var data = {};
-                                        data[model.fieldName] = model.$field.tinymce().getContent();
-                                        $.ajax({
-                                            url: '@(Url.Action(MVC.API.DeviceBatch.UpdateWarrantyDetails(Model.DeviceBatch.Id)))',
-                                            dataType: 'json',
-                                            data: data,
-                                            traditional: true,
-                                            type: 'POST',
-                                            success: function (d) {
-                                                if (d == 'OK') {
-                                                    model.$ajax_loading.hide();
-                                                    model.$ajax_ok.show().delay('fast').fadeOut('slow');
-                                                } else {
-                                                    model.$ajax_loading.hide();
-                                                    alert('Unable to update warranty details: ' + d);
-                                                }
-                                            },
-                                            error: function (jqXHR, textStatus, errorThrown) {
-                                                alert('Unable to update warranty details: ' + errorThrown);
-                                                model.$ajax_loading.hide();
-                                            }
-                                        })
-                                    }
-                                };
+                                const $field = $('#DeviceBatch_WarrantyDetails');
 
-                                model.$field.tinymce({
+                                async function updated() {
+                                    $('#ajaxWarrantyDetails_loading').show();
+                                    try {
+                                        const body = new FormData();
+                                        body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                                        body.append('warrantyDetails', $field.tinymce().getContent())
+
+                                        const response = await fetch($('#DeviceBatch_WarrantyDetails_Container').attr('data-updateurl'), {
+                                            method: 'POST',
+                                            body: body
+                                        });
+
+                                        if (response.ok) {
+                                            $('#ajaxWarrantyDetails_ok').show().delay('fast').fadeOut('slow');
+                                        } else {
+                                            alert('Unable to update warranty details: ' + response.statusText);
+                                        }
+                                    } catch (e) {
+                                        alert('Unable to update warranty details: ' + e);
+                                    }
+                                    $('#ajaxWarrantyDetails_loading').hide();
+                                }
+
+                                $field.tinymce({
                                     theme: 'simple',
                                     add_unload_trigger: false,
                                     schema: "html5",
                                     statusbar: false,
                                     setup: function (ed) {
                                         ed.on('init', function () {
-                                            $(ed.getWin()).blur(model.updated);
+                                            $(ed.getWin()).blur(function () { updated(); });
                                         });
                                     }
                                 });
@@ -555,7 +533,7 @@
                         </td>
                     </tr>
                 </table>
-                <div id="DeviceBatch_InsuranceDetails_Container">
+                <div id="DeviceBatch_InsuranceDetails_Container" data-updateurl="@(Url.Action(MVC.API.DeviceBatch.UpdateInsuranceDetails(Model.DeviceBatch.Id)))">
                     <div>
                         Details @AjaxHelpers.AjaxLoader("ajaxInsuranceDetails")
                     </div>
@@ -564,48 +542,38 @@
                         @Html.EditorFor(model => model.DeviceBatch.InsuranceDetails)
                         <script type="text/javascript">
                             $(function () {
-                                var model = {
-                                    $field: $('#DeviceBatch_InsuranceDetails'),
-                                    $ajax_loading: null,
-                                    $ajax_ok: null,
-                                    updated: function () {
-                                        if (!model.$ajax_loading)
-                                            model.$ajax_loading = $('#ajaxInsuranceDetails_loading');
-                                        if (!model.$ajax_ok)
-                                            model.$ajax_ok = $('#ajaxInsuranceDetails_ok');
-                                        model.$ajax_loading.show();
-                                        var data = { InsuranceDetails: model.$field.tinymce().getContent() };
-                                        $.ajax({
-                                            url: '@(Url.Action(MVC.API.DeviceBatch.UpdateInsuranceDetails(Model.DeviceBatch.Id)))',
-                                            dataType: 'json',
-                                            data: data,
-                                            traditional: true,
-                                            type: 'POST',
-                                            success: function (d) {
-                                                if (d == 'OK') {
-                                                    model.$ajax_loading.hide();
-                                                    model.$ajax_ok.show().delay('fast').fadeOut('slow');
-                                                } else {
-                                                    model.$ajax_loading.hide();
-                                                    alert('Unable to update insurance details: ' + d);
-                                                }
-                                            },
-                                            error: function (jqXHR, textStatus, errorThrown) {
-                                                alert('Unable to update insurance details: ' + errorThrown);
-                                                model.$ajax_loading.hide();
-                                            }
-                                        })
-                                    }
-                                };
+                                const $field = $('#DeviceBatch_InsuranceDetails');
+                                async function updated() {
+                                    $('#ajaxInsuranceDetails_loading').show();
+                                    try {
+                                        const body = new FormData();
+                                        body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                                        body.append('insuranceDetails', $field.tinymce().getContent())
 
-                                model.$field.tinymce({
+                                        const response = await fetch($('#DeviceBatch_InsuranceDetails_Container').attr('data-updateurl'), {
+                                            method: 'POST',
+                                            body: body
+                                        });
+
+                                        if (response.ok) {
+                                            $('#ajaxInsuranceDetails_ok').show().delay('fast').fadeOut('slow');
+                                        } else {
+                                            alert('Unable to update insurance details: ' + response.statusText);
+                                        }
+                                    } catch (e) {
+                                        alert('Unable to update insurance details: ' + e);
+                                    }
+                                    $('#ajaxInsuranceDetails_loading').hide();
+                                }
+
+                                $field.tinymce({
                                     theme: 'simple',
                                     add_unload_trigger: false,
                                     schema: "html5",
                                     statusbar: false,
                                     setup: function (ed) {
                                         ed.on('init', function () {
-                                            $(ed.getWin()).blur(model.updated);
+                                            $(ed.getWin()).blur(function () { updated(); });
                                         });
                                     }
                                 });
@@ -622,7 +590,7 @@
                 </div>
             </td>
         </tr>
-        <tr>
+        <tr id="DeviceBatch_Comments_Container" data-updateurl="@(Url.Action(MVC.API.DeviceBatch.UpdateComments(Model.DeviceBatch.Id)))">
             <th>
                 Comments:<br />
                 @AjaxHelpers.AjaxLoader("ajaxComments")
@@ -632,53 +600,43 @@
                 {
                     @Html.EditorFor(model => model.DeviceBatch.Comments)
                     <script type="text/javascript">
-                    $(function () {
-                        var model = {
-                            $field: $('#DeviceBatch_Comments'),
-                            $ajax_loading: null,
-                            $ajax_ok: null,
-                            updated: function () {
-                                if (!model.$ajax_loading)
-                                    model.$ajax_loading = $('#ajaxComments_loading');
-                                if (!model.$ajax_ok)
-                                    model.$ajax_ok = $('#ajaxComments_ok');
-                                model.$ajax_loading.show();
-                                var data = { Comments: model.$field.tinymce().getContent() };
-                                $.ajax({
-                                    url: '@(Url.Action(MVC.API.DeviceBatch.UpdateComments(Model.DeviceBatch.Id)))',
-                                    dataType: 'json',
-                                    data: data,
-                                    traditional: true,
-                                    type: 'POST',
-                                    success: function (d) {
-                                        if (d == 'OK') {
-                                            model.$ajax_loading.hide();
-                                            model.$ajax_ok.show().delay('fast').fadeOut('slow');
-                                        } else {
-                                            model.$ajax_loading.hide();
-                                            alert('Unable to update comments: ' + d);
-                                        }
-                                    },
-                                    error: function (jqXHR, textStatus, errorThrown) {
-                                        alert('Unable to update comments: ' + errorThrown);
-                                        model.$ajax_loading.hide();
-                                    }
-                                })
-                            }
-                        };
+                        $(function () {
+                            const $field = $('#DeviceBatch_Comments');
+                            async function updated() {
+                                $('#ajaxComments_loading').show();
+                                try {
+                                    const body = new FormData();
+                                    body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                                    body.append('comments', $field.tinymce().getContent())
 
-                        model.$field.tinymce({
-                            theme: 'simple',
-                            add_unload_trigger: false,
-                            schema: "html5",
-                            statusbar: false,
-                            setup: function (ed) {
-                                ed.on('init', function () {
-                                    $(ed.getWin()).blur(model.updated);
-                                });
+                                    const response = await fetch($('#DeviceBatch_Comments_Container').attr('data-updateurl'), {
+                                        method: 'POST',
+                                        body: body
+                                    });
+
+                                    if (response.ok) {
+                                        $('#ajaxComments_ok').show().delay('fast').fadeOut('slow');
+                                    } else {
+                                        alert('Unable to update comments: ' + response.statusText);
+                                    }
+                                } catch (e) {
+                                    alert('Unable to update comments: ' + e);
+                                }
+                                $('#ajaxComments_loading').hide();
                             }
+
+                            $field.tinymce({
+                                theme: 'simple',
+                                add_unload_trigger: false,
+                                schema: "html5",
+                                statusbar: false,
+                                setup: function (ed) {
+                                    ed.on('init', function () {
+                                        $(ed.getWin()).blur(function () { updated(); });
+                                    });
+                                }
+                            });
                         });
-                    });
                     </script>
                 }
                 else
@@ -693,8 +651,7 @@
         <tr>
             <th>Attachments:</th>
             <td>
-                <div id="DeviceBatch_Attachments" class="@(canConfig ? "canAddAttachments" : "cannotAddAttachments")" data-uploadurl="@(Url.Action(MVC.API.DeviceBatch.AttachmentUpload(Model.DeviceBatch.Id, null)))">
-                    @Html.AntiForgeryToken()
+                <div id="DeviceBatch_Attachments" class="@(canConfig ? "canAddAttachments" : "cannotAddAttachments")" data-uploadurl="@(Url.Action(MVC.API.DeviceBatch.AttachmentUpload(Model.DeviceBatch.Id, null)))" data-removeurl="@Url.Action(MVC.API.DeviceBatch.AttachmentRemove())">
                     <div class="Disco-AttachmentUpload-DropTarget">
                         <h2>Drop Attachments Here</h2>
                     </div>
@@ -708,7 +665,7 @@
                                         <img alt="Attachment Thumbnail" src="@(Url.Action(MVC.API.DeviceBatch.AttachmentThumbnail(attachment.Id)))" />
                                     </span>
                                     <span class="comments" title="@attachment.Comments">
-                                        @attachment.Comments
+                                        @(attachment.Comments ?? attachment.Filename)
                                     </span><span class="author">@attachment.TechUser.ToString()</span>@if (canConfig)
                                     {<text><span class="remove fa fa-times-circle"></span></text>}<span class="timestamp" title="@attachment.Timestamp.ToFullDateTime()" data-livestamp="@attachment.Timestamp.ToUnixEpoc()">@attachment.Timestamp.ToFullDateTime()</span>
                                 </a>
@@ -926,12 +883,10 @@
                             });
                             //#endregion
                             //#region Remove Attachments
-                            $attachmentOutput.find('span.remove').click(removeAttachment);
+                            $attachmentOutput.find('span.remove').on('click', removeAttachment);
 
                             function removeAttachment() {
-                                $this = $(this).closest('a');
-
-                                var data = { id: $this.attr('data-attachmentid') };
+                                const attachmentId = $(this).closest('a').attr('data-attachmentid');
 
                                 if (!$dialogRemoveAttachment) {
                                     $dialogRemoveAttachment = $('#dialogRemoveAttachment').dialog({
@@ -942,31 +897,28 @@
                                     });
                                 }
 
-                                $dialogRemoveAttachment.dialog("enable");
                                 $dialogRemoveAttachment.dialog('option', 'buttons', {
                                     "Remove": function () {
-                                        $dialogRemoveAttachment.dialog("disable");
                                         $dialogRemoveAttachment.dialog("option", "buttons", null);
-                                        $.ajax({
-                                            url: '@Url.Action(MVC.API.DeviceBatch.AttachmentRemove())',
-                                            dataType: 'json',
-                                            data: data,
-                                            success: function (d) {
-                                                if (d == 'OK') {
-                                                    // Do nothing, await SignalR notification
-                                                } else {
-                                                    alert('Unable to remove attachment: ' + d);
-                                                }
-                                                $dialogRemoveAttachment.dialog("close");
-                                            },
-                                            error: function (jqXHR, textStatus, errorThrown) {
-                                                alert('Unable to remove attachment: ' + textStatus);
-                                                $dialogRemoveAttachment.dialog("close");
+
+                                        const body = new FormData();
+                                        body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                                        body.append('id', attachmentId);
+                                        fetch($Attachments.attr('data-removeurl'), {
+                                            method: 'POST',
+                                            body: body
+                                        }).then(r => {
+                                            if (!r.ok) {
+                                                alert('Unable to remove attachment: ' + r.statusText);
                                             }
+                                            $dialogRemoveAttachment.dialog('close');
+                                        }).catch(e => {
+                                            alert('Unable to remove attachment: ' + e);
+                                            $dialogRemoveAttachment.dialog('close');
                                         });
                                     },
                                     Cancel: function () {
-                                        $dialogRemoveAttachment.dialog("close");
+                                        $(this).dialog("close");
                                     }
                                 });
 
@@ -1044,7 +996,7 @@
     {
         <button id="DeviceBatch_Decommission" class="button">Decommission All Devices</button>
         <div id="DeviceBatch_Decommission_Dialog" class="dialog" title="Batch Device Decommission">
-            @using (Html.BeginForm(MVC.API.Device.DeviceBatchDecommission(Model.DeviceBatch.Id), FormMethod.Post))
+            @using (Html.BeginForm(MVC.API.Device.DeviceBatchDecommission(Model.DeviceBatch.Id)))
             {
                 @Html.AntiForgeryToken()
                 <div class="clearfix" style="margin-bottom: 10px;">
@@ -1101,7 +1053,44 @@
     }
     @if (Model.CanDelete)
     {
-        @Html.ActionLinkButton("Delete", MVC.API.DeviceBatch.Delete(Model.DeviceBatch.Id, true), "buttonDelete")
+        <button id="buttonDelete" type="button" class="button">Delete</button>
+        <div id="dialogConfirmDelete" class="dialog" title="Delete this Device Batch?">
+            @using (Html.BeginForm(MVC.API.DeviceBatch.Delete(Model.DeviceBatch.Id, true)))
+            {
+                @Html.AntiForgeryToken()
+            }
+            <p>
+                <i class="fa fa-exclamation-triangle fa-lg warning"></i>
+                This item will be permanently deleted and cannot be recovered. Are you sure?
+            </p>
+        </div>
+        <script type="text/javascript">
+            $(function () {
+                let dialog = null;
+                $('#buttonDelete').on('click', function () {
+                    if (!dialog) {
+                        dialog = $("#dialogConfirmDelete").dialog({
+                            resizable: false,
+                            width: 300,
+                            modal: true,
+                            autoOpen: false,
+                            buttons: {
+                                "Delete": function () {
+                                    $(this)
+                                        .dialog("option", "buttons", null)
+                                        .find('form').trigger('submit');
+                                },
+                                Cancel: function () {
+                                    $(this).dialog("close");
+                                }
+                            }
+                        });
+                    }
+
+                    dialog.dialog('open');
+                });
+            });
+        </script>
     }
     @if (Model.DeviceCount > 0)
     {

Disco.Web/Areas/Config/Views/DeviceBatch/Timeline.cshtml

@@ -1,15 +1,14 @@
 @{
     Authorization.Require(Claims.Config.DeviceBatch.ShowTimeline);
-    
+
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Device Batches", MVC.Config.DeviceBatch.Index(null), "Timeline");
     Html.BundleDeferred("~/Style/Timeline");
     Html.BundleDeferred("~/ClientScripts/Modules/Timeline");
 }
-<div id="deviceBatchesTimeline" style="height: 550px;">
+<div id="deviceBatchesTimeline" style="height: 550px;" data-url="@(Url.Action(MVC.API.DeviceBatch.Timeline()))">
 </div>
 <script type="text/javascript">
     (function () {
-        var dataUrl = '@(Url.Action(MVC.API.DeviceBatch.Timeline()))';
         var tl;
 
         $(function () {
@@ -23,7 +22,7 @@
             var sixMonthsDate = new Date();
             sixMonthsDate.setDate(currentDate.getDate());
             sixMonthsDate.setMonth(currentDate.getMonth() + 6);
-            
+
             var hotZoneStart1 = new Date(currentDate.getFullYear(), 0, 1, 10, 0, 0);
             var hotZoneEnd1 = new Date(currentDate.getFullYear(), 11, 31, 10, 0, 0);
             var hotZoneStart2 = new Date(currentDate.getFullYear() + 1, 0, 1, 10, 0, 0);
@@ -37,18 +36,18 @@
             var bandInfos = [
                 Timeline.createHotZoneBandInfo({
                     zones: [
-                    {
-                        start: hotZoneStart1,
-                        end: hotZoneEnd1,
-                        magnify: 4,
-                        unit: Timeline.DateTime.MONTH
-                    },
-                    {
-                        start: hotZoneStart2,
-                        end: hotZoneEnd2,
-                        magnify: 4,
-                        unit: Timeline.DateTime.MONTH
-                    }
+                        {
+                            start: hotZoneStart1,
+                            end: hotZoneEnd1,
+                            magnify: 4,
+                            unit: Timeline.DateTime.MONTH
+                        },
+                        {
+                            start: hotZoneStart2,
+                            end: hotZoneEnd2,
+                            magnify: 4,
+                            unit: Timeline.DateTime.MONTH
+                        }
                     ],
                     eventSource: eventSource,
                     width: "85%",
@@ -106,17 +105,26 @@
             });
 
             // Load Events
-            $.ajax({
-                url: dataUrl,
-                dataType: 'json',
-                type: 'POST',
-                success: function (data) {
-                    eventSource.loadJSON(data, dataUrl);
-                },
-                error: function (jqXHR, textStatus, errorThrown) {
-                    alert('Unable to load Timeline Data: ' + errorThrown);
+            async function loadEventsAsync() {
+                try {
+                    const dataUrl = $('#deviceBatchesTimeline').attr('data-url');
+                    const body = new FormData();
+                    body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                    const response = await fetch(dataUrl, {
+                        method: 'POST',
+                        body: body
+                    });
+                    if (response.ok) {
+                        const data = await response.json();
+                        eventSource.loadJSON(data, dataUrl);
+                    } else {
+                        alert('Unable to load Timeline Data: ' + response.statusText);
+                    }
+                } catch (e) {
+                    alert('Unable to load Timeline Data: ' + e);
                 }
-            });
+            }
+            loadEventsAsync();
         });
 
     })();

Disco.Web/Areas/Config/Views/DeviceBatch/Timeline.generated.cs

@@ -47,7 +47,7 @@ namespace Disco.Web.Areas.Config.Views.DeviceBatch
             #line 1 "..\..\Areas\Config\Views\DeviceBatch\Timeline.cshtml"
   
     Authorization.Require(Claims.Config.DeviceBatch.ShowTimeline);
-    
+
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Device Batches", MVC.Config.DeviceBatch.Index(null), "Timeline");
     Html.BundleDeferred("~/Style/Timeline");
     Html.BundleDeferred("~/ClientScripts/Modules/Timeline");
@@ -61,74 +61,83 @@ WriteLiteral(" id=\"deviceBatchesTimeline\"");
 
 WriteLiteral(" style=\"height: 550px;\"");
 
-WriteLiteral(">\r\n</div>\r\n<script");
-
-WriteLiteral(" type=\"text/javascript\"");
-
-WriteLiteral(">\r\n    (function () {\r\n        var dataUrl = \'");
+WriteLiteral(" data-url=\"");
 
             
-            #line 12 "..\..\Areas\Config\Views\DeviceBatch\Timeline.cshtml"
-                   Write(Url.Action(MVC.API.DeviceBatch.Timeline()));
+            #line 8 "..\..\Areas\Config\Views\DeviceBatch\Timeline.cshtml"
+                                                             Write(Url.Action(MVC.API.DeviceBatch.Timeline()));
 
             
             #line default
             #line hidden
-WriteLiteral("\';\r\n        var tl;\r\n\r\n        $(function () {\r\n\r\n            var eventSource = n" +
-"ew Timeline.DefaultEventSource();\r\n\r\n            var currentDate = new Date();\r\n" +
-"            currentDate = new Date(currentDate.getFullYear(), currentDate.getMon" +
-"th(), currentDate.getDay(), 10, 0, 0);\r\n            var tomorrowDate = new Date(" +
-");\r\n            tomorrowDate.setDate(currentDate.getDate() + 1);\r\n            va" +
-"r sixMonthsDate = new Date();\r\n            sixMonthsDate.setDate(currentDate.get" +
-"Date());\r\n            sixMonthsDate.setMonth(currentDate.getMonth() + 6);\r\n     " +
-"       \r\n            var hotZoneStart1 = new Date(currentDate.getFullYear(), 0, " +
-"1, 10, 0, 0);\r\n            var hotZoneEnd1 = new Date(currentDate.getFullYear()," +
-" 11, 31, 10, 0, 0);\r\n            var hotZoneStart2 = new Date(currentDate.getFul" +
-"lYear() + 1, 0, 1, 10, 0, 0);\r\n            var hotZoneEnd2 = new Date(currentDat" +
-"e.getFullYear() + 1, 11, 31, 10, 0, 0);\r\n            //hotZoneEnd.setDate(hotZon" +
-"eEnd.getDate() - 1);\r\n\r\n            //hotZoneStart = hotZoneStart.toLocaleDateSt" +
-"ring();\r\n            //hotZoneEnd = hotZoneEnd.toLocaleDateString();\r\n\r\n\r\n      " +
-"      var bandInfos = [\r\n                Timeline.createHotZoneBandInfo({\r\n     " +
-"               zones: [\r\n                    {\r\n                        start: h" +
-"otZoneStart1,\r\n                        end: hotZoneEnd1,\r\n                      " +
-"  magnify: 4,\r\n                        unit: Timeline.DateTime.MONTH\r\n          " +
-"          },\r\n                    {\r\n                        start: hotZoneStart" +
-"2,\r\n                        end: hotZoneEnd2,\r\n                        magnify: " +
-"4,\r\n                        unit: Timeline.DateTime.MONTH\r\n                    }" +
-"\r\n                    ],\r\n                    eventSource: eventSource,\r\n       " +
-"             width: \"85%\",\r\n                    intervalUnit: Timeline.DateTime." +
-"YEAR,\r\n                    intervalPixels: 150,\r\n                    timeZone: 1" +
-"0,\r\n                    date: sixMonthsDate\r\n                }),\r\n              " +
-"  Timeline.createBandInfo({\r\n                    eventSource: eventSource,\r\n    " +
-"                width: \"15%\",\r\n                    intervalUnit: Timeline.DateTi" +
-"me.YEAR,\r\n                    intervalPixels: 150,\r\n                    overview" +
-": true,\r\n                    timeZone: 10,\r\n                    date: sixMonthsD" +
-"ate\r\n                })\r\n            ];\r\n            bandInfos[1].syncWith = 0;\r" +
-"\n            bandInfos[1].highlight = true;\r\n\r\n            for (var i = 0; i < b" +
-"andInfos.length; i++) {\r\n                bandInfos[i].decorators = [\r\n          " +
-"          new Timeline.SpanHighlightDecorator({\r\n                        startDa" +
-"te: currentDate,\r\n                        endDate: tomorrowDate,\r\n              " +
-"          color: \"#CC2222\",\r\n                        opacity: 50\r\n              " +
-"      }),\r\n                    new Timeline.SpanHighlightDecorator({\r\n          " +
-"              startDate: hotZoneStart1,\r\n                        endDate: hotZon" +
-"eEnd1,\r\n                        color: \"#CEA5A5\",\r\n                        opaci" +
-"ty: 50\r\n                    }),\r\n                    new Timeline.SpanHighlightD" +
-"ecorator({\r\n                        startDate: hotZoneStart2,\r\n                 " +
-"       endDate: hotZoneEnd2,\r\n                        color: \"#CCB7B7\",\r\n       " +
-"                 opacity: 50\r\n                    })\r\n                ];\r\n      " +
-"      }\r\n\r\n            tl = Timeline.create($(\'#deviceBatchesTimeline\')[0], band" +
-"Infos);\r\n\r\n            var tlResizeLayoutHandle = null;\r\n            $(window).r" +
-"esize(function () {\r\n                if (tlResizeLayoutHandle)\r\n                " +
-"    window.clearTimeout(tlResizeLayoutHandle);\r\n                tlResizeLayoutHa" +
-"ndle = window.setTimeout(function () {\r\n                    tlResizeLayoutHandle" +
-" = null;\r\n                    tl.layout();\r\n                }, 500);\r\n          " +
-"  });\r\n\r\n            // Load Events\r\n            $.ajax({\r\n                url: " +
-"dataUrl,\r\n                dataType: \'json\',\r\n                type: \'POST\',\r\n    " +
-"            success: function (data) {\r\n                    eventSource.loadJSON" +
-"(data, dataUrl);\r\n                },\r\n                error: function (jqXHR, te" +
-"xtStatus, errorThrown) {\r\n                    alert(\'Unable to load Timeline Dat" +
-"a: \' + errorThrown);\r\n                }\r\n            });\r\n        });\r\n\r\n    })(" +
-");\r\n\r\n</script>\r\n");
+WriteLiteral("\"");
+
+WriteLiteral(">\r\n</div>\r\n<script");
+
+WriteLiteral(" type=\"text/javascript\"");
+
+WriteLiteral(">\r\n    (function () {\r\n        var tl;\r\n\r\n        $(function () {\r\n\r\n            " +
+"var eventSource = new Timeline.DefaultEventSource();\r\n\r\n            var currentD" +
+"ate = new Date();\r\n            currentDate = new Date(currentDate.getFullYear()," +
+" currentDate.getMonth(), currentDate.getDay(), 10, 0, 0);\r\n            var tomor" +
+"rowDate = new Date();\r\n            tomorrowDate.setDate(currentDate.getDate() + " +
+"1);\r\n            var sixMonthsDate = new Date();\r\n            sixMonthsDate.setD" +
+"ate(currentDate.getDate());\r\n            sixMonthsDate.setMonth(currentDate.getM" +
+"onth() + 6);\r\n\r\n            var hotZoneStart1 = new Date(currentDate.getFullYear" +
+"(), 0, 1, 10, 0, 0);\r\n            var hotZoneEnd1 = new Date(currentDate.getFull" +
+"Year(), 11, 31, 10, 0, 0);\r\n            var hotZoneStart2 = new Date(currentDate" +
+".getFullYear() + 1, 0, 1, 10, 0, 0);\r\n            var hotZoneEnd2 = new Date(cur" +
+"rentDate.getFullYear() + 1, 11, 31, 10, 0, 0);\r\n            //hotZoneEnd.setDate" +
+"(hotZoneEnd.getDate() - 1);\r\n\r\n            //hotZoneStart = hotZoneStart.toLocal" +
+"eDateString();\r\n            //hotZoneEnd = hotZoneEnd.toLocaleDateString();\r\n\r\n\r" +
+"\n            var bandInfos = [\r\n                Timeline.createHotZoneBandInfo({" +
+"\r\n                    zones: [\r\n                        {\r\n                     " +
+"       start: hotZoneStart1,\r\n                            end: hotZoneEnd1,\r\n   " +
+"                         magnify: 4,\r\n                            unit: Timeline" +
+".DateTime.MONTH\r\n                        },\r\n                        {\r\n        " +
+"                    start: hotZoneStart2,\r\n                            end: hotZ" +
+"oneEnd2,\r\n                            magnify: 4,\r\n                            u" +
+"nit: Timeline.DateTime.MONTH\r\n                        }\r\n                    ],\r" +
+"\n                    eventSource: eventSource,\r\n                    width: \"85%\"" +
+",\r\n                    intervalUnit: Timeline.DateTime.YEAR,\r\n                  " +
+"  intervalPixels: 150,\r\n                    timeZone: 10,\r\n                    d" +
+"ate: sixMonthsDate\r\n                }),\r\n                Timeline.createBandInfo" +
+"({\r\n                    eventSource: eventSource,\r\n                    width: \"1" +
+"5%\",\r\n                    intervalUnit: Timeline.DateTime.YEAR,\r\n               " +
+"     intervalPixels: 150,\r\n                    overview: true,\r\n                " +
+"    timeZone: 10,\r\n                    date: sixMonthsDate\r\n                })\r\n" +
+"            ];\r\n            bandInfos[1].syncWith = 0;\r\n            bandInfos[1]" +
+".highlight = true;\r\n\r\n            for (var i = 0; i < bandInfos.length; i++) {\r\n" +
+"                bandInfos[i].decorators = [\r\n                    new Timeline.Sp" +
+"anHighlightDecorator({\r\n                        startDate: currentDate,\r\n       " +
+"                 endDate: tomorrowDate,\r\n                        color: \"#CC2222" +
+"\",\r\n                        opacity: 50\r\n                    }),\r\n              " +
+"      new Timeline.SpanHighlightDecorator({\r\n                        startDate: " +
+"hotZoneStart1,\r\n                        endDate: hotZoneEnd1,\r\n                 " +
+"       color: \"#CEA5A5\",\r\n                        opacity: 50\r\n                 " +
+"   }),\r\n                    new Timeline.SpanHighlightDecorator({\r\n             " +
+"           startDate: hotZoneStart2,\r\n                        endDate: hotZoneEn" +
+"d2,\r\n                        color: \"#CCB7B7\",\r\n                        opacity:" +
+" 50\r\n                    })\r\n                ];\r\n            }\r\n\r\n            tl" +
+" = Timeline.create($(\'#deviceBatchesTimeline\')[0], bandInfos);\r\n\r\n            va" +
+"r tlResizeLayoutHandle = null;\r\n            $(window).resize(function () {\r\n    " +
+"            if (tlResizeLayoutHandle)\r\n                    window.clearTimeout(t" +
+"lResizeLayoutHandle);\r\n                tlResizeLayoutHandle = window.setTimeout(" +
+"function () {\r\n                    tlResizeLayoutHandle = null;\r\n               " +
+"     tl.layout();\r\n                }, 500);\r\n            });\r\n\r\n            // L" +
+"oad Events\r\n            async function loadEventsAsync() {\r\n                try " +
+"{\r\n                    const dataUrl = $(\'#deviceBatchesTimeline\').attr(\'data-ur" +
+"l\');\r\n                    const body = new FormData();\r\n                    body" +
+".append(\'__RequestVerificationToken\', document.body.dataset.antiforgery);\r\n     " +
+"               const response = await fetch(dataUrl, {\r\n                        " +
+"method: \'POST\',\r\n                        body: body\r\n                    });\r\n  " +
+"                  if (response.ok) {\r\n                        const data = await" +
+" response.json();\r\n                        eventSource.loadJSON(data, dataUrl);\r" +
+"\n                    } else {\r\n                        alert(\'Unable to load Tim" +
+"eline Data: \' + response.statusText);\r\n                    }\r\n                } " +
+"catch (e) {\r\n                    alert(\'Unable to load Timeline Data: \' + e);\r\n " +
+"               }\r\n            }\r\n            loadEventsAsync();\r\n        });\r\n\r\n" +
+"    })();\r\n\r\n</script>\r\n");
 
         }
     }

Disco.Web/Areas/Config/Views/DeviceFlag/Create.cshtml

@@ -4,23 +4,24 @@
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Device Flags", MVC.Config.DeviceFlag.Index(null), "Create");
 }
 @using (Html.BeginForm())
-{ 
-    @Html.HiddenFor(m => m.DeviceFlag.Icon)
-    @Html.HiddenFor(m => m.DeviceFlag.IconColour)
+{
+    @Html.AntiForgeryToken()
     <div class="form" style="width: 450px">
         <table>
             <tr>
-                <th>Name:
+                <th>
+                    Name:
                 </th>
                 <td>
-                    @Html.EditorFor(model => model.DeviceFlag.Name)<br />@Html.ValidationMessageFor(model => model.DeviceFlag.Name)
+                    @Html.EditorFor(model => model.Name)<br />@Html.ValidationMessageFor(model => model.Name)
                 </td>
             </tr>
             <tr>
-                <th>Description:
+                <th>
+                    Description:
                 </th>
                 <td>
-                    @Html.EditorFor(model => model.DeviceFlag.Description)<br />@Html.ValidationMessageFor(model => model.DeviceFlag.Description)
+                    @Html.EditorFor(model => model.Description)<br />@Html.ValidationMessageFor(model => model.Description)
                 </td>
             </tr>
         </table>
@@ -30,7 +31,7 @@
     </div>
     <script type="text/javascript">
         $(function () {
-            $('#DeviceFlag_Name').focus().select();
+            $('#Name').focus().select();
         });
     </script>
 }

Disco.Web/Areas/Config/Views/DeviceFlag/Create.generated.cs

@@ -57,35 +57,21 @@ WriteLiteral("\r\n");
             
             #line 6 "..\..\Areas\Config\Views\DeviceFlag\Create.cshtml"
  using (Html.BeginForm())
-{ 
+{
     
             
             #line default
             #line hidden
             
             #line 8 "..\..\Areas\Config\Views\DeviceFlag\Create.cshtml"
-Write(Html.HiddenFor(m => m.DeviceFlag.Icon));
+Write(Html.AntiForgeryToken());
 
             
             #line default
             #line hidden
             
             #line 8 "..\..\Areas\Config\Views\DeviceFlag\Create.cshtml"
-                                           
-    
-            
-            #line default
-            #line hidden
-            
-            #line 9 "..\..\Areas\Config\Views\DeviceFlag\Create.cshtml"
-Write(Html.HiddenFor(m => m.DeviceFlag.IconColour));
-
-            
-            #line default
-            #line hidden
-            
-            #line 9 "..\..\Areas\Config\Views\DeviceFlag\Create.cshtml"
-                                                 
+                            
 
             
             #line default
@@ -96,14 +82,14 @@ WriteLiteral(" class=\"form\"");
 
 WriteLiteral(" style=\"width: 450px\"");
 
-WriteLiteral(">\r\n        <table>\r\n            <tr>\r\n                <th>Name:\r\n                " +
-"</th>\r\n                <td>\r\n");
+WriteLiteral(">\r\n        <table>\r\n            <tr>\r\n                <th>\r\n                    N" +
+"ame:\r\n                </th>\r\n                <td>\r\n");
 
 WriteLiteral("                    ");
 
             
             #line 16 "..\..\Areas\Config\Views\DeviceFlag\Create.cshtml"
-               Write(Html.EditorFor(model => model.DeviceFlag.Name));
+               Write(Html.EditorFor(model => model.Name));
 
             
             #line default
@@ -112,19 +98,20 @@ WriteLiteral("<br />");
 
             
             #line 16 "..\..\Areas\Config\Views\DeviceFlag\Create.cshtml"
-                                                                    Write(Html.ValidationMessageFor(model => model.DeviceFlag.Name));
+                                                         Write(Html.ValidationMessageFor(model => model.Name));
 
             
             #line default
             #line hidden
 WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>\r\n                <th" +
-">Description:\r\n                </th>\r\n                <td>\r\n");
+">\r\n                    Description:\r\n                </th>\r\n                <td>" +
+"\r\n");
 
 WriteLiteral("                    ");
 
             
-            #line 23 "..\..\Areas\Config\Views\DeviceFlag\Create.cshtml"
-               Write(Html.EditorFor(model => model.DeviceFlag.Description));
+            #line 24 "..\..\Areas\Config\Views\DeviceFlag\Create.cshtml"
+               Write(Html.EditorFor(model => model.Description));
 
             
             #line default
@@ -132,8 +119,8 @@ WriteLiteral("                    ");
 WriteLiteral("<br />");
 
             
-            #line 23 "..\..\Areas\Config\Views\DeviceFlag\Create.cshtml"
-                                                                           Write(Html.ValidationMessageFor(model => model.DeviceFlag.Description));
+            #line 24 "..\..\Areas\Config\Views\DeviceFlag\Create.cshtml"
+                                                                Write(Html.ValidationMessageFor(model => model.Description));
 
             
             #line default
@@ -156,11 +143,11 @@ WriteLiteral("    <script");
 
 WriteLiteral(" type=\"text/javascript\"");
 
-WriteLiteral(">\r\n        $(function () {\r\n            $(\'#DeviceFlag_Name\').focus().select();\r\n" +
-"        });\r\n    </script>\r\n");
+WriteLiteral(">\r\n        $(function () {\r\n            $(\'#Name\').focus().select();\r\n        });" +
+"\r\n    </script>\r\n");
 
             
-            #line 36 "..\..\Areas\Config\Views\DeviceFlag\Create.cshtml"
+            #line 37 "..\..\Areas\Config\Views\DeviceFlag\Create.cshtml"
 }
 
             

Disco.Web/Areas/Config/Views/DeviceFlag/Show.cshtml

@@ -38,10 +38,10 @@
             </th>
             <td>
                 @if (canConfig)
-            {@Html.EditorFor(model => model.DeviceFlag.Name)
-                    @AjaxHelpers.AjaxSave()
-                    @AjaxHelpers.AjaxLoader()
-                    <script type="text/javascript">
+                {@Html.EditorFor(model => model.DeviceFlag.Name)
+                @AjaxHelpers.AjaxSave()
+                @AjaxHelpers.AjaxLoader()
+                <script type="text/javascript">
                         $(function () {
                             document.DiscoFunctions.PropertyChangeHelper(
                                 $('#DeviceFlag_Name'),
@@ -50,12 +50,12 @@
                                 'FlagName'
                             );
                         });
-                    </script>
-                }
-                else
-                {
-                    @Model.DeviceFlag.Name
-                }
+                </script>
+            }
+            else
+            {
+                @Model.DeviceFlag.Name
+            }
             </td>
         </tr>
         <tr>
@@ -65,9 +65,9 @@
             <td>
                 @if (canConfig)
                 {@Html.EditorFor(model => model.DeviceFlag.Description)
-                    @AjaxHelpers.AjaxSave()
-                    @AjaxHelpers.AjaxLoader()
-                    <script type="text/javascript">
+                @AjaxHelpers.AjaxSave()
+                @AjaxHelpers.AjaxLoader()
+                <script type="text/javascript">
                         $(function () {
                             document.DiscoFunctions.PropertyChangeHelper(
                                 $('#DeviceFlag_Description'),
@@ -76,11 +76,11 @@
                                 'Description'
                             );
                         });
-                    </script>
-                }
-                else
-                {
-                    <pre>
+                </script>
+            }
+            else
+            {
+                <pre>
                     @if (string.IsNullOrEmpty(Model.DeviceFlag.Description))
                     {
                     <text>&lt;None&gt;</text>
@@ -90,7 +90,7 @@
                         @Model.DeviceFlag.Description.ToHtmlComment()
                     }
                     </pre>
-                }
+            }
             </td>
         </tr>
         <tr>
@@ -113,6 +113,12 @@
                     <div>
                         <a id="Config_DeviceFlags_Icon_Update" href="#" class="button small">Update</a>
                         <div id="Config_DeviceFlags_Icon_Update_Dialog" class="dialog" title="Device Flag Icon">
+                            @using (Html.BeginForm(MVC.API.DeviceFlag.UpdateIconAndColour(id: Model.DeviceFlag.Id, redirect: true)))
+                            {
+                                @Html.AntiForgeryToken()
+                                <input type="hidden" name="icon" />
+                                <input type="hidden" name="iconColour" />
+                            }
                             <div>
                                 <div class="colours">
                                     @foreach (var colour in Model.ThemeColours)
@@ -183,15 +189,11 @@
                                 }
 
                                 function save() {
-                                    var url = '@(Url.Action(MVC.API.DeviceFlag.UpdateIconAndColour(id: Model.DeviceFlag.Id, redirect: true)))',
-                                        data = {
-                                            Icon: icons.find('i.selected').attr('data-icon'),
-                                            IconColour: colours.find('i.selected').attr('data-colour')
-                                        };
-                                    window.location.href = url + '&' + $.param(data);
-
-                                    dialog.dialog("disable");
                                     dialog.dialog("option", "buttons", null);
+                                    const $form = dialog.find('form');
+                                    $form.find('input[name="icon"]').val(icons.find('i.selected').attr('data-icon'));
+                                    $form.find('input[name="iconColour"]').val(colours.find('i.selected').attr('data-colour'));
+                                    $form.trigger('submit');
                                 }
 
                                 function cancel() {
@@ -391,7 +393,7 @@
                    UpdateUrl = Url.Action(MVC.API.DeviceFlag.UpdateAssignedUserLinkedGroup(Model.DeviceFlag.Id, redirect: true))
                })
                     @if (canConfig)
-            {
+                    {
                         @Html.Partial(MVC.Config.Shared.Views.LinkedGroupShared)
                     }
                 </div>
@@ -442,7 +444,8 @@
                 <div class="loading">
                     <h4><i class="fa fa-lg fa-cog fa-spin" title="Please Wait"></i>Loading current assignments...</h4>
                 </div>
-                <form action="#" method="post">
+                <form action="#" method="post" data-overrideaction="@(Url.Action(MVC.API.DeviceFlag.BulkAssignDevices(Model.DeviceFlag.Id, true)))" data-addaction="@(Url.Action(MVC.API.DeviceFlag.BulkAssignDevices(Model.DeviceFlag.Id, false)))">
+                    @Html.AntiForgeryToken()
                     <textarea id="Config_DeviceFlags_BulkAssign_AssignDialog_DeviceSerialNumbers" name="DeviceSerialNumbers"></textarea>
                     <h4>Comments:</h4>
                     <textarea id="Config_DeviceFlags_BulkAssign_AssignDialog_Comments" name="Comments"></textarea>
@@ -502,8 +505,9 @@
                         assignDialog.dialog('option', 'buttons', buttons);
                         assignDialog.dialog('option', 'title', 'Bulk Assign Devices: ' + mode);
 
+                        const $form = assignDeviceSerialNumbers.closest('form');
                         if (mode == "Override") {
-                            assignDeviceSerialNumbers.closest('form').attr('action', '@(Url.Action(MVC.API.DeviceFlag.BulkAssignDevices(Model.DeviceFlag.Id, true)))');
+                            $form.attr('action', $form.attr('data-overrideaction'));
 
                             assignDialog.addClass('loading');
                             $.getJSON('@Url.Action(MVC.API.DeviceFlag.AssignedDevices(Model.DeviceFlag.Id))', function (response, result) {
@@ -523,7 +527,7 @@
                         }
                         else // Assume Add
                         {
-                            assignDeviceSerialNumbers.closest('form').attr('action', '@(Url.Action(MVC.API.DeviceFlag.BulkAssignDevices(Model.DeviceFlag.Id, false)))');
+                            $form.attr('action', $form.attr('data-addaction'));
                         }
 
                         assignDialog.dialog('open');
@@ -538,8 +542,12 @@
         }
         @if (canDelete)
         {
-            @Html.ActionLinkButton("Delete", MVC.API.DeviceFlag.Delete(Model.DeviceFlag.Id, true), "Config_DeviceFlags_Actions_Delete_Button")
-            <div id="Config_DeviceFlags_Actions_Delete_Dialog" title="Delete this Device Flag?">
+            <button id="Config_DeviceFlags_Actions_Delete_Button" type="button" class="button">Delete</button>
+            <div id="Config_DeviceFlags_Actions_Delete_Dialog" class="dialog" title="Delete this Device Flag?">
+                @using (Html.BeginForm(MVC.API.DeviceFlag.Delete(Model.DeviceFlag.Id, true)))
+                {
+                    @Html.AntiForgeryToken()
+                }
                 <p>
                     <i class="fa fa-exclamation-triangle fa-lg warning"></i>
                     This item will be permanently deleted and cannot be recovered.<br />
@@ -555,29 +563,27 @@
             </div>
             <script type="text/javascript">
                 $(function () {
-                    var button = $('#Config_DeviceFlags_Actions_Delete_Button');
-                    var buttonDialog = $('#Config_DeviceFlags_Actions_Delete_Dialog');
-                    var buttonLink = button.attr('href');
-                    button.attr('href', '#');
-                    button.click(function () {
-                        buttonDialog.dialog('open');
-                        return false;
-                    });
-                    buttonDialog.dialog({
-                        resizable: false,
-                        modal: true,
-                        autoOpen: false,
-                        buttons: {
-                            "Delete": function () {
-                                var $this = $(this);
-                                $this.dialog("disable");
-                                $this.dialog("option", "buttons", null);
-                                window.location.href = buttonLink;
-                            },
-                            Cancel: function () {
-                                $(this).dialog("close");
-                            }
+                    let buttonDialog = null;
+                    $('#Config_DeviceFlags_Actions_Delete_Button').on('click', function () {
+                        const $button = $(this);
+                        if (!buttonDialog) {
+                            buttonDialog = $('#Config_DeviceFlags_Actions_Delete_Dialog').dialog({
+                                resizable: false,
+                                modal: true,
+                                autoOpen: false,
+                                buttons: {
+                                    "Delete": function () {
+                                        $(this)
+                                            .dialog("option", "buttons", null)
+                                            .find('form').trigger('submit');
+                                    },
+                                    Cancel: function () {
+                                        $(this).dialog("close");
+                                    }
+                                }
+                            });
                         }
+                        buttonDialog.dialog('open');
                     });
                 });
             </script>

Disco.Web/Areas/Config/Views/DeviceModel/Create.cshtml

@@ -1,11 +1,11 @@
 @model Disco.Web.Areas.Config.Models.DeviceModel.CreateModel
 @{
     Authorization.RequireAll(Claims.Config.DeviceModel.CreateCustom, Claims.Config.DeviceModel.Configure);
-    
+
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Device Models", MVC.Config.DeviceModel.Index(null), "Create Custom");
 }
 @using (Html.BeginForm())
-{ 
+{
     @Html.AntiForgeryToken()
     <div class="form" style="width: 450px">
         <table>
@@ -14,21 +14,23 @@
                     Name / Description:
                 </th>
                 <td>
-                @Html.TextBoxFor(model => model.Description)<br />@Html.ValidationMessageFor(model => model.Description)
+                    @Html.TextBoxFor(model => model.Description)<br />@Html.ValidationMessageFor(model => model.Description)
                 </td>
             </tr>
             <tr>
                 <th>
                     Manufacturer:
                 </th>
-                <td>@Html.TextBoxFor(model => model.Manufacturer)<br />@Html.ValidationMessageFor(model => model.Manufacturer)
+                <td>
+                    @Html.TextBoxFor(model => model.Manufacturer)<br />@Html.ValidationMessageFor(model => model.Manufacturer)
                 </td>
             </tr>
             <tr>
                 <th>
                     Model:
                 </th>
-                <td>@Html.TextBoxFor(model => model.ManufacturerModel)<br />@Html.ValidationMessageFor(model => model.ManufacturerModel)
+                <td>
+                    @Html.TextBoxFor(model => model.ManufacturerModel)<br />@Html.ValidationMessageFor(model => model.ManufacturerModel)
                 </td>
             </tr>
         </table>

Disco.Web/Areas/Config/Views/DeviceModel/Create.generated.cs

@@ -47,7 +47,7 @@ namespace Disco.Web.Areas.Config.Views.DeviceModel
             #line 2 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
   
     Authorization.RequireAll(Claims.Config.DeviceModel.CreateCustom, Claims.Config.DeviceModel.Configure);
-    
+
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Device Models", MVC.Config.DeviceModel.Index(null), "Create Custom");
 
             
@@ -58,7 +58,7 @@ WriteLiteral("\r\n");
             
             #line 7 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
  using (Html.BeginForm())
-{ 
+{
     
             
             #line default
@@ -86,11 +86,11 @@ WriteLiteral(" style=\"width: 450px\"");
 WriteLiteral(">\r\n        <table>\r\n            <tr>\r\n                <th>\r\n                    N" +
 "ame / Description:\r\n                </th>\r\n                <td>\r\n");
 
-WriteLiteral("                ");
+WriteLiteral("                    ");
 
             
             #line 17 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
-           Write(Html.TextBoxFor(model => model.Description));
+               Write(Html.TextBoxFor(model => model.Description));
 
             
             #line default
@@ -99,17 +99,19 @@ WriteLiteral("<br />");
 
             
             #line 17 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
-                                                             Write(Html.ValidationMessageFor(model => model.Description));
+                                                                 Write(Html.ValidationMessageFor(model => model.Description));
 
             
             #line default
             #line hidden
 WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>\r\n                <th" +
 ">\r\n                    Manufacturer:\r\n                </th>\r\n                <td" +
-">");
+">\r\n");
+
+WriteLiteral("                    ");
 
             
-            #line 24 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
+            #line 25 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
                Write(Html.TextBoxFor(model => model.Manufacturer));
 
             
@@ -118,17 +120,19 @@ WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>
 WriteLiteral("<br />");
 
             
-            #line 24 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
+            #line 25 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
                                                                   Write(Html.ValidationMessageFor(model => model.Manufacturer));
 
             
             #line default
             #line hidden
 WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>\r\n                <th" +
-">\r\n                    Model:\r\n                </th>\r\n                <td>");
+">\r\n                    Model:\r\n                </th>\r\n                <td>\r\n");
+
+WriteLiteral("                    ");
 
             
-            #line 31 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
+            #line 33 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
                Write(Html.TextBoxFor(model => model.ManufacturerModel));
 
             
@@ -137,7 +141,7 @@ WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>
 WriteLiteral("<br />");
 
             
-            #line 31 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
+            #line 33 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
                                                                        Write(Html.ValidationMessageFor(model => model.ManufacturerModel));
 
             
@@ -165,7 +169,7 @@ WriteLiteral(">\r\n        $(function () {\r\n            $(\'#Description\').fo
 "    });\r\n    </script>\r\n");
 
             
-            #line 44 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
+            #line 46 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
 }
 
             

Disco.Web/Areas/Config/Views/DeviceModel/Show.cshtml

@@ -274,6 +274,7 @@
                     <hr />
                     using (Html.BeginForm(MVC.API.DeviceModel.Image(Model.DeviceModel.Id, true, null), FormMethod.Post, new { enctype = "multipart/form-data" }))
                     {
+                        @Html.AntiForgeryToken()
                         <input type="file" name="Image" id="Image" style="width: 220px;" />
                         <input class="button small" type="submit" value="Upload Image" />
                     }
@@ -290,7 +291,7 @@
     {
         <button id="DeviceModel_Decommission" class="button">Decommission All Devices</button>
         <div id="DeviceModel_Decommission_Dialog" class="dialog" title="Model Device Decommission">
-            @using (Html.BeginForm(MVC.API.Device.DeviceModelDecommission(Model.DeviceModel.Id), FormMethod.Post))
+            @using (Html.BeginForm(MVC.API.Device.DeviceModelDecommission(Model.DeviceModel.Id)))
             {
                 @Html.AntiForgeryToken()
                 <div class="clearfix" style="margin-bottom: 10px;">
@@ -347,7 +348,44 @@
     }
     @if (Model.CanDelete)
     {
-        @Html.ActionLinkButton("Delete", MVC.API.DeviceModel.Delete(Model.DeviceModel.Id, true), "buttonDelete")
+        <button id="buttonDelete" type="button" class="button">Delete</button>
+        <div id="dialogConfirmDelete" class="dialog" title="Delete this Device Model?">
+            @using (Html.BeginForm(MVC.API.DeviceModel.Delete(Model.DeviceModel.Id, true)))
+            {
+                @Html.AntiForgeryToken()
+            }
+            <p>
+                <i class="fa fa-exclamation-triangle fa-lg warning"></i>
+                This item will be permanently deleted and cannot be recovered. Are you sure?
+            </p>
+        </div>
+        <script type="text/javascript">
+            $(function () {
+                let dialog = null;
+                $('#buttonDelete').on('click', function () {
+                    if (!dialog) {
+                        dialog = $("#dialogConfirmDelete").dialog({
+                            resizable: false,
+                            width: 300,
+                            modal: true,
+                            autoOpen: false,
+                            buttons: {
+                                "Delete": function () {
+                                    $(this)
+                                        .dialog("option", "buttons", null)
+                                        .find('form').trigger('submit');
+                                },
+                                Cancel: function () {
+                                    $(this).dialog("close");
+                                }
+                            }
+                        });
+                    }
+
+                    dialog.dialog('open');
+                });
+            });
+        </script>
     }
     @if (Model.DeviceCount > 0)
     {

Disco.Web/Areas/Config/Views/DeviceModel/Show.generated.cs

@@ -936,6 +936,20 @@ WriteLiteral("                    <hr />\r\n");
             #line 275 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
                     using (Html.BeginForm(MVC.API.DeviceModel.Image(Model.DeviceModel.Id, true, null), FormMethod.Post, new { enctype = "multipart/form-data" }))
                     {
+                        
+            
+            #line default
+            #line hidden
+            
+            #line 277 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+                   Write(Html.AntiForgeryToken());
+
+            
+            #line default
+            #line hidden
+            
+            #line 277 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+                                                
 
             
             #line default
@@ -963,7 +977,7 @@ WriteLiteral(" value=\"Upload Image\"");
 WriteLiteral(" />\r\n");
 
             
-            #line 279 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 280 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
                     }
                 }
 
@@ -973,7 +987,7 @@ WriteLiteral(" />\r\n");
 WriteLiteral("            </td>\r\n        </tr>\r\n    </table>\r\n</div>\r\n<h2>Components</h2>\r\n");
 
             
-            #line 286 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 287 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
 Write(Html.Partial(MVC.Config.DeviceModel.Views._DeviceComponentsTable, Model.DeviceComponentsModel));
 
             
@@ -982,7 +996,7 @@ Write(Html.Partial(MVC.Config.DeviceModel.Views._DeviceComponentsTable, Model.De
 WriteLiteral("\r\n");
 
             
-            #line 287 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 288 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
 Write(Html.Partial(MVC.Config.Shared.Views._DeviceGroupDocumentBulkGenerate, Model));
 
             
@@ -995,13 +1009,13 @@ WriteLiteral(" class=\"actionBar\"");
 WriteLiteral(">\r\n");
 
             
-            #line 289 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 290 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
     
             
             #line default
             #line hidden
             
-            #line 289 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 290 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
      if (Model.CanDecommission)
     {
 
@@ -1027,28 +1041,28 @@ WriteLiteral(" title=\"Model Device Decommission\"");
 WriteLiteral(">\r\n");
 
             
-            #line 293 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 294 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
             
             
             #line default
             #line hidden
             
-            #line 293 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
-             using (Html.BeginForm(MVC.API.Device.DeviceModelDecommission(Model.DeviceModel.Id), FormMethod.Post))
+            #line 294 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+             using (Html.BeginForm(MVC.API.Device.DeviceModelDecommission(Model.DeviceModel.Id)))
             {
                 
             
             #line default
             #line hidden
             
-            #line 295 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 296 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
            Write(Html.AntiForgeryToken());
 
             
             #line default
             #line hidden
             
-            #line 295 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 296 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
                                         
 
             
@@ -1073,13 +1087,13 @@ WriteLiteral(" class=\"none\"");
 WriteLiteral(">\r\n");
 
             
-            #line 301 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 302 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
                         
             
             #line default
             #line hidden
             
-            #line 301 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 302 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
                          foreach (DecommissionReasons decommissionReason in Enum.GetValues(typeof(DecommissionReasons)).Cast<DecommissionReasons>().OrderBy(r => r.ToString()))
                         {
 
@@ -1090,33 +1104,33 @@ WriteLiteral("                            <li>\r\n
 
 WriteLiteral(" type=\"radio\"");
 
-WriteAttribute("id", Tuple.Create(" id=\"", 12649), Tuple.Create("\"", 12719)
-, Tuple.Create(Tuple.Create("", 12654), Tuple.Create("DeviceModel_Decommission_Dialog_Reason_", 12654), true)
+WriteAttribute("id", Tuple.Create(" id=\"", 12682), Tuple.Create("\"", 12752)
+, Tuple.Create(Tuple.Create("", 12687), Tuple.Create("DeviceModel_Decommission_Dialog_Reason_", 12687), true)
             
-            #line 304 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
-               , Tuple.Create(Tuple.Create("", 12693), Tuple.Create<System.Object, System.Int32>((int)decommissionReason
+            #line 305 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+               , Tuple.Create(Tuple.Create("", 12726), Tuple.Create<System.Object, System.Int32>((int)decommissionReason
             
             #line default
             #line hidden
-, 12693), false)
+, 12726), false)
 );
 
 WriteLiteral("\r\n                                       name=\"decommissionReason\"");
 
-WriteAttribute("value", Tuple.Create(" value=\"", 12786), Tuple.Create("\"", 12820)
+WriteAttribute("value", Tuple.Create(" value=\"", 12819), Tuple.Create("\"", 12853)
             
-            #line 305 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
-, Tuple.Create(Tuple.Create("", 12794), Tuple.Create<System.Object, System.Int32>((int)decommissionReason
+            #line 306 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+, Tuple.Create(Tuple.Create("", 12827), Tuple.Create<System.Object, System.Int32>((int)decommissionReason
             
             #line default
             #line hidden
-, 12794), false)
+, 12827), false)
 );
 
 WriteLiteral(" ");
 
             
-            #line 305 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 306 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
                                                                                                 Write((decommissionReason == DecommissionReasons.EndOfLife) ? "checked=\"checked\"" : string.Empty);
 
             
@@ -1124,21 +1138,21 @@ WriteLiteral(" ");
             #line hidden
 WriteLiteral(" />\r\n                                <label");
 
-WriteAttribute("for", Tuple.Create(" for=\"", 12960), Tuple.Create("\"", 13031)
-, Tuple.Create(Tuple.Create("", 12966), Tuple.Create("DeviceModel_Decommission_Dialog_Reason_", 12966), true)
+WriteAttribute("for", Tuple.Create(" for=\"", 12993), Tuple.Create("\"", 13064)
+, Tuple.Create(Tuple.Create("", 12999), Tuple.Create("DeviceModel_Decommission_Dialog_Reason_", 12999), true)
             
-            #line 306 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
-   , Tuple.Create(Tuple.Create("", 13005), Tuple.Create<System.Object, System.Int32>((int)decommissionReason
+            #line 307 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+   , Tuple.Create(Tuple.Create("", 13038), Tuple.Create<System.Object, System.Int32>((int)decommissionReason
             
             #line default
             #line hidden
-, 13005), false)
+, 13038), false)
 );
 
 WriteLiteral(">");
 
             
-            #line 306 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 307 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
                                                                                                            Write(decommissionReason.ReasonMessage());
 
             
@@ -1147,7 +1161,7 @@ WriteLiteral(">");
 WriteLiteral("</label>\r\n                            </li>\r\n");
 
             
-            #line 308 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 309 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
                         }
 
             
@@ -1166,7 +1180,7 @@ WriteLiteral(" />\r\n                        Unassign devices users\r\n
 "\r\n                </div>\r\n");
 
             
-            #line 316 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 317 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
             }
 
             
@@ -1210,7 +1224,7 @@ WriteLiteral(@">
 ");
 
             
-            #line 347 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 348 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
     }
 
             
@@ -1219,23 +1233,104 @@ WriteLiteral(@">
 WriteLiteral("    ");
 
             
-            #line 348 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 349 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
      if (Model.CanDelete)
     {
-        
+
+            
+            #line default
+            #line hidden
+WriteLiteral("        <button");
+
+WriteLiteral(" id=\"buttonDelete\"");
+
+WriteLiteral(" type=\"button\"");
+
+WriteLiteral(" class=\"button\"");
+
+WriteLiteral(">Delete</button>\r\n");
+
+WriteLiteral("        <div");
+
+WriteLiteral(" id=\"dialogConfirmDelete\"");
+
+WriteLiteral(" class=\"dialog\"");
+
+WriteLiteral(" title=\"Delete this Device Model?\"");
+
+WriteLiteral(">\r\n");
+
+            
+            #line 353 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            
             
             #line default
             #line hidden
             
-            #line 350 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
-   Write(Html.ActionLinkButton("Delete", MVC.API.DeviceModel.Delete(Model.DeviceModel.Id, true), "buttonDelete"));
+            #line 353 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+             using (Html.BeginForm(MVC.API.DeviceModel.Delete(Model.DeviceModel.Id, true)))
+            {
+                
+            
+            #line default
+            #line hidden
+            
+            #line 355 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+           Write(Html.AntiForgeryToken());
 
             
             #line default
             #line hidden
             
-            #line 350 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
-                                                                                                                
+            #line 355 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+                                        
+            }
+
+            
+            #line default
+            #line hidden
+WriteLiteral("            <p>\r\n                <i");
+
+WriteLiteral(" class=\"fa fa-exclamation-triangle fa-lg warning\"");
+
+WriteLiteral("></i>\r\n                This item will be permanently deleted and cannot be recove" +
+"red. Are you sure?\r\n            </p>\r\n        </div>\r\n");
+
+WriteLiteral("        <script");
+
+WriteLiteral(" type=\"text/javascript\"");
+
+WriteLiteral(@">
+            $(function () {
+                let dialog = null;
+                $('#buttonDelete').on('click', function () {
+                    if (!dialog) {
+                        dialog = $(""#dialogConfirmDelete"").dialog({
+                            resizable: false,
+                            width: 300,
+                            modal: true,
+                            autoOpen: false,
+                            buttons: {
+                                ""Delete"": function () {
+                                    $(this)
+                                        .dialog(""option"", ""buttons"", null)
+                                        .find('form').trigger('submit');
+                                },
+                                Cancel: function () {
+                                    $(this).dialog(""close"");
+                                }
+                            }
+                        });
+                    }
+
+                    dialog.dialog('open');
+                });
+            });
+        </script>
+");
+
+            
+            #line 389 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
     }
 
             
@@ -1244,7 +1339,7 @@ WriteLiteral("    ");
 WriteLiteral("    ");
 
             
-            #line 352 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 390 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
      if (Model.DeviceCount > 0)
     {
         if (Authorization.Has(Claims.Device.Actions.Export))
@@ -1254,14 +1349,14 @@ WriteLiteral("    ");
             #line default
             #line hidden
             
-            #line 356 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 394 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
        Write(Html.ActionLinkButton("Export Devices", MVC.Device.Export(null, Disco.Models.Services.Devices.DeviceExportTypes.Model, Model.DeviceModel.Id)));
 
             
             #line default
             #line hidden
             
-            #line 356 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 394 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
                                                                                                                                                           
         }
         if (Authorization.Has(Claims.Device.Search) && Model.DeviceCount > 0)
@@ -1271,14 +1366,14 @@ WriteLiteral("    ");
             #line default
             #line hidden
             
-            #line 360 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 398 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
        Write(Html.ActionLinkButton(string.Format("View {0} Device{1}", Model.DeviceCount, (Model.DeviceCount != 1 ? "s" : null)), MVC.Search.Query(Model.DeviceModel.Id.ToString(), "DeviceModel")));
 
             
             #line default
             #line hidden
             
-            #line 360 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 398 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
                                                                                                                                                                                                    
         }
     }

Disco.Web/Areas/Config/Views/DeviceModel/_DeviceComponentsTable.cshtml

@@ -8,15 +8,19 @@
 }
 @if (canConfig)
 {
-    <table id="deviceComponents" data-devicemodelid="@(Model.DeviceModelId.HasValue ? Model.DeviceModelId.Value.ToString() : string.Empty)">
+    <table id="deviceComponents" data-devicemodelid="@(Model.DeviceModelId.HasValue ? Model.DeviceModelId.Value.ToString() : string.Empty)" data-addurl="@Url.Action(MVC.API.DeviceModel.ComponentAdd(null, null, null))" data-updateurl="@Url.Action(MVC.API.DeviceModel.ComponentUpdate())" data-removeurl="@Url.Action(MVC.API.DeviceModel.ComponentRemove())" data-geturl="@Url.Action(MVC.API.DeviceModel.Component())" data-updatejobsubtypesurl="@Url.Action(MVC.API.DeviceModel.ComponentUpdateJobSubTypes())">
         <tr>
-            <th>Description
+            <th>
+                Description
             </th>
-            <th>Cost
+            <th>
+                Cost
             </th>
-            <th>Job Types
+            <th>
+                Job Types
             </th>
-            <th class="actions">&nbsp;
+            <th class="actions">
+                &nbsp;
             </th>
         </tr>
         @foreach (var item in Model.DeviceComponents)
@@ -47,183 +51,179 @@
     </table>
     <script type="text/javascript">
         $(function () {
-            var $deviceComponents = $('#deviceComponents');
+            const $deviceComponents = $('#deviceComponents');
 
             $('#addDeviceComponent').click(function () {
-                var dc = $('<tr><td><input type="text" class="description" /></td><td><input type="text" class="cost" /></td><td><span class="fa-stack edit"><i class="fa fa-list-alt fa-stack-2x"></i><i class="fa fa-asterisk fa-stack-1x hidden"></i></span></td><td><i class="fa fa-times-circle remove"></i></td></tr>');
-                dc.find('input').focus(function () { $(this).select() })
+                const dc = $('<tr><td><input type="text" class="description" /></td><td><input type="text" class="cost" /></td><td><span class="fa-stack edit"><i class="fa fa-list-alt fa-stack-2x"></i><i class="fa fa-asterisk fa-stack-1x hidden"></i></span></td><td><i class="fa fa-times-circle remove"></i></td></tr>');
                 dc.insertBefore($deviceComponents.find('tr').last());
                 dc.find('input.description').focus();
                 return false;
             });
 
-            $deviceComponents.on('change', 'input', updateComponent);
+            $deviceComponents.on('change', 'input', function () { updateComponent(this); });
             $deviceComponents.on('focus', 'input', function () { $(this).select(); });
 
             $deviceComponents.on('click', '.remove', removeComponent);
-            $deviceComponents.on('click', '.edit', editComponentJobTypes);
+            $deviceComponents.on('click', '.edit', function () { editComponentJobTypes(this); });
 
-            function removeComponentConfirmed(id, row) {
-                var data = { id: id };
-                $.ajax({
-                    url: '@Url.Action(MVC.API.DeviceModel.ComponentRemove())',
-                    dataType: 'json',
-                    data: data,
-                    success: function (d) {
-                        if (d == 'OK') {
-                            row.remove();
-                        } else {
-                            alert('Unable to remove component: ' + d);
-                        }
-                    },
-                    error: function (jqXHR, textStatus, errorThrown) {
-                        alert('Unable to remove component: ' + textStatus);
+            async function removeComponentConfirmed(id, row) {
+                const body = new FormData();
+                body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                body.append('id', id);
+
+                try {
+                    const response = await fetch($deviceComponents.attr('data-removeurl'), {
+                        method: 'POST',
+                        body: body
+                    });
+
+                    if (response.ok) {
+                        row.remove();
+                    } else {
+                        alert('Unable to remove component: ' + response.statusText);
                     }
-                });
-        }
+                } catch (e) {
+                    alert('Unable to remove component: ' + e);
+                }
+            }
             function removeComponent() {
-                var componentRow = $(this).closest('tr');
-                var id = componentRow.attr('data-devicecomponentid');
+                const componentRow = $(this).closest('tr');
+                const id = componentRow.attr('data-devicecomponentid');
                 if (id) {
-                    var dialog = $("#dialogConfirmRemove");
-                    var buttons = dialog.dialog("option", "buttons");
+                    const dialog = $("#dialogConfirmRemove");
+                    const buttons = dialog.dialog("option", "buttons");
                     buttons['Remove'] = function () { removeComponentConfirmed(id, componentRow); $(this).dialog("close"); };
-                    var buttons = dialog.dialog("option", "buttons", buttons);
+                    dialog.dialog("option", "buttons", buttons);
                     dialog.dialog('open');
                 } else {
                     // New - Remove
                     componentRow.remove();
                 }
             }
-            function updateComponent() {
-                var componentRow = $(this).closest('tr');
+            async function updateComponent(input) {
+                const componentRow = $(input).closest('tr');
                 componentRow.find('input').attr('disabled', true).addClass('updating');
 
-                var id = componentRow.attr('data-devicecomponentid');
+                const id = componentRow.attr('data-devicecomponentid');
                 if (id) {
                     // Update
-                    var data = {
-                        id: id,
-                        Description: componentRow.find('input.description').val(),
-                        Cost: componentRow.find('input.cost').val()
-                    };
-                    $.ajax({
-                        url: '@Url.Action(MVC.API.DeviceModel.ComponentUpdate())',
-                        dataType: 'json',
-                        type: 'POST',
-                        data: data,
-                        success: function (d) {
+                    const body = new FormData();
+                    body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                    body.append('id', id);
+                    body.append('description', componentRow.find('input.description').val());
+                    body.append('cost', componentRow.find('input.cost').val());
+
+                    try {
+                        const response = await fetch($deviceComponents.attr('data-updateurl'), {
+                            method: 'POST',
+                            body: body
+                        });
+
+                        if (response.ok) {
+                            const result = await response.json();
                             componentRow.find('input').attr('disabled', false).removeClass('updating');
-                            if (d.Result == 'OK') {
-                                componentRow.find('input.description').val(d.Component.Description);
-                                componentRow.find('input.cost').val(d.Component.Cost);
-                            } else {
-                                alert('Unable to update component: ' + d.Result);
-                            }
-                        },
-                        error: function (jqXHR, textStatus, errorThrown) {
-                            alert('Unable to update component: ' + textStatus);
+                            componentRow.find('input.description').val(result.Description);
+                            componentRow.find('input.cost').val(result.Cost);
+                        } else {
+                            alert('Unable to update component: ' + response.statusText);
                         }
-                    });
+                    } catch (e) {
+                        alert('Unable to update component: ' + e);
+                    }
                 } else {
                     // Add
-                    id = componentRow.closest('table').attr('data-devicemodelid');
-                    var data = {
-                        id: id,
-                        Description: componentRow.find('input.description').val(),
-                        Cost: componentRow.find('input.cost').val()
-                    };
-                    $.ajax({
-                        url: '@Url.Action(MVC.API.DeviceModel.ComponentAdd(null, null, null))',
-                        dataType: 'json',
-                        type: 'POST',
-                        data: data,
-                        success: function (d) {
+                    const modelId = componentRow.closest('table').attr('data-devicemodelid');
+                    const body = new FormData();
+                    body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                    body.append('id', modelId);
+                    body.append('description', componentRow.find('input.description').val());
+                    body.append('cost', componentRow.find('input.cost').val());
+
+                    try {
+                        const response = await fetch($deviceComponents.attr('data-addurl'), {
+                            method: 'POST',
+                            body: body
+                        });
+
+                        if (response.ok) {
+                            const result = await response.json();
                             componentRow.find('input').attr('disabled', false).removeClass('updating');
-                            if (d.Result == 'OK') {
-                                componentRow.attr('data-devicecomponentid', d.Component.Id);
-                                componentRow.find('input.description').val(d.Component.Description);
-                                componentRow.find('input.cost').val(d.Component.Cost);
-                            } else {
-                                alert('Unable to add component: ' + d.Result);
-                            }
-                        },
-                        error: function (jqXHR, textStatus, errorThrown) {
-                            alert('Unable to add component: ' + textStatus);
+                            componentRow.attr('data-devicecomponentid', result.Id);
+                            componentRow.find('input.description').val(result.Description);
+                            componentRow.find('input.cost').val(result.Cost);
+                        } else {
+                            alert('Unable to add component: ' + response.statusText);
                         }
-                    });
+                    } catch (e) {
+                        alert('Unable to add component: ' + e);
+                    }
                 }
             }
-            function editComponentJobTypes() {
-                var edit$this = $(this);
-                var componentRow = edit$this.closest('tr');
-
-                var id = componentRow.attr('data-devicecomponentid');
+            async function editComponentJobTypes(input) {
+                const edit$this = $(input);
+                const componentRow = edit$this.closest('tr');
+                const id = componentRow.attr('data-devicecomponentid');
 
                 if (id) {
-                    var data = {
-                        id: id
-                    };
-                    $.ajax({
-                        url: '@Url.Action(MVC.API.DeviceModel.Component())',
-                        dataType: 'json',
-                        data: data,
-                        success: function (d) {
-                            componentRow.find('input').attr('disabled', false).removeClass('updating');
-                            if (d.Result == 'OK') {
-                                $dialogUpdateJobTypes = $('#dialogUpdateJobTypes');
-                                $dialogUpdateJobTypes.find('input:checked').each(function () { $(this).prop('checked', false) });
-                                for (var i = 0; i < d.Component.JobSubTypes.length; i++) {
-                                    var sjt = d.Component.JobSubTypes[i];
-                                    $dialogUpdateJobTypes.find('#SubTypes_' + sjt).prop('checked', true);
-                                }
-                                $('#CheckboxBulkSelect_dialogUpdateJobTypes').checkboxBulkSelect('update');
-                                var buttons = $dialogUpdateJobTypes.dialog("option", "buttons");
-                                buttons['Save'] = function () {
-                                    $dialogUpdateJobTypes.dialog("disable");
-                                    var selectedSJTs = [];
-                                    $dialogUpdateJobTypes.find('input:checked').each(function () { selectedSJTs.push($(this).val()) });
+                    try {
+                        const body = new FormData();
+                        body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                        body.append('id', id);
+                        const getResponse = await fetch($deviceComponents.attr('data-geturl'), {
+                            method: 'POST',
+                            body: body
+                        })
 
-                                    var data = {
-                                        id: id,
-                                        JobSubTypes: selectedSJTs
-                                    };
-                                    $.ajax({
-                                        url: '@Url.Action(MVC.API.DeviceModel.ComponentUpdateJobSubTypes())',
-                                        dataType: 'json',
-                                        type: 'POST',
-                                        traditional: true,
-                                        data: data,
-                                        success: function (d) {
-                                            if (d.Result == 'OK') {
-                                                if (d.Component.JobSubTypes.length > 0) {
-                                                    edit$this.find('.fa-asterisk').removeClass('hidden');
-                                                } else {
-                                                    edit$this.find('.fa-asterisk').addClass('hidden');
-                                                }
-                                                $dialogUpdateJobTypes.dialog("enable");
-                                                $dialogUpdateJobTypes.dialog("close");
-                                            } else {
-                                                alert('Unable to update component sub types: ' + d.Result);
-                                            }
-                                        },
-                                        error: function (jqXHR, textStatus, errorThrown) {
-                                            alert('Unable to update component sub types: ' + textStatus);
-                                        }
-                                    });
-                                };
-                                var buttons = $dialogUpdateJobTypes.dialog("option", "buttons", buttons);
-                                $dialogUpdateJobTypes.dialog('open');
-                            } else {
-                                alert('Unable to load component: ' + d.Result);
+                        componentRow.find('input').attr('disabled', false).removeClass('updating');
+                        if (getResponse.ok) {
+                            const component = await getResponse.json();
+                            $dialogUpdateJobTypes = $('#dialogUpdateJobTypes');
+                            $dialogUpdateJobTypes.find('input:checked').each(function () { $(this).prop('checked', false) });
+                            for (var i = 0; i < component.JobSubTypes.length; i++) {
+                                var sjt = component.JobSubTypes[i];
+                                $dialogUpdateJobTypes.find('#SubTypes_' + sjt).prop('checked', true);
                             }
-                        },
-                        error: function (jqXHR, textStatus, errorThrown) {
-                            alert('Unable to load component: ' + textStatus);
-                        }
-                    });
-                }
+                            $('#CheckboxBulkSelect_dialogUpdateJobTypes').checkboxBulkSelect('update');
+                            const buttons = $dialogUpdateJobTypes.dialog("option", "buttons");
+                            buttons['Save'] = function () {
+                                async function saveAsync() {
+                                    const body = new FormData();
+                                    let jobSubTypeCount = 0;
+                                    body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                                    body.append('id', id);
+                                    $dialogUpdateJobTypes.find('input:checked').each(function () { body.append('jobSubTypes', $(this).val()); jobSubTypeCount++; });
 
+                                    try {
+                                        const updateResponse = await fetch($deviceComponents.attr('data-updatejobsubtypesurl'), {
+                                            method: 'POST',
+                                            body: body
+                                        })
+
+                                        if (updateResponse.ok) {
+                                            if (jobSubTypeCount > 0) {
+                                                edit$this.find('.fa-asterisk').removeClass('hidden');
+                                            } else {
+                                                edit$this.find('.fa-asterisk').addClass('hidden');
+                                            }
+                                            $dialogUpdateJobTypes.dialog("close");
+                                        } else {
+                                            alert('Unable to update component sub types: ' + updateResponse.statusText);
+                                        }
+                                    } catch (e) {
+                                        alert('Unable to update component sub types: ' + e);
+                                    }
+                                }
+                                saveAsync();
+                            };
+                            $dialogUpdateJobTypes.dialog("option", "buttons", buttons);
+                            $dialogUpdateJobTypes.dialog('open');
+                        } else {
+                            alert('Unable to load component: ' + getResponse.statusText);
+                        }
+                    } catch (e) {
+                        alert('Unable to load component: ' + e);
+                    }
+                }
             }
 
             $("#dialogConfirmRemove").dialog({
@@ -278,11 +278,14 @@ else
 {
     <table id="deviceComponents" data-devicemodelid="@(Model.DeviceModelId.HasValue ? Model.DeviceModelId.Value.ToString() : string.Empty)">
         <tr>
-            <th>Description
+            <th>
+                Description
             </th>
-            <th>Cost
+            <th>
+                Cost
             </th>
-            <th>Job Types
+            <th>
+                Job Types
             </th>
         </tr>
         @foreach (var item in Model.DeviceComponents)

Disco.Web/Areas/Config/Views/DeviceModel/_DeviceComponentsTable.generated.cs

@@ -80,22 +80,77 @@ WriteLiteral(" data-devicemodelid=\"");
             #line hidden
 WriteLiteral("\"");
 
-WriteLiteral(">\r\n        <tr>\r\n            <th>Description\r\n            </th>\r\n            <th>" +
-"Cost\r\n            </th>\r\n            <th>Job Types\r\n            </th>\r\n         " +
-"   <th");
+WriteLiteral(" data-addurl=\"");
+
+            
+            #line 11 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+                                                                                                                                                    Write(Url.Action(MVC.API.DeviceModel.ComponentAdd(null, null, null)));
+
+            
+            #line default
+            #line hidden
+WriteLiteral("\"");
+
+WriteLiteral(" data-updateurl=\"");
+
+            
+            #line 11 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+                                                                                                                                                                                                                                     Write(Url.Action(MVC.API.DeviceModel.ComponentUpdate()));
+
+            
+            #line default
+            #line hidden
+WriteLiteral("\"");
+
+WriteLiteral(" data-removeurl=\"");
+
+            
+            #line 11 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+                                                                                                                                                                                                                                                                                                         Write(Url.Action(MVC.API.DeviceModel.ComponentRemove()));
+
+            
+            #line default
+            #line hidden
+WriteLiteral("\"");
+
+WriteLiteral(" data-geturl=\"");
+
+            
+            #line 11 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+                                                                                                                                                                                                                                                                                                                                                                          Write(Url.Action(MVC.API.DeviceModel.Component()));
+
+            
+            #line default
+            #line hidden
+WriteLiteral("\"");
+
+WriteLiteral(" data-updatejobsubtypesurl=\"");
+
+            
+            #line 11 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+                                                                                                                                                                                                                                                                                                                                                                                                                                                   Write(Url.Action(MVC.API.DeviceModel.ComponentUpdateJobSubTypes()));
+
+            
+            #line default
+            #line hidden
+WriteLiteral("\"");
+
+WriteLiteral(">\r\n        <tr>\r\n            <th>\r\n                Description\r\n            </th>" +
+"\r\n            <th>\r\n                Cost\r\n            </th>\r\n            <th>\r\n " +
+"               Job Types\r\n            </th>\r\n            <th");
 
 WriteLiteral(" class=\"actions\"");
 
-WriteLiteral(">&nbsp;\r\n            </th>\r\n        </tr>\r\n");
+WriteLiteral(">\r\n                &nbsp;\r\n            </th>\r\n        </tr>\r\n");
 
             
-            #line 22 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 26 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
         
             
             #line default
             #line hidden
             
-            #line 22 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 26 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
          foreach (var item in Model.DeviceComponents)
         {
 
@@ -107,7 +162,7 @@ WriteLiteral("            <tr");
 WriteLiteral(" data-devicecomponentid=\"");
 
             
-            #line 24 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 28 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
                                    Write(item.Id);
 
             
@@ -121,14 +176,14 @@ WriteLiteral(" type=\"text\"");
 
 WriteLiteral(" class=\"description\"");
 
-WriteAttribute("value", Tuple.Create(" value=\"", 883), Tuple.Create("\"", 908)
+WriteAttribute("value", Tuple.Create(" value=\"", 1318), Tuple.Create("\"", 1343)
             
-            #line 26 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
-, Tuple.Create(Tuple.Create("", 891), Tuple.Create<System.Object, System.Int32>(item.Description
+            #line 30 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+, Tuple.Create(Tuple.Create("", 1326), Tuple.Create<System.Object, System.Int32>(item.Description
             
             #line default
             #line hidden
-, 891), false)
+, 1326), false)
 );
 
 WriteLiteral(" />\r\n                </td>\r\n                <td>\r\n                    <input");
@@ -137,14 +192,14 @@ WriteLiteral(" type=\"text\"");
 
 WriteLiteral(" class=\"cost\"");
 
-WriteAttribute("value", Tuple.Create(" value=\"", 1010), Tuple.Create("\"", 1042)
+WriteAttribute("value", Tuple.Create(" value=\"", 1445), Tuple.Create("\"", 1477)
             
-            #line 29 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
-, Tuple.Create(Tuple.Create("", 1018), Tuple.Create<System.Object, System.Int32>(item.Cost.ToString("C")
+            #line 33 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+, Tuple.Create(Tuple.Create("", 1453), Tuple.Create<System.Object, System.Int32>(item.Cost.ToString("C")
             
             #line default
             #line hidden
-, 1018), false)
+, 1453), false)
 );
 
 WriteLiteral(" />\r\n                </td>\r\n                <td>\r\n                    <span");
@@ -157,17 +212,17 @@ WriteLiteral(" class=\"fa fa-list-alt fa-stack-2x\"");
 
 WriteLiteral("></i>\r\n                        <i");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 1237), Tuple.Create("\"", 1328)
-, Tuple.Create(Tuple.Create("", 1245), Tuple.Create("fa", 1245), true)
-, Tuple.Create(Tuple.Create(" ", 1247), Tuple.Create("fa-asterisk", 1248), true)
-, Tuple.Create(Tuple.Create(" ", 1259), Tuple.Create("fa-stack-1x", 1260), true)
+WriteAttribute("class", Tuple.Create(" class=\"", 1672), Tuple.Create("\"", 1763)
+, Tuple.Create(Tuple.Create("", 1680), Tuple.Create("fa", 1680), true)
+, Tuple.Create(Tuple.Create(" ", 1682), Tuple.Create("fa-asterisk", 1683), true)
+, Tuple.Create(Tuple.Create(" ", 1694), Tuple.Create("fa-stack-1x", 1695), true)
             
-            #line 34 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
-, Tuple.Create(Tuple.Create("", 1271), Tuple.Create<System.Object, System.Int32>(item.JobSubTypes.Count == 0 ? " hidden" : string.Empty
+            #line 38 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+, Tuple.Create(Tuple.Create("", 1706), Tuple.Create<System.Object, System.Int32>(item.JobSubTypes.Count == 0 ? " hidden" : string.Empty
             
             #line default
             #line hidden
-, 1271), false)
+, 1706), false)
 );
 
 WriteLiteral("></i>\r\n                    </span>\r\n                </td>\r\n                <td>\r\n" +
@@ -178,7 +233,7 @@ WriteLiteral(" class=\"fa fa-times-circle remove\"");
 WriteLiteral("></i>\r\n                </td>\r\n            </tr>\r\n");
 
             
-            #line 41 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 45 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
         }
 
             
@@ -200,213 +255,142 @@ WriteLiteral("    <script");
 
 WriteLiteral(" type=\"text/javascript\"");
 
-WriteLiteral(@">
-        $(function () {
-            var $deviceComponents = $('#deviceComponents');
-
-            $('#addDeviceComponent').click(function () {
-                var dc = $('<tr><td><input type=""text"" class=""description"" /></td><td><input type=""text"" class=""cost"" /></td><td><span class=""fa-stack edit""><i class=""fa fa-list-alt fa-stack-2x""></i><i class=""fa fa-asterisk fa-stack-1x hidden""></i></span></td><td><i class=""fa fa-times-circle remove""></i></td></tr>');
-                dc.find('input').focus(function () { $(this).select() })
-                dc.insertBefore($deviceComponents.find('tr').last());
-                dc.find('input.description').focus();
-                return false;
-            });
-
-            $deviceComponents.on('change', 'input', updateComponent);
-            $deviceComponents.on('focus', 'input', function () { $(this).select(); });
-
-            $deviceComponents.on('click', '.remove', removeComponent);
-            $deviceComponents.on('click', '.edit', editComponentJobTypes);
-
-            function removeComponentConfirmed(id, row) {
-                var data = { id: id };
-                $.ajax({
-                    url: '");
-
-            
-            #line 69 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
-                     Write(Url.Action(MVC.API.DeviceModel.ComponentRemove()));
-
-            
-            #line default
-            #line hidden
-WriteLiteral("\',\r\n                    dataType: \'json\',\r\n                    data: data,\r\n     " +
-"               success: function (d) {\r\n                        if (d == \'OK\') {" +
-"\r\n                            row.remove();\r\n                        } else {\r\n " +
-"                           alert(\'Unable to remove component: \' + d);\r\n         " +
-"               }\r\n                    },\r\n                    error: function (j" +
-"qXHR, textStatus, errorThrown) {\r\n                        alert(\'Unable to remov" +
-"e component: \' + textStatus);\r\n                    }\r\n                });\r\n     " +
-"   }\r\n            function removeComponent() {\r\n                var componentRow" +
-" = $(this).closest(\'tr\');\r\n                var id = componentRow.attr(\'data-devi" +
-"cecomponentid\');\r\n                if (id) {\r\n                    var dialog = $(" +
-"\"#dialogConfirmRemove\");\r\n                    var buttons = dialog.dialog(\"optio" +
-"n\", \"buttons\");\r\n                    buttons[\'Remove\'] = function () { removeCom" +
-"ponentConfirmed(id, componentRow); $(this).dialog(\"close\"); };\r\n                " +
-"    var buttons = dialog.dialog(\"option\", \"buttons\", buttons);\r\n                " +
-"    dialog.dialog(\'open\');\r\n                } else {\r\n                    // New" +
-" - Remove\r\n                    componentRow.remove();\r\n                }\r\n      " +
-"      }\r\n            function updateComponent() {\r\n                var component" +
-"Row = $(this).closest(\'tr\');\r\n                componentRow.find(\'input\').attr(\'d" +
-"isabled\', true).addClass(\'updating\');\r\n\r\n                var id = componentRow.a" +
-"ttr(\'data-devicecomponentid\');\r\n                if (id) {\r\n                    /" +
-"/ Update\r\n                    var data = {\r\n                        id: id,\r\n   " +
-"                     Description: componentRow.find(\'input.description\').val(),\r" +
-"\n                        Cost: componentRow.find(\'input.cost\').val()\r\n          " +
-"          };\r\n                    $.ajax({\r\n                        url: \'");
-
-            
-            #line 111 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
-                         Write(Url.Action(MVC.API.DeviceModel.ComponentUpdate()));
-
-            
-            #line default
-            #line hidden
-WriteLiteral(@"',
-                        dataType: 'json',
-                        type: 'POST',
-                        data: data,
-                        success: function (d) {
-                            componentRow.find('input').attr('disabled', false).removeClass('updating');
-                            if (d.Result == 'OK') {
-                                componentRow.find('input.description').val(d.Component.Description);
-                                componentRow.find('input.cost').val(d.Component.Cost);
-                            } else {
-                                alert('Unable to update component: ' + d.Result);
-                            }
-                        },
-                        error: function (jqXHR, textStatus, errorThrown) {
-                            alert('Unable to update component: ' + textStatus);
-                        }
-                    });
-                } else {
-                    // Add
-                    id = componentRow.closest('table').attr('data-devicemodelid');
-                    var data = {
-                        id: id,
-                        Description: componentRow.find('input.description').val(),
-                        Cost: componentRow.find('input.cost').val()
-                    };
-                    $.ajax({
-                        url: '");
-
-            
-            #line 137 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
-                         Write(Url.Action(MVC.API.DeviceModel.ComponentAdd(null, null, null)));
-
-            
-            #line default
-            #line hidden
-WriteLiteral(@"',
-                        dataType: 'json',
-                        type: 'POST',
-                        data: data,
-                        success: function (d) {
-                            componentRow.find('input').attr('disabled', false).removeClass('updating');
-                            if (d.Result == 'OK') {
-                                componentRow.attr('data-devicecomponentid', d.Component.Id);
-                                componentRow.find('input.description').val(d.Component.Description);
-                                componentRow.find('input.cost').val(d.Component.Cost);
-                            } else {
-                                alert('Unable to add component: ' + d.Result);
-                            }
-                        },
-                        error: function (jqXHR, textStatus, errorThrown) {
-                            alert('Unable to add component: ' + textStatus);
-                        }
-                    });
-                }
-            }
-            function editComponentJobTypes() {
-                var edit$this = $(this);
-                var componentRow = edit$this.closest('tr');
-
-                var id = componentRow.attr('data-devicecomponentid');
-
-                if (id) {
-                    var data = {
-                        id: id
-                    };
-                    $.ajax({
-                        url: '");
-
-            
-            #line 168 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
-                         Write(Url.Action(MVC.API.DeviceModel.Component()));
-
-            
-            #line default
-            #line hidden
-WriteLiteral("\',\r\n                        dataType: \'json\',\r\n                        data: data" +
-",\r\n                        success: function (d) {\r\n                            " +
-"componentRow.find(\'input\').attr(\'disabled\', false).removeClass(\'updating\');\r\n   " +
-"                         if (d.Result == \'OK\') {\r\n                              " +
-"  $dialogUpdateJobTypes = $(\'#dialogUpdateJobTypes\');\r\n                         " +
-"       $dialogUpdateJobTypes.find(\'input:checked\').each(function () { $(this).pr" +
-"op(\'checked\', false) });\r\n                                for (var i = 0; i < d." +
-"Component.JobSubTypes.length; i++) {\r\n                                    var sj" +
-"t = d.Component.JobSubTypes[i];\r\n                                    $dialogUpda" +
-"teJobTypes.find(\'#SubTypes_\' + sjt).prop(\'checked\', true);\r\n                    " +
-"            }\r\n                                $(\'#CheckboxBulkSelect_dialogUpda" +
-"teJobTypes\').checkboxBulkSelect(\'update\');\r\n                                var " +
-"buttons = $dialogUpdateJobTypes.dialog(\"option\", \"buttons\");\r\n                  " +
-"              buttons[\'Save\'] = function () {\r\n                                 " +
-"   $dialogUpdateJobTypes.dialog(\"disable\");\r\n                                   " +
-" var selectedSJTs = [];\r\n                                    $dialogUpdateJobTyp" +
-"es.find(\'input:checked\').each(function () { selectedSJTs.push($(this).val()) });" +
-"\r\n\r\n                                    var data = {\r\n                          " +
-"              id: id,\r\n                                        JobSubTypes: sele" +
-"ctedSJTs\r\n                                    };\r\n                              " +
-"      $.ajax({\r\n                                        url: \'");
-
-            
-            #line 192 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
-                                         Write(Url.Action(MVC.API.DeviceModel.ComponentUpdateJobSubTypes()));
-
-            
-            #line default
-            #line hidden
-WriteLiteral("\',\r\n                                        dataType: \'json\',\r\n                  " +
-"                      type: \'POST\',\r\n                                        tra" +
-"ditional: true,\r\n                                        data: data,\r\n          " +
-"                              success: function (d) {\r\n                         " +
-"                   if (d.Result == \'OK\') {\r\n                                    " +
-"            if (d.Component.JobSubTypes.length > 0) {\r\n                         " +
-"                           edit$this.find(\'.fa-asterisk\').removeClass(\'hidden\');" +
-"\r\n                                                } else {\r\n                    " +
-"                                edit$this.find(\'.fa-asterisk\').addClass(\'hidden\'" +
-");\r\n                                                }\r\n                         " +
-"                       $dialogUpdateJobTypes.dialog(\"enable\");\r\n                " +
-"                                $dialogUpdateJobTypes.dialog(\"close\");\r\n        " +
-"                                    } else {\r\n                                  " +
-"              alert(\'Unable to update component sub types: \' + d.Result);\r\n     " +
-"                                       }\r\n                                      " +
-"  },\r\n                                        error: function (jqXHR, textStatus" +
-", errorThrown) {\r\n                                            alert(\'Unable to u" +
-"pdate component sub types: \' + textStatus);\r\n                                   " +
-"     }\r\n                                    });\r\n                               " +
-" };\r\n                                var buttons = $dialogUpdateJobTypes.dialog(" +
-"\"option\", \"buttons\", buttons);\r\n                                $dialogUpdateJob" +
-"Types.dialog(\'open\');\r\n                            } else {\r\n                   " +
-"             alert(\'Unable to load component: \' + d.Result);\r\n                  " +
-"          }\r\n                        },\r\n                        error: function" +
-" (jqXHR, textStatus, errorThrown) {\r\n                            alert(\'Unable t" +
-"o load component: \' + textStatus);\r\n                        }\r\n                 " +
-"   });\r\n                }\r\n\r\n            }\r\n\r\n            $(\"#dialogConfirmRemov" +
-"e\").dialog({\r\n                resizable: false,\r\n                height: 140,\r\n " +
-"               modal: true,\r\n                autoOpen: false,\r\n                b" +
-"uttons: {\r\n                    \"Remove\": function () {\r\n                        " +
-"$(this).dialog(\"close\");\r\n                    },\r\n                    Cancel: fu" +
-"nction () {\r\n                        $(this).dialog(\"close\");\r\n                 " +
-"   }\r\n                }\r\n            });\r\n\r\n            $(\'#dialogUpdateJobTypes" +
-"\').dialog({\r\n                resizable: false,\r\n                modal: true,\r\n  " +
-"              autoOpen: false,\r\n                width: 550,\r\n                but" +
-"tons: {\r\n                    \"Save\": function () {\r\n                        $(th" +
-"is).dialog(\"close\");\r\n                    },\r\n                    Cancel: functi" +
-"on () {\r\n                        $(this).dialog(\"close\");\r\n                    }" +
-"\r\n                }\r\n            });\r\n\r\n            $(\'#CheckboxBulkSelect_dialo" +
-"gUpdateJobTypes\').checkboxBulkSelect({ parentSelector: \'div\' });\r\n        });\r\n " +
-"   </script>\r\n");
+WriteLiteral(">\r\n        $(function () {\r\n            const $deviceComponents = $(\'#deviceCompo" +
+"nents\');\r\n\r\n            $(\'#addDeviceComponent\').click(function () {\r\n          " +
+"      const dc = $(\'<tr><td><input type=\"text\" class=\"description\" /></td><td><i" +
+"nput type=\"text\" class=\"cost\" /></td><td><span class=\"fa-stack edit\"><i class=\"f" +
+"a fa-list-alt fa-stack-2x\"></i><i class=\"fa fa-asterisk fa-stack-1x hidden\"></i>" +
+"</span></td><td><i class=\"fa fa-times-circle remove\"></i></td></tr>\');\r\n        " +
+"        dc.insertBefore($deviceComponents.find(\'tr\').last());\r\n                d" +
+"c.find(\'input.description\').focus();\r\n                return false;\r\n           " +
+" });\r\n\r\n            $deviceComponents.on(\'change\', \'input\', function () { update" +
+"Component(this); });\r\n            $deviceComponents.on(\'focus\', \'input\', functio" +
+"n () { $(this).select(); });\r\n\r\n            $deviceComponents.on(\'click\', \'.remo" +
+"ve\', removeComponent);\r\n            $deviceComponents.on(\'click\', \'.edit\', funct" +
+"ion () { editComponentJobTypes(this); });\r\n\r\n            async function removeCo" +
+"mponentConfirmed(id, row) {\r\n                const body = new FormData();\r\n     " +
+"           body.append(\'__RequestVerificationToken\', document.body.dataset.antif" +
+"orgery);\r\n                body.append(\'id\', id);\r\n\r\n                try {\r\n     " +
+"               const response = await fetch($deviceComponents.attr(\'data-removeu" +
+"rl\'), {\r\n                        method: \'POST\',\r\n                        body: " +
+"body\r\n                    });\r\n\r\n                    if (response.ok) {\r\n       " +
+"                 row.remove();\r\n                    } else {\r\n                  " +
+"      alert(\'Unable to remove component: \' + response.statusText);\r\n            " +
+"        }\r\n                } catch (e) {\r\n                    alert(\'Unable to r" +
+"emove component: \' + e);\r\n                }\r\n            }\r\n            function" +
+" removeComponent() {\r\n                const componentRow = $(this).closest(\'tr\')" +
+";\r\n                const id = componentRow.attr(\'data-devicecomponentid\');\r\n    " +
+"            if (id) {\r\n                    const dialog = $(\"#dialogConfirmRemov" +
+"e\");\r\n                    const buttons = dialog.dialog(\"option\", \"buttons\");\r\n " +
+"                   buttons[\'Remove\'] = function () { removeComponentConfirmed(id" +
+", componentRow); $(this).dialog(\"close\"); };\r\n                    dialog.dialog(" +
+"\"option\", \"buttons\", buttons);\r\n                    dialog.dialog(\'open\');\r\n    " +
+"            } else {\r\n                    // New - Remove\r\n                    c" +
+"omponentRow.remove();\r\n                }\r\n            }\r\n            async funct" +
+"ion updateComponent(input) {\r\n                const componentRow = $(input).clos" +
+"est(\'tr\');\r\n                componentRow.find(\'input\').attr(\'disabled\', true).ad" +
+"dClass(\'updating\');\r\n\r\n                const id = componentRow.attr(\'data-device" +
+"componentid\');\r\n                if (id) {\r\n                    // Update\r\n      " +
+"              const body = new FormData();\r\n                    body.append(\'__R" +
+"equestVerificationToken\', document.body.dataset.antiforgery);\r\n                 " +
+"   body.append(\'id\', id);\r\n                    body.append(\'description\', compon" +
+"entRow.find(\'input.description\').val());\r\n                    body.append(\'cost\'" +
+", componentRow.find(\'input.cost\').val());\r\n\r\n                    try {\r\n        " +
+"                const response = await fetch($deviceComponents.attr(\'data-update" +
+"url\'), {\r\n                            method: \'POST\',\r\n                         " +
+"   body: body\r\n                        });\r\n\r\n                        if (respon" +
+"se.ok) {\r\n                            const result = await response.json();\r\n   " +
+"                         componentRow.find(\'input\').attr(\'disabled\', false).remo" +
+"veClass(\'updating\');\r\n                            componentRow.find(\'input.descr" +
+"iption\').val(result.Description);\r\n                            componentRow.find" +
+"(\'input.cost\').val(result.Cost);\r\n                        } else {\r\n            " +
+"                alert(\'Unable to update component: \' + response.statusText);\r\n  " +
+"                      }\r\n                    } catch (e) {\r\n                    " +
+"    alert(\'Unable to update component: \' + e);\r\n                    }\r\n         " +
+"       } else {\r\n                    // Add\r\n                    const modelId =" +
+" componentRow.closest(\'table\').attr(\'data-devicemodelid\');\r\n                    " +
+"const body = new FormData();\r\n                    body.append(\'__RequestVerifica" +
+"tionToken\', document.body.dataset.antiforgery);\r\n                    body.append" +
+"(\'id\', modelId);\r\n                    body.append(\'description\', componentRow.fi" +
+"nd(\'input.description\').val());\r\n                    body.append(\'cost\', compone" +
+"ntRow.find(\'input.cost\').val());\r\n\r\n                    try {\r\n                 " +
+"       const response = await fetch($deviceComponents.attr(\'data-addurl\'), {\r\n  " +
+"                          method: \'POST\',\r\n                            body: bod" +
+"y\r\n                        });\r\n\r\n                        if (response.ok) {\r\n  " +
+"                          const result = await response.json();\r\n               " +
+"             componentRow.find(\'input\').attr(\'disabled\', false).removeClass(\'upd" +
+"ating\');\r\n                            componentRow.attr(\'data-devicecomponentid\'" +
+", result.Id);\r\n                            componentRow.find(\'input.description\'" +
+").val(result.Description);\r\n                            componentRow.find(\'input" +
+".cost\').val(result.Cost);\r\n                        } else {\r\n                   " +
+"         alert(\'Unable to add component: \' + response.statusText);\r\n            " +
+"            }\r\n                    } catch (e) {\r\n                        alert(" +
+"\'Unable to add component: \' + e);\r\n                    }\r\n                }\r\n   " +
+"         }\r\n            async function editComponentJobTypes(input) {\r\n         " +
+"       const edit$this = $(input);\r\n                const componentRow = edit$th" +
+"is.closest(\'tr\');\r\n                const id = componentRow.attr(\'data-devicecomp" +
+"onentid\');\r\n\r\n                if (id) {\r\n                    try {\r\n            " +
+"            const body = new FormData();\r\n                        body.append(\'_" +
+"_RequestVerificationToken\', document.body.dataset.antiforgery);\r\n               " +
+"         body.append(\'id\', id);\r\n                        const getResponse = awa" +
+"it fetch($deviceComponents.attr(\'data-geturl\'), {\r\n                            m" +
+"ethod: \'POST\',\r\n                            body: body\r\n                        " +
+"})\r\n\r\n                        componentRow.find(\'input\').attr(\'disabled\', false)" +
+".removeClass(\'updating\');\r\n                        if (getResponse.ok) {\r\n      " +
+"                      const component = await getResponse.json();\r\n             " +
+"               $dialogUpdateJobTypes = $(\'#dialogUpdateJobTypes\');\r\n            " +
+"                $dialogUpdateJobTypes.find(\'input:checked\').each(function () { $" +
+"(this).prop(\'checked\', false) });\r\n                            for (var i = 0; i" +
+" < component.JobSubTypes.length; i++) {\r\n                                var sjt" +
+" = component.JobSubTypes[i];\r\n                                $dialogUpdateJobTy" +
+"pes.find(\'#SubTypes_\' + sjt).prop(\'checked\', true);\r\n                           " +
+" }\r\n                            $(\'#CheckboxBulkSelect_dialogUpdateJobTypes\').ch" +
+"eckboxBulkSelect(\'update\');\r\n                            const buttons = $dialog" +
+"UpdateJobTypes.dialog(\"option\", \"buttons\");\r\n                            buttons" +
+"[\'Save\'] = function () {\r\n                                async function saveAsy" +
+"nc() {\r\n                                    const body = new FormData();\r\n      " +
+"                              let jobSubTypeCount = 0;\r\n                        " +
+"            body.append(\'__RequestVerificationToken\', document.body.dataset.anti" +
+"forgery);\r\n                                    body.append(\'id\', id);\r\n         " +
+"                           $dialogUpdateJobTypes.find(\'input:checked\').each(func" +
+"tion () { body.append(\'jobSubTypes\', $(this).val()); jobSubTypeCount++; });\r\n\r\n " +
+"                                   try {\r\n                                      " +
+"  const updateResponse = await fetch($deviceComponents.attr(\'data-updatejobsubty" +
+"pesurl\'), {\r\n                                            method: \'POST\',\r\n      " +
+"                                      body: body\r\n                              " +
+"          })\r\n\r\n                                        if (updateResponse.ok) {" +
+"\r\n                                            if (jobSubTypeCount > 0) {\r\n      " +
+"                                          edit$this.find(\'.fa-asterisk\').removeC" +
+"lass(\'hidden\');\r\n                                            } else {\r\n         " +
+"                                       edit$this.find(\'.fa-asterisk\').addClass(\'" +
+"hidden\');\r\n                                            }\r\n                      " +
+"                      $dialogUpdateJobTypes.dialog(\"close\");\r\n                  " +
+"                      } else {\r\n                                            aler" +
+"t(\'Unable to update component sub types: \' + updateResponse.statusText);\r\n      " +
+"                                  }\r\n                                    } catch" +
+" (e) {\r\n                                        alert(\'Unable to update componen" +
+"t sub types: \' + e);\r\n                                    }\r\n                   " +
+"             }\r\n                                saveAsync();\r\n                  " +
+"          };\r\n                            $dialogUpdateJobTypes.dialog(\"option\"," +
+" \"buttons\", buttons);\r\n                            $dialogUpdateJobTypes.dialog(" +
+"\'open\');\r\n                        } else {\r\n                            alert(\'U" +
+"nable to load component: \' + getResponse.statusText);\r\n                        }" +
+"\r\n                    } catch (e) {\r\n                        alert(\'Unable to lo" +
+"ad component: \' + e);\r\n                    }\r\n                }\r\n            }\r\n" +
+"\r\n            $(\"#dialogConfirmRemove\").dialog({\r\n                resizable: fal" +
+"se,\r\n                height: 140,\r\n                modal: true,\r\n               " +
+" autoOpen: false,\r\n                buttons: {\r\n                    \"Remove\": fun" +
+"ction () {\r\n                        $(this).dialog(\"close\");\r\n                  " +
+"  },\r\n                    Cancel: function () {\r\n                        $(this)" +
+".dialog(\"close\");\r\n                    }\r\n                }\r\n            });\r\n\r\n" +
+"            $(\'#dialogUpdateJobTypes\').dialog({\r\n                resizable: fals" +
+"e,\r\n                modal: true,\r\n                autoOpen: false,\r\n            " +
+"    width: 550,\r\n                buttons: {\r\n                    \"Save\": functio" +
+"n () {\r\n                        $(this).dialog(\"close\");\r\n                    }," +
+"\r\n                    Cancel: function () {\r\n                        $(this).dia" +
+"log(\"close\");\r\n                    }\r\n                }\r\n            });\r\n\r\n    " +
+"        $(\'#CheckboxBulkSelect_dialogUpdateJobTypes\').checkboxBulkSelect({ paren" +
+"tSelector: \'div\' });\r\n        });\r\n    </script>\r\n");
 
 WriteLiteral("    <div");
 
@@ -470,18 +454,18 @@ WriteLiteral(" data-devicemodelid=\"");
             #line hidden
 WriteLiteral("\"");
 
-WriteLiteral(">\r\n        <tr>\r\n            <th>Description\r\n            </th>\r\n            <th>" +
-"Cost\r\n            </th>\r\n            <th>Job Types\r\n            </th>\r\n        <" +
-"/tr>\r\n");
+WriteLiteral(">\r\n        <tr>\r\n            <th>\r\n                Description\r\n            </th>" +
+"\r\n            <th>\r\n                Cost\r\n            </th>\r\n            <th>\r\n " +
+"               Job Types\r\n            </th>\r\n        </tr>\r\n");
 
             
-            #line 288 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 291 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
         
             
             #line default
             #line hidden
             
-            #line 288 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 291 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
          foreach (var item in Model.DeviceComponents)
         {
 
@@ -493,7 +477,7 @@ WriteLiteral("            <tr");
 WriteLiteral(" data-devicecomponentid=\"");
 
             
-            #line 290 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 293 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
                                    Write(item.Id);
 
             
@@ -506,7 +490,7 @@ WriteLiteral(">\r\n                <td>\r\n");
 WriteLiteral("                    ");
 
             
-            #line 292 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 295 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
                Write(item.Description);
 
             
@@ -517,7 +501,7 @@ WriteLiteral("\r\n                </td>\r\n                <td>\r\n");
 WriteLiteral("                    ");
 
             
-            #line 295 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 298 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
                Write(item.Cost.ToString("C"));
 
             
@@ -526,13 +510,13 @@ WriteLiteral("                    ");
 WriteLiteral("\r\n                </td>\r\n                <td>\r\n");
 
             
-            #line 298 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 301 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
                     
             
             #line default
             #line hidden
             
-            #line 298 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 301 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
                      if (item.JobSubTypes.Count > 0)
                     {
 
@@ -542,13 +526,13 @@ WriteLiteral("\r\n                </td>\r\n                <td>\r\n");
 WriteLiteral("                        <ul>\r\n");
 
             
-            #line 301 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 304 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
                             
             
             #line default
             #line hidden
             
-            #line 301 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 304 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
                              foreach (var jst in item.JobSubTypes)
                             {
 
@@ -558,7 +542,7 @@ WriteLiteral("                        <ul>\r\n");
 WriteLiteral("                                <li>");
 
             
-            #line 303 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 306 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
                                Write(jst.Description);
 
             
@@ -567,7 +551,7 @@ WriteLiteral("                                <li>");
 WriteLiteral("</li>\r\n");
 
             
-            #line 304 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 307 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
                             }
 
             
@@ -576,7 +560,7 @@ WriteLiteral("</li>\r\n");
 WriteLiteral("                        </ul>\r\n");
 
             
-            #line 306 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 309 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
                     }
                     else
                     {
@@ -591,7 +575,7 @@ WriteLiteral(" class=\"smallMessage\"");
 WriteLiteral(">&lt;None Specified&gt;</span>\r\n");
 
             
-            #line 310 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 313 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
                     }
 
             
@@ -600,7 +584,7 @@ WriteLiteral(">&lt;None Specified&gt;</span>\r\n");
 WriteLiteral("                </td>\r\n            </tr>\r\n");
 
             
-            #line 313 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 316 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
         }
 
             
@@ -609,7 +593,7 @@ WriteLiteral("                </td>\r\n            </tr>\r\n");
 WriteLiteral("    </table>\r\n");
 
             
-            #line 315 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 318 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
 }
             
             #line default

Disco.Web/Areas/Config/Views/DeviceProfile/Create.cshtml

@@ -1,11 +1,12 @@
 @model Disco.Web.Areas.Config.Models.DeviceProfile.CreateModel
 @{
     Authorization.RequireAll(Claims.Config.DeviceProfile.Create, Claims.Config.DeviceProfile.Configure);
-    
+
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Device Profiles", MVC.Config.DeviceProfile.Index(null), "Create");
 }
 @using (Html.BeginForm())
-{ 
+{
+    @Html.AntiForgeryToken()
     @Html.ValidationSummary(false)
     <div class="form" style="width: 450px">
         <table>
@@ -14,28 +15,26 @@
                     Name:
                 </th>
                 <td>
-                @Html.TextBoxFor(model => model.DeviceProfile.Name)<br />@Html.ValidationMessageFor(model => model.DeviceProfile.Name)
+                    @Html.TextBoxFor(model => model.Name)<br />@Html.ValidationMessageFor(model => model.Name)
                 </td>
             </tr>
             <tr>
                 <th>
                     Short Name:
                 </th>
-                <td>@Html.TextBoxFor(model => model.DeviceProfile.ShortName)<br />@Html.ValidationMessageFor(model => model.DeviceProfile.ShortName)
+                <td>
+                    @Html.TextBoxFor(model => model.ShortName)<br />@Html.ValidationMessageFor(model => model.ShortName)
                 </td>
             </tr>
             <tr>
                 <th>
                     Description:
                 </th>
-                <td>@Html.TextBoxFor(model => model.DeviceProfile.Description)<br />@Html.ValidationMessageFor(model => model.DeviceProfile.Description)
+                <td>
+                    @Html.TextBoxFor(model => model.Description)<br />@Html.ValidationMessageFor(model => model.Description)
                 </td>
             </tr>
         </table>
-        @Html.HiddenFor(model => model.DeviceProfile.ComputerNameTemplate)
-        @Html.HiddenFor(model => model.DeviceProfile.ProvisionADAccount)
-        @Html.HiddenFor(model => model.DeviceProfile.DistributionType)
-        @Html.HiddenFor(model => model.DeviceProfile.OrganisationalUnit)
         <p class="actions">
             <input type="submit" class="button" value="Create" />
         </p>

Disco.Web/Areas/Config/Views/DeviceProfile/Create.generated.cs

@@ -47,7 +47,7 @@ namespace Disco.Web.Areas.Config.Views.DeviceProfile
             #line 2 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
   
     Authorization.RequireAll(Claims.Config.DeviceProfile.Create, Claims.Config.DeviceProfile.Configure);
-    
+
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Device Profiles", MVC.Config.DeviceProfile.Index(null), "Create");
 
             
@@ -58,20 +58,34 @@ WriteLiteral("\r\n");
             
             #line 7 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
  using (Html.BeginForm())
-{ 
+{
     
             
             #line default
             #line hidden
             
             #line 9 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
-Write(Html.ValidationSummary(false));
+Write(Html.AntiForgeryToken());
 
             
             #line default
             #line hidden
             
             #line 9 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
+                            
+    
+            
+            #line default
+            #line hidden
+            
+            #line 10 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
+Write(Html.ValidationSummary(false));
+
+            
+            #line default
+            #line hidden
+            
+            #line 10 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
                                   
 
             
@@ -86,11 +100,11 @@ WriteLiteral(" style=\"width: 450px\"");
 WriteLiteral(">\r\n        <table>\r\n            <tr>\r\n                <th>\r\n                    N" +
 "ame:\r\n                </th>\r\n                <td>\r\n");
 
-WriteLiteral("                ");
+WriteLiteral("                    ");
 
             
-            #line 17 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
-           Write(Html.TextBoxFor(model => model.DeviceProfile.Name));
+            #line 18 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
+               Write(Html.TextBoxFor(model => model.Name));
 
             
             #line default
@@ -98,18 +112,21 @@ WriteLiteral("                ");
 WriteLiteral("<br />");
 
             
-            #line 17 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
-                                                                    Write(Html.ValidationMessageFor(model => model.DeviceProfile.Name));
+            #line 18 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
+                                                          Write(Html.ValidationMessageFor(model => model.Name));
 
             
             #line default
             #line hidden
 WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>\r\n                <th" +
-">\r\n                    Short Name:\r\n                </th>\r\n                <td>");
+">\r\n                    Short Name:\r\n                </th>\r\n                <td>\r" +
+"\n");
+
+WriteLiteral("                    ");
 
             
-            #line 24 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
-               Write(Html.TextBoxFor(model => model.DeviceProfile.ShortName));
+            #line 26 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
+               Write(Html.TextBoxFor(model => model.ShortName));
 
             
             #line default
@@ -117,19 +134,21 @@ WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>
 WriteLiteral("<br />");
 
             
-            #line 24 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
-                                                                             Write(Html.ValidationMessageFor(model => model.DeviceProfile.ShortName));
+            #line 26 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
+                                                               Write(Html.ValidationMessageFor(model => model.ShortName));
 
             
             #line default
             #line hidden
 WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>\r\n                <th" +
 ">\r\n                    Description:\r\n                </th>\r\n                <td>" +
-"");
+"\r\n");
+
+WriteLiteral("                    ");
 
             
-            #line 31 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
-               Write(Html.TextBoxFor(model => model.DeviceProfile.Description));
+            #line 34 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
+               Write(Html.TextBoxFor(model => model.Description));
 
             
             #line default
@@ -137,57 +156,13 @@ WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>
 WriteLiteral("<br />");
 
             
-            #line 31 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
-                                                                               Write(Html.ValidationMessageFor(model => model.DeviceProfile.Description));
+            #line 34 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
+                                                                 Write(Html.ValidationMessageFor(model => model.Description));
 
             
             #line default
             #line hidden
-WriteLiteral("\r\n                </td>\r\n            </tr>\r\n        </table>\r\n");
-
-WriteLiteral("        ");
-
-            
-            #line 35 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
-   Write(Html.HiddenFor(model => model.DeviceProfile.ComputerNameTemplate));
-
-            
-            #line default
-            #line hidden
-WriteLiteral("\r\n");
-
-WriteLiteral("        ");
-
-            
-            #line 36 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
-   Write(Html.HiddenFor(model => model.DeviceProfile.ProvisionADAccount));
-
-            
-            #line default
-            #line hidden
-WriteLiteral("\r\n");
-
-WriteLiteral("        ");
-
-            
-            #line 37 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
-   Write(Html.HiddenFor(model => model.DeviceProfile.DistributionType));
-
-            
-            #line default
-            #line hidden
-WriteLiteral("\r\n");
-
-WriteLiteral("        ");
-
-            
-            #line 38 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
-   Write(Html.HiddenFor(model => model.DeviceProfile.OrganisationalUnit));
-
-            
-            #line default
-            #line hidden
-WriteLiteral("\r\n        <p");
+WriteLiteral("\r\n                </td>\r\n            </tr>\r\n        </table>\r\n        <p");
 
 WriteLiteral(" class=\"actions\"");
 
@@ -209,7 +184,7 @@ WriteLiteral(">\r\n        $(function () {\r\n            $(\'#Name\').focus().s
 "\r\n    </script>\r\n");
 
             
-            #line 48 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
+            #line 47 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
 }
 
             

Disco.Web/Areas/Config/Views/DeviceProfile/Defaults.cshtml

@@ -1,8 +1,10 @@
 @model Disco.Web.Areas.Config.Models.DeviceProfile.DefaultsModel
 @{
     Authorization.Require(Claims.Config.DeviceProfile.ConfigureDefaults);
-    
+
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Device Profiles", MVC.Config.DeviceProfile.Index(null), "Defaults");
+
+    Html.BundleDeferred("~/ClientScripts/Modules/Disco-PropertyChangeHelpers");
 }
 <div class="form" style="width: 600px">
     <table>
@@ -15,19 +17,12 @@
                 @AjaxHelpers.AjaxLoader()
                 <script type="text/javascript">
                     $(function () {
-                        $('#Default').change(function () {
-                            $this = $(this);
-                            $ajaxLoading = $this.next('.ajaxLoading').show();
-                            var data = { id: $this.val() };
-                            $.getJSON('@(Url.Action(MVC.API.DeviceProfile.Default()))', data, function (response, result) {
-                                if (result != 'success' || response != 'OK') {
-                                    alert('Unable to change Default Device Profile:\n' + response);
-                                    $ajaxLoading.hide();
-                                } else {
-                                    $ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
-                                }
-                            });
-                        });
+                        document.DiscoFunctions.PropertyChangeHelper(
+                            $('#Default'),
+                            'Default Profile',
+                            '@Url.Action(MVC.API.DeviceProfile.Default())',
+                            'id'
+                        );
                     });
                 </script>
             </td>
@@ -41,19 +36,12 @@
                 @AjaxHelpers.AjaxLoader()
                 <script type="text/javascript">
                     $(function () {
-                        $('#DefaultAddDeviceOffline').change(function () {
-                            $this = $(this);
-                            $ajaxLoading = $this.next('.ajaxLoading').show();
-                            var data = { id: $this.val() };
-                            $.getJSON('@(Url.Action(MVC.API.DeviceProfile.DefaultAddDeviceOffline()))', data, function (response, result) {
-                                if (result != 'success' || response != 'OK') {
-                                    alert('Unable to change Default Add Device Offline Device Profile:\n' + response);
-                                    $ajaxLoading.hide();
-                                } else {
-                                    $ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
-                                }
-                            });
-                        });
+                        document.DiscoFunctions.PropertyChangeHelper(
+                            $('#DefaultAddDeviceOffline'),
+                            'Default Add Device Offline Profile',
+                            '@Url.Action(MVC.API.DeviceProfile.DefaultAddDeviceOffline())',
+                            'id'
+                        );
                     });
                 </script>
             </td>

Disco.Web/Areas/Config/Views/DeviceProfile/Defaults.generated.cs

@@ -47,9 +47,11 @@ namespace Disco.Web.Areas.Config.Views.DeviceProfile
             #line 2 "..\..\Areas\Config\Views\DeviceProfile\Defaults.cshtml"
   
     Authorization.Require(Claims.Config.DeviceProfile.ConfigureDefaults);
-    
+
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Device Profiles", MVC.Config.DeviceProfile.Index(null), "Defaults");
 
+    Html.BundleDeferred("~/ClientScripts/Modules/Disco-PropertyChangeHelpers");
+
             
             #line default
             #line hidden
@@ -74,7 +76,7 @@ WriteLiteral(">\r\n");
 WriteLiteral("                ");
 
             
-            #line 14 "..\..\Areas\Config\Views\DeviceProfile\Defaults.cshtml"
+            #line 16 "..\..\Areas\Config\Views\DeviceProfile\Defaults.cshtml"
            Write(Html.DropDownListFor(m => m.Default, Model.DeviceProfiles.ToSelectListItems(Model.Default)));
 
             
@@ -85,7 +87,7 @@ WriteLiteral("\r\n");
 WriteLiteral("                ");
 
             
-            #line 15 "..\..\Areas\Config\Views\DeviceProfile\Defaults.cshtml"
+            #line 17 "..\..\Areas\Config\Views\DeviceProfile\Defaults.cshtml"
            Write(AjaxHelpers.AjaxLoader());
 
             
@@ -95,36 +97,20 @@ WriteLiteral("\r\n                <script");
 
 WriteLiteral(" type=\"text/javascript\"");
 
-WriteLiteral(@">
-                    $(function () {
-                        $('#Default').change(function () {
-                            $this = $(this);
-                            $ajaxLoading = $this.next('.ajaxLoading').show();
-                            var data = { id: $this.val() };
-                            $.getJSON('");
+WriteLiteral(">\r\n                    $(function () {\r\n                        document.DiscoFun" +
+"ctions.PropertyChangeHelper(\r\n                            $(\'#Default\'),\r\n      " +
+"                      \'Default Profile\',\r\n                            \'");
 
             
-            #line 22 "..\..\Areas\Config\Views\DeviceProfile\Defaults.cshtml"
-                                   Write(Url.Action(MVC.API.DeviceProfile.Default()));
+            #line 23 "..\..\Areas\Config\Views\DeviceProfile\Defaults.cshtml"
+                        Write(Url.Action(MVC.API.DeviceProfile.Default()));
 
             
             #line default
             #line hidden
-WriteLiteral(@"', data, function (response, result) {
-                                if (result != 'success' || response != 'OK') {
-                                    alert('Unable to change Default Device Profile:\n' + response);
-                                    $ajaxLoading.hide();
-                                } else {
-                                    $ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
-                                }
-                            });
-                        });
-                    });
-                </script>
-            </td>
-        </tr>
-        <tr>
-            <th");
+WriteLiteral("\',\r\n                            \'id\'\r\n                        );\r\n               " +
+"     });\r\n                </script>\r\n            </td>\r\n        </tr>\r\n        <" +
+"tr>\r\n            <th");
 
 WriteLiteral(" class=\"name\"");
 
@@ -138,7 +124,7 @@ WriteLiteral(">\r\n");
 WriteLiteral("                ");
 
             
-            #line 40 "..\..\Areas\Config\Views\DeviceProfile\Defaults.cshtml"
+            #line 35 "..\..\Areas\Config\Views\DeviceProfile\Defaults.cshtml"
            Write(Html.DropDownListFor(m => m.DefaultAddDeviceOffline, Model.DeviceProfilesAndNone.ToSelectListItems(Model.DefaultAddDeviceOffline)));
 
             
@@ -149,7 +135,7 @@ WriteLiteral("\r\n");
 WriteLiteral("                ");
 
             
-            #line 41 "..\..\Areas\Config\Views\DeviceProfile\Defaults.cshtml"
+            #line 36 "..\..\Areas\Config\Views\DeviceProfile\Defaults.cshtml"
            Write(AjaxHelpers.AjaxLoader());
 
             
@@ -161,35 +147,21 @@ WriteLiteral(" type=\"text/javascript\"");
 
 WriteLiteral(@">
                     $(function () {
-                        $('#DefaultAddDeviceOffline').change(function () {
-                            $this = $(this);
-                            $ajaxLoading = $this.next('.ajaxLoading').show();
-                            var data = { id: $this.val() };
-                            $.getJSON('");
+                        document.DiscoFunctions.PropertyChangeHelper(
+                            $('#DefaultAddDeviceOffline'),
+                            'Default Add Device Offline Profile',
+                            '");
 
             
-            #line 48 "..\..\Areas\Config\Views\DeviceProfile\Defaults.cshtml"
-                                   Write(Url.Action(MVC.API.DeviceProfile.DefaultAddDeviceOffline()));
+            #line 42 "..\..\Areas\Config\Views\DeviceProfile\Defaults.cshtml"
+                        Write(Url.Action(MVC.API.DeviceProfile.DefaultAddDeviceOffline()));
 
             
             #line default
             #line hidden
-WriteLiteral(@"', data, function (response, result) {
-                                if (result != 'success' || response != 'OK') {
-                                    alert('Unable to change Default Add Device Offline Device Profile:\n' + response);
-                                    $ajaxLoading.hide();
-                                } else {
-                                    $ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
-                                }
-                            });
-                        });
-                    });
-                </script>
-            </td>
-        </tr>
-    </table>
-</div>
-");
+WriteLiteral("\',\r\n                            \'id\'\r\n                        );\r\n               " +
+"     });\r\n                </script>\r\n            </td>\r\n        </tr>\r\n    </tab" +
+"le>\r\n</div>\r\n");
 
         }
     }

Disco.Web/Areas/Config/Views/DeviceProfile/Show.cshtml

@@ -568,7 +568,7 @@
                         </div>
                         <div id="treeOrganisationalUnit" class="organisationalUnitTree">
                         </div>
-                        @using (Html.BeginForm(MVC.API.DeviceProfile.UpdateOrganisationalUnit(Model.DeviceProfile.Id, redirect: true), FormMethod.Post))
+                        @using (Html.BeginForm(MVC.API.DeviceProfile.UpdateOrganisationalUnit(Model.DeviceProfile.Id, redirect: true)))
                         {
                             @Html.AntiForgeryToken();
                             <input type="hidden" name="OrganisationalUnit" />
@@ -754,23 +754,30 @@
                 {
                     <script type="text/javascript">
                         $(function () {
-                            var $container = $('#DeviceProfile_CertificateProviders');
+                            const $container = $('#DeviceProfile_CertificateProviders');
 
                             $container.on('change', 'input', function () {
-                                var $ajaxLoading = $('#DeviceProfile_CertificateProviders_loading').show();
+                                const $ajaxLoading = $('#DeviceProfile_CertificateProviders_loading').show();
 
-                                var data = {
-                                    CertificateProviders: $('input:checked', $container).map(function () { return $(this).val() }).get().join(',')
-                                };
-                                $.getJSON('@(Url.Action(MVC.API.DeviceProfile.UpdateCertificateProviders(Model.DeviceProfile.Id)))', data, function (response, result) {
-                                    if (result != 'success' || response != 'OK') {
-                                        alert('Unable to change property "CertificateProviders":\n' + response);
-                                        $ajaxLoading.hide();
-                                    } else {
+                                const body = new FormData();
+                                body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                                body.append('certificateProviders', $container.find('input:checked',).map(function () { return $(this).val() }).get().join(','));
+
+                                fetch('@(Url.Action(MVC.API.DeviceProfile.UpdateCertificateProviders(Model.DeviceProfile.Id)))', {
+                                    method: 'POST',
+                                    body: body
+                                }).then(r => {
+                                    if (r.ok) {
                                         $ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
+                                    } else {
+                                        alert('Unable to change property "CertificateProviders":\n' + r.statusText);
+                                        $ajaxLoading.hide();
                                     }
-                                })
-                            })
+                                }).catch(e => {
+                                    alert('Unable to change property "CertificateProviders":\n' + e);
+                                    $ajaxLoading.hide();
+                                });
+                            });
                         });
                     </script>
                 }
@@ -783,18 +790,25 @@
                             $container.on('change', 'input', function () {
                                 var $ajaxLoading = $('#DeviceProfile_CertificateProviders_loading').show();
 
-                                var data = {
-                                    CertificateAuthorityProviders: $('input:checked', $container).map(function () { return $(this).val() }).get().join(',')
-                                };
-                                $.getJSON('@(Url.Action(MVC.API.DeviceProfile.UpdateCertificateAuthorityProviders(Model.DeviceProfile.Id)))', data, function (response, result) {
-                                    if (result != 'success' || response != 'OK') {
-                                        alert('Unable to change property "CertificateAuthorityProviders":\n' + response);
-                                        $ajaxLoading.hide();
-                                    } else {
+                                const body = new FormData();
+                                body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                                body.append('certificateAuthorityProviders', $container.find('input:checked',).map(function () { return $(this).val() }).get().join(','));
+
+                                fetch('@(Url.Action(MVC.API.DeviceProfile.UpdateCertificateAuthorityProviders(Model.DeviceProfile.Id)))', {
+                                    method: 'POST',
+                                    body: body
+                                }).then(r => {
+                                    if (r.ok) {
                                         $ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
+                                    } else {
+                                        alert('Unable to change property "CertificateAuthorityProviders":\n' + r.statusText);
+                                        $ajaxLoading.hide();
                                     }
-                                })
-                            })
+                                }).catch(e => {
+                                    alert('Unable to change property "CertificateAuthorityProviders":\n' + e);
+                                    $ajaxLoading.hide();
+                                });
+                            });
                         });
                     </script>
                 }
@@ -870,18 +884,25 @@
                             $container.on('change', 'input', function () {
                                 var $ajaxLoading = $('#DeviceProfile_WirelessProfileProviders_loading').show();
 
-                                var data = {
-                                    WirelessProfileProviders: $('input:checked', $container).map(function () { return $(this).val() }).get().join(',')
-                                };
-                                $.getJSON('@(Url.Action(MVC.API.DeviceProfile.UpdateWirelessProfileProviders(Model.DeviceProfile.Id)))', data, function (response, result) {
-                                    if (result != 'success' || response != 'OK') {
-                                        alert('Unable to change property "WirelessProfileProviders":\n' + response);
-                                        $ajaxLoading.hide();
-                                    } else {
+                                const body = new FormData();
+                                body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                                body.append('wirelessProfileProviders', $container.find('input:checked',).map(function () { return $(this).val() }).get().join(','));
+
+                                fetch('@(Url.Action(MVC.API.DeviceProfile.UpdateWirelessProfileProviders(Model.DeviceProfile.Id)))', {
+                                    method: 'POST',
+                                    body: body
+                                }).then(r => {
+                                    if (r.ok) {
                                         $ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
+                                    } else {
+                                        alert('Unable to change property "WirelessProfileProviders":\n' + r.statusText);
+                                        $ajaxLoading.hide();
                                     }
-                                })
-                            })
+                                }).catch(e => {
+                                    alert('Unable to change property "WirelessProfileProviders":\n' + e);
+                                    $ajaxLoading.hide();
+                                });
+                            });
                         });
                     </script>
                 }
@@ -967,50 +988,13 @@
         </tr>
     </table>
 </div>
-@if (canDelete)
-{
-    <div id="dialogConfirmDelete" title="Delete this Device Profile?">
-        <p>
-            <i class="fa fa-exclamation-triangle fa-lg warning"></i>
-            This item will be permanently deleted and cannot be recovered. Are you sure?
-        </p>
-    </div>
-    <script type="text/javascript">
-        $(function () {
-
-            var button = $('#buttonDelete');
-            var buttonLink = button.attr('href');
-            button.attr('href', '#');
-            button.click(function () {
-                $("#dialogConfirmDelete").dialog('open');
-            });
-
-            $("#dialogConfirmDelete").dialog({
-                resizable: false,
-                height: 140,
-                modal: true,
-                autoOpen: false,
-                buttons: {
-                    "Delete": function () {
-                        $(this).dialog('disable');
-                        window.location.href = buttonLink;
-                    },
-                    Cancel: function () {
-                        $(this).dialog("close");
-                    }
-                }
-            });
-
-        });
-    </script>
-}
 @Html.Partial(MVC.Config.Shared.Views._DeviceGroupDocumentBulkGenerate, Model)
 <div class="actionBar">
     @if (Model.CanDecommission)
     {
         <button id="DeviceProfile_Decommission" class="button">Decommission All Devices</button>
         <div id="DeviceProfile_Decommission_Dialog" class="dialog" title="Profile Device Decommission">
-            @using (Html.BeginForm(MVC.API.Device.DeviceProfileDecommission(Model.DeviceProfile.Id), FormMethod.Post))
+            @using (Html.BeginForm(MVC.API.Device.DeviceProfileDecommission(Model.DeviceProfile.Id)))
             {
                 @Html.AntiForgeryToken()
                 <div class="clearfix" style="margin-bottom: 10px;">
@@ -1067,7 +1051,44 @@
     }
     @if (canDelete)
     {
-        @Html.ActionLinkButton("Delete", MVC.API.DeviceProfile.Delete(Model.DeviceProfile.Id, true), "buttonDelete")
+        <button id="buttonDelete" type="button" class="button">Delete</button>
+        <div id="dialogConfirmDelete" class="dialog" title="Delete this Device Profile?">
+            @using (Html.BeginForm(MVC.API.DeviceProfile.Delete(Model.DeviceProfile.Id, true)))
+            {
+                @Html.AntiForgeryToken()
+            }
+            <p>
+                <i class="fa fa-exclamation-triangle fa-lg warning"></i>
+                This item will be permanently deleted and cannot be recovered. Are you sure?
+            </p>
+        </div>
+        <script type="text/javascript">
+            $(function () {
+                let dialog = null;
+                $('#buttonDelete').on('click', function () {
+                    if (!dialog) {
+                        dialog = $("#dialogConfirmDelete").dialog({
+                            resizable: false,
+                            width: 300,
+                            modal: true,
+                            autoOpen: false,
+                            buttons: {
+                                "Delete": function () {
+                                    $(this)
+                                        .dialog("option", "buttons", null)
+                                        .find('form').trigger('submit');
+                                },
+                                Cancel: function () {
+                                    $(this).dialog("close");
+                                }
+                            }
+                        });
+                    }
+
+                    dialog.dialog('open');
+                });
+            });
+        </script>
     }
     @if (Authorization.Has(Claims.Device.Actions.Export))
     {

Disco.Web/Areas/Config/Views/DeviceProfile/Show.generated.cs

@@ -1825,7 +1825,7 @@ WriteLiteral(">\r\n                        </div>\r\n");
             #line hidden
             
             #line 571 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
-                         using (Html.BeginForm(MVC.API.DeviceProfile.UpdateOrganisationalUnit(Model.DeviceProfile.Id, redirect: true), FormMethod.Post))
+                         using (Html.BeginForm(MVC.API.DeviceProfile.UpdateOrganisationalUnit(Model.DeviceProfile.Id, redirect: true)))
                         {
                             
             
@@ -2230,38 +2230,45 @@ WriteLiteral(" type=\"text/javascript\"");
 
 WriteLiteral(@">
                         $(function () {
-                            var $container = $('#DeviceProfile_CertificateProviders');
+                            const $container = $('#DeviceProfile_CertificateProviders');
 
                             $container.on('change', 'input', function () {
-                                var $ajaxLoading = $('#DeviceProfile_CertificateProviders_loading').show();
+                                const $ajaxLoading = $('#DeviceProfile_CertificateProviders_loading').show();
 
-                                var data = {
-                                    CertificateProviders: $('input:checked', $container).map(function () { return $(this).val() }).get().join(',')
-                                };
-                                $.getJSON('");
+                                const body = new FormData();
+                                body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                                body.append('certificateProviders', $container.find('input:checked',).map(function () { return $(this).val() }).get().join(','));
+
+                                fetch('");
 
             
-            #line 765 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
-                                       Write(Url.Action(MVC.API.DeviceProfile.UpdateCertificateProviders(Model.DeviceProfile.Id)));
+            #line 766 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+                                   Write(Url.Action(MVC.API.DeviceProfile.UpdateCertificateProviders(Model.DeviceProfile.Id)));
 
             
             #line default
             #line hidden
-WriteLiteral(@"', data, function (response, result) {
-                                    if (result != 'success' || response != 'OK') {
-                                        alert('Unable to change property ""CertificateProviders"":\n' + response);
-                                        $ajaxLoading.hide();
-                                    } else {
+WriteLiteral(@"', {
+                                    method: 'POST',
+                                    body: body
+                                }).then(r => {
+                                    if (r.ok) {
                                         $ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
+                                    } else {
+                                        alert('Unable to change property ""CertificateProviders"":\n' + r.statusText);
+                                        $ajaxLoading.hide();
                                     }
-                                })
-                            })
+                                }).catch(e => {
+                                    alert('Unable to change property ""CertificateProviders"":\n' + e);
+                                    $ajaxLoading.hide();
+                                });
+                            });
                         });
                     </script>
 ");
 
             
-            #line 776 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 783 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                 }
 
             
@@ -2270,7 +2277,7 @@ WriteLiteral(@"', data, function (response, result) {
 WriteLiteral("                ");
 
             
-            #line 777 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 784 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                  if (canConfig && Model.CertificateProviders.Count > 0)
                 {
 
@@ -2288,33 +2295,40 @@ WriteLiteral(@">
                             $container.on('change', 'input', function () {
                                 var $ajaxLoading = $('#DeviceProfile_CertificateProviders_loading').show();
 
-                                var data = {
-                                    CertificateAuthorityProviders: $('input:checked', $container).map(function () { return $(this).val() }).get().join(',')
-                                };
-                                $.getJSON('");
+                                const body = new FormData();
+                                body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                                body.append('certificateAuthorityProviders', $container.find('input:checked',).map(function () { return $(this).val() }).get().join(','));
+
+                                fetch('");
 
             
-            #line 789 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
-                                       Write(Url.Action(MVC.API.DeviceProfile.UpdateCertificateAuthorityProviders(Model.DeviceProfile.Id)));
+            #line 797 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+                                   Write(Url.Action(MVC.API.DeviceProfile.UpdateCertificateAuthorityProviders(Model.DeviceProfile.Id)));
 
             
             #line default
             #line hidden
-WriteLiteral(@"', data, function (response, result) {
-                                    if (result != 'success' || response != 'OK') {
-                                        alert('Unable to change property ""CertificateAuthorityProviders"":\n' + response);
-                                        $ajaxLoading.hide();
-                                    } else {
+WriteLiteral(@"', {
+                                    method: 'POST',
+                                    body: body
+                                }).then(r => {
+                                    if (r.ok) {
                                         $ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
+                                    } else {
+                                        alert('Unable to change property ""CertificateAuthorityProviders"":\n' + r.statusText);
+                                        $ajaxLoading.hide();
                                     }
-                                })
-                            })
+                                }).catch(e => {
+                                    alert('Unable to change property ""CertificateAuthorityProviders"":\n' + e);
+                                    $ajaxLoading.hide();
+                                });
+                            });
                         });
                     </script>
 ");
 
             
-            #line 800 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 814 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                 }
 
             
@@ -2324,13 +2338,13 @@ WriteLiteral("            </th>\r\n            <td>\r\n                <h4>Devic
 "tes</h4>\r\n");
 
             
-            #line 804 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 818 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                 
             
             #line default
             #line hidden
             
-            #line 804 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 818 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                  if (canConfig && Model.CertificateProviders.Count > 0)
                 {
                     
@@ -2338,14 +2352,14 @@ WriteLiteral("            </th>\r\n            <td>\r\n                <h4>Devic
             #line default
             #line hidden
             
-            #line 806 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 820 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                Write(CommonHelpers.CheckBoxList("DeviceProfile_CertificateProviders", "DeviceProfile_CertificateProviders", Model.CertificateProviders.ToSelectListItems(Model.DeviceProfile.GetCertificateProviders())));
 
             
             #line default
             #line hidden
             
-            #line 806 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 820 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                                                                                                                                                                                                                         
                 }
                 else
@@ -2365,7 +2379,7 @@ WriteLiteral(" class=\"smallMessage\"");
 WriteLiteral(">&lt;None Allocated&gt;</span>\r\n");
 
             
-            #line 815 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 829 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                     }
                     else
                     {
@@ -2376,13 +2390,13 @@ WriteLiteral(">&lt;None Allocated&gt;</span>\r\n");
 WriteLiteral("                        <ul>\r\n");
 
             
-            #line 819 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 833 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                             
             
             #line default
             #line hidden
             
-            #line 819 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 833 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                              foreach (var certificateProvider in certificateProviders)
                             {
 
@@ -2392,7 +2406,7 @@ WriteLiteral("                        <ul>\r\n");
 WriteLiteral("                                <li>");
 
             
-            #line 821 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 835 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                                Write(certificateProvider.Name);
 
             
@@ -2401,7 +2415,7 @@ WriteLiteral("                                <li>");
 WriteLiteral("</li>\r\n");
 
             
-            #line 822 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 836 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                             }
 
             
@@ -2410,7 +2424,7 @@ WriteLiteral("</li>\r\n");
 WriteLiteral("                        </ul>\r\n");
 
             
-            #line 824 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 838 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                     }
                 }
 
@@ -2424,13 +2438,13 @@ WriteLiteral(" style=\"margin-top: 4px;\"");
 WriteLiteral(">Authority Certificates</h4>\r\n");
 
             
-            #line 827 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 841 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                 
             
             #line default
             #line hidden
             
-            #line 827 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 841 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                  if (canConfig && Model.CertificateAuthorityProviders.Count > 0)
                 {
                     
@@ -2438,14 +2452,14 @@ WriteLiteral(">Authority Certificates</h4>\r\n");
             #line default
             #line hidden
             
-            #line 829 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 843 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                Write(CommonHelpers.CheckBoxList("DeviceProfile_CertificateAuthorityProviders", "DeviceProfile_CertificateAuthorityProviders", Model.CertificateAuthorityProviders.ToSelectListItems(Model.DeviceProfile.GetCertificateAuthorityProviders())));
 
             
             #line default
             #line hidden
             
-            #line 829 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 843 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                                                                                                                                                                                                                                                             
                 }
                 else
@@ -2465,7 +2479,7 @@ WriteLiteral(" class=\"smallMessage\"");
 WriteLiteral(">&lt;None Allocated&gt;</span>\r\n");
 
             
-            #line 838 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 852 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                     }
                     else
                     {
@@ -2476,13 +2490,13 @@ WriteLiteral(">&lt;None Allocated&gt;</span>\r\n");
 WriteLiteral("                        <ul>\r\n");
 
             
-            #line 842 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 856 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                             
             
             #line default
             #line hidden
             
-            #line 842 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 856 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                              foreach (var certificateProvider in certificateProviders)
                             {
 
@@ -2492,7 +2506,7 @@ WriteLiteral("                        <ul>\r\n");
 WriteLiteral("                                <li>");
 
             
-            #line 844 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 858 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                                Write(certificateProvider.Name);
 
             
@@ -2501,7 +2515,7 @@ WriteLiteral("                                <li>");
 WriteLiteral("</li>\r\n");
 
             
-            #line 845 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 859 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                             }
 
             
@@ -2510,7 +2524,7 @@ WriteLiteral("</li>\r\n");
 WriteLiteral("                        </ul>\r\n");
 
             
-            #line 847 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 861 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                     }
                 }
 
@@ -2520,7 +2534,7 @@ WriteLiteral("                        </ul>\r\n");
 WriteLiteral("                ");
 
             
-            #line 849 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 863 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                  if (canViewPlugins)
                 {
 
@@ -2541,21 +2555,21 @@ WriteLiteral(" class=\"fa fa-info-circle\"");
 
 WriteLiteral("></i>View the <a");
 
-WriteAttribute("href", Tuple.Create(" href=\"", 48824), Tuple.Create("\"", 48874)
+WriteAttribute("href", Tuple.Create(" href=\"", 49620), Tuple.Create("\"", 49670)
             
-            #line 853 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
-, Tuple.Create(Tuple.Create("", 48831), Tuple.Create<System.Object, System.Int32>(Url.Action(MVC.Config.Plugins.Install())
+            #line 867 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+, Tuple.Create(Tuple.Create("", 49627), Tuple.Create<System.Object, System.Int32>(Url.Action(MVC.Config.Plugins.Install())
             
             #line default
             #line hidden
-, 48831), false)
+, 49627), false)
 );
 
 WriteLiteral(">Plugin Catalogue</a> to discover and install certificate provider plugins.\r\n    " +
 "                    </p>\r\n                    </div>\r\n");
 
             
-            #line 856 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 870 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                 }
 
             
@@ -2565,13 +2579,13 @@ WriteLiteral("            </td>\r\n        </tr>\r\n        <tr>\r\n
 " Provision Wireless Profiles:\r\n");
 
             
-            #line 862 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 876 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                 
             
             #line default
             #line hidden
             
-            #line 862 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 876 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                  if (canConfig && Model.WirelessProfileProviders.Count > 0)
                 {
 
@@ -2581,20 +2595,20 @@ WriteLiteral("            </td>\r\n        </tr>\r\n        <tr>\r\n
 WriteLiteral("                    <br />\r\n");
 
             
-            #line 865 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 879 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                     
             
             #line default
             #line hidden
             
-            #line 865 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 879 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                Write(AjaxHelpers.AjaxLoader("DeviceProfile_WirelessProfileProviders"));
 
             
             #line default
             #line hidden
             
-            #line 865 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 879 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                                                                                      
 
             
@@ -2611,33 +2625,40 @@ WriteLiteral(@">
                             $container.on('change', 'input', function () {
                                 var $ajaxLoading = $('#DeviceProfile_WirelessProfileProviders_loading').show();
 
-                                var data = {
-                                    WirelessProfileProviders: $('input:checked', $container).map(function () { return $(this).val() }).get().join(',')
-                                };
-                                $.getJSON('");
+                                const body = new FormData();
+                                body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                                body.append('wirelessProfileProviders', $container.find('input:checked',).map(function () { return $(this).val() }).get().join(','));
+
+                                fetch('");
 
             
-            #line 876 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
-                                       Write(Url.Action(MVC.API.DeviceProfile.UpdateWirelessProfileProviders(Model.DeviceProfile.Id)));
+            #line 891 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+                                   Write(Url.Action(MVC.API.DeviceProfile.UpdateWirelessProfileProviders(Model.DeviceProfile.Id)));
 
             
             #line default
             #line hidden
-WriteLiteral(@"', data, function (response, result) {
-                                    if (result != 'success' || response != 'OK') {
-                                        alert('Unable to change property ""WirelessProfileProviders"":\n' + response);
-                                        $ajaxLoading.hide();
-                                    } else {
+WriteLiteral(@"', {
+                                    method: 'POST',
+                                    body: body
+                                }).then(r => {
+                                    if (r.ok) {
                                         $ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
+                                    } else {
+                                        alert('Unable to change property ""WirelessProfileProviders"":\n' + r.statusText);
+                                        $ajaxLoading.hide();
                                     }
-                                })
-                            })
+                                }).catch(e => {
+                                    alert('Unable to change property ""WirelessProfileProviders"":\n' + e);
+                                    $ajaxLoading.hide();
+                                });
+                            });
                         });
                     </script>
 ");
 
             
-            #line 887 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 908 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                 }
 
             
@@ -2646,13 +2667,13 @@ WriteLiteral(@"', data, function (response, result) {
 WriteLiteral("            </th>\r\n            <td>\r\n");
 
             
-            #line 890 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 911 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                 
             
             #line default
             #line hidden
             
-            #line 890 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 911 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                  if (canConfig && Model.WirelessProfileProviders.Count > 0)
                 {
                     
@@ -2660,14 +2681,14 @@ WriteLiteral("            </th>\r\n            <td>\r\n");
             #line default
             #line hidden
             
-            #line 892 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 913 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                Write(CommonHelpers.CheckBoxList("DeviceProfile_WirelessProfileProviders", "DeviceProfile_WirelessProfileProviders", Model.WirelessProfileProviders.ToSelectListItems(Model.DeviceProfile.GetWirelessProfileProviders())));
 
             
             #line default
             #line hidden
             
-            #line 892 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 913 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                                                                                                                                                                                                                                         
                 }
                 else
@@ -2687,7 +2708,7 @@ WriteLiteral(" class=\"smallMessage\"");
 WriteLiteral(">&lt;None Allocated&gt;</span>\r\n");
 
             
-            #line 901 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 922 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                     }
                     else
                     {
@@ -2698,13 +2719,13 @@ WriteLiteral(">&lt;None Allocated&gt;</span>\r\n");
 WriteLiteral("                        <ul>\r\n");
 
             
-            #line 905 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 926 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                             
             
             #line default
             #line hidden
             
-            #line 905 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 926 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                              foreach (var wirelessProfileProvider in wirelessProfileProviders)
                             {
 
@@ -2714,7 +2735,7 @@ WriteLiteral("                        <ul>\r\n");
 WriteLiteral("                                <li>");
 
             
-            #line 907 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 928 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                                Write(wirelessProfileProvider.Name);
 
             
@@ -2723,7 +2744,7 @@ WriteLiteral("                                <li>");
 WriteLiteral("</li>\r\n");
 
             
-            #line 908 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 929 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                             }
 
             
@@ -2732,7 +2753,7 @@ WriteLiteral("</li>\r\n");
 WriteLiteral("                        </ul>\r\n");
 
             
-            #line 910 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 931 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                     }
                 }
 
@@ -2742,7 +2763,7 @@ WriteLiteral("                        </ul>\r\n");
 WriteLiteral("                ");
 
             
-            #line 912 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 933 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                  if (canViewPlugins)
                 {
 
@@ -2763,21 +2784,21 @@ WriteLiteral(" class=\"fa fa-info-circle\"");
 
 WriteLiteral("></i>View the <a");
 
-WriteAttribute("href", Tuple.Create(" href=\"", 52078), Tuple.Create("\"", 52128)
+WriteAttribute("href", Tuple.Create(" href=\"", 53278), Tuple.Create("\"", 53328)
             
-            #line 916 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
-, Tuple.Create(Tuple.Create("", 52085), Tuple.Create<System.Object, System.Int32>(Url.Action(MVC.Config.Plugins.Install())
+            #line 937 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+, Tuple.Create(Tuple.Create("", 53285), Tuple.Create<System.Object, System.Int32>(Url.Action(MVC.Config.Plugins.Install())
             
             #line default
             #line hidden
-, 52085), false)
+, 53285), false)
 );
 
 WriteLiteral(">Plugin Catalogue</a> to discover and install wireless profile provider plugins.\r" +
 "\n                        </p>\r\n                    </div>\r\n");
 
             
-            #line 919 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 940 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                 }
 
             
@@ -2786,13 +2807,13 @@ WriteLiteral(">Plugin Catalogue</a> to discover and install wireless profile pro
 WriteLiteral("            </td>\r\n        </tr>\r\n");
 
             
-            #line 922 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 943 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
         
             
             #line default
             #line hidden
             
-            #line 922 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 943 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
          if (hideAdvanced)
         {
 
@@ -2826,7 +2847,7 @@ WriteLiteral(@">Show Advanced Options</button>
 ");
 
             
-            #line 938 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 959 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
         }
 
             
@@ -2842,7 +2863,7 @@ WriteLiteral(">\r\n            <th>\r\n                Linked Groups:\r\n
 WriteLiteral("                    ");
 
             
-            #line 945 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 966 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                Write(Html.Partial(MVC.Config.Shared.Views.LinkedGroupInstance, new LinkedGroupModel()
                {
                    CanConfigure = canConfig,
@@ -2860,7 +2881,7 @@ WriteLiteral("\r\n");
 WriteLiteral("                    ");
 
             
-            #line 953 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 974 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                Write(Html.Partial(MVC.Config.Shared.Views.LinkedGroupInstance, new LinkedGroupModel()
                {
                    CanConfigure = canConfig,
@@ -2876,13 +2897,13 @@ WriteLiteral("                    ");
 WriteLiteral("\r\n");
 
             
-            #line 961 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 982 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                     
             
             #line default
             #line hidden
             
-            #line 961 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 982 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                      if (canConfig)
                     {
                         
@@ -2890,14 +2911,14 @@ WriteLiteral("\r\n");
             #line default
             #line hidden
             
-            #line 963 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 984 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                    Write(Html.Partial(MVC.Config.Shared.Views.LinkedGroupShared));
 
             
             #line default
             #line hidden
             
-            #line 963 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 984 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                                                                                 
                     }
 
@@ -2907,69 +2928,7 @@ WriteLiteral("\r\n");
 WriteLiteral("                </div>\r\n            </td>\r\n        </tr>\r\n    </table>\r\n</div>\r\n");
 
             
-            #line 970 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
- if (canDelete)
-{
-
-            
-            #line default
-            #line hidden
-WriteLiteral("    <div");
-
-WriteLiteral(" id=\"dialogConfirmDelete\"");
-
-WriteLiteral(" title=\"Delete this Device Profile?\"");
-
-WriteLiteral(">\r\n        <p>\r\n            <i");
-
-WriteLiteral(" class=\"fa fa-exclamation-triangle fa-lg warning\"");
-
-WriteLiteral("></i>\r\n            This item will be permanently deleted and cannot be recovered." +
-" Are you sure?\r\n        </p>\r\n    </div>\r\n");
-
-WriteLiteral("    <script");
-
-WriteLiteral(" type=\"text/javascript\"");
-
-WriteLiteral(@">
-        $(function () {
-
-            var button = $('#buttonDelete');
-            var buttonLink = button.attr('href');
-            button.attr('href', '#');
-            button.click(function () {
-                $(""#dialogConfirmDelete"").dialog('open');
-            });
-
-            $(""#dialogConfirmDelete"").dialog({
-                resizable: false,
-                height: 140,
-                modal: true,
-                autoOpen: false,
-                buttons: {
-                    ""Delete"": function () {
-                        $(this).dialog('disable');
-                        window.location.href = buttonLink;
-                    },
-                    Cancel: function () {
-                        $(this).dialog(""close"");
-                    }
-                }
-            });
-
-        });
-    </script>
-");
-
-            
-            #line 1006 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
-}
-
-            
-            #line default
-            #line hidden
-            
-            #line 1007 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 991 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
 Write(Html.Partial(MVC.Config.Shared.Views._DeviceGroupDocumentBulkGenerate, Model));
 
             
@@ -2982,13 +2941,13 @@ WriteLiteral(" class=\"actionBar\"");
 WriteLiteral(">\r\n");
 
             
-            #line 1009 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 993 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
     
             
             #line default
             #line hidden
             
-            #line 1009 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 993 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
      if (Model.CanDecommission)
     {
 
@@ -3014,28 +2973,28 @@ WriteLiteral(" title=\"Profile Device Decommission\"");
 WriteLiteral(">\r\n");
 
             
-            #line 1013 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 997 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
             
             
             #line default
             #line hidden
             
-            #line 1013 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
-             using (Html.BeginForm(MVC.API.Device.DeviceProfileDecommission(Model.DeviceProfile.Id), FormMethod.Post))
+            #line 997 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+             using (Html.BeginForm(MVC.API.Device.DeviceProfileDecommission(Model.DeviceProfile.Id)))
             {
                 
             
             #line default
             #line hidden
             
-            #line 1015 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 999 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
            Write(Html.AntiForgeryToken());
 
             
             #line default
             #line hidden
             
-            #line 1015 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 999 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                                         
 
             
@@ -3060,13 +3019,13 @@ WriteLiteral(" class=\"none\"");
 WriteLiteral(">\r\n");
 
             
-            #line 1021 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1005 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                         
             
             #line default
             #line hidden
             
-            #line 1021 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1005 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                          foreach (DecommissionReasons decommissionReason in Enum.GetValues(typeof(DecommissionReasons)).Cast<DecommissionReasons>().OrderBy(r => r.ToString()))
                         {
 
@@ -3077,33 +3036,33 @@ WriteLiteral("                            <li>\r\n
 
 WriteLiteral(" type=\"radio\"");
 
-WriteAttribute("id", Tuple.Create(" id=\"", 56977), Tuple.Create("\"", 57049)
-, Tuple.Create(Tuple.Create("", 56982), Tuple.Create("DeviceProfile_Decommission_Dialog_Reason_", 56982), true)
+WriteAttribute("id", Tuple.Create(" id=\"", 56980), Tuple.Create("\"", 57052)
+, Tuple.Create(Tuple.Create("", 56985), Tuple.Create("DeviceProfile_Decommission_Dialog_Reason_", 56985), true)
             
-            #line 1024 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
-                 , Tuple.Create(Tuple.Create("", 57023), Tuple.Create<System.Object, System.Int32>((int)decommissionReason
+            #line 1008 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+                 , Tuple.Create(Tuple.Create("", 57026), Tuple.Create<System.Object, System.Int32>((int)decommissionReason
             
             #line default
             #line hidden
-, 57023), false)
+, 57026), false)
 );
 
 WriteLiteral("\r\n                                       name=\"decommissionReason\"");
 
-WriteAttribute("value", Tuple.Create(" value=\"", 57116), Tuple.Create("\"", 57150)
+WriteAttribute("value", Tuple.Create(" value=\"", 57119), Tuple.Create("\"", 57153)
             
-            #line 1025 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
-, Tuple.Create(Tuple.Create("", 57124), Tuple.Create<System.Object, System.Int32>((int)decommissionReason
+            #line 1009 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+, Tuple.Create(Tuple.Create("", 57127), Tuple.Create<System.Object, System.Int32>((int)decommissionReason
             
             #line default
             #line hidden
-, 57124), false)
+, 57127), false)
 );
 
 WriteLiteral(" ");
 
             
-            #line 1025 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1009 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                                                                                                 Write((decommissionReason == DecommissionReasons.EndOfLife) ? "checked=\"checked\"" : string.Empty);
 
             
@@ -3111,21 +3070,21 @@ WriteLiteral(" ");
             #line hidden
 WriteLiteral(" />\r\n                                <label");
 
-WriteAttribute("for", Tuple.Create(" for=\"", 57290), Tuple.Create("\"", 57363)
-, Tuple.Create(Tuple.Create("", 57296), Tuple.Create("DeviceProfile_Decommission_Dialog_Reason_", 57296), true)
+WriteAttribute("for", Tuple.Create(" for=\"", 57293), Tuple.Create("\"", 57366)
+, Tuple.Create(Tuple.Create("", 57299), Tuple.Create("DeviceProfile_Decommission_Dialog_Reason_", 57299), true)
             
-            #line 1026 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
-     , Tuple.Create(Tuple.Create("", 57337), Tuple.Create<System.Object, System.Int32>((int)decommissionReason
+            #line 1010 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+     , Tuple.Create(Tuple.Create("", 57340), Tuple.Create<System.Object, System.Int32>((int)decommissionReason
             
             #line default
             #line hidden
-, 57337), false)
+, 57340), false)
 );
 
 WriteLiteral(">");
 
             
-            #line 1026 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1010 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                                                                                                              Write(decommissionReason.ReasonMessage());
 
             
@@ -3134,7 +3093,7 @@ WriteLiteral(">");
 WriteLiteral("</label>\r\n                            </li>\r\n");
 
             
-            #line 1028 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1012 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                         }
 
             
@@ -3153,7 +3112,7 @@ WriteLiteral(" />\r\n                        Unassign devices users\r\n
 "\r\n                </div>\r\n");
 
             
-            #line 1036 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1020 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
             }
 
             
@@ -3197,7 +3156,7 @@ WriteLiteral(@">
 ");
 
             
-            #line 1067 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1051 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
     }
 
             
@@ -3206,23 +3165,104 @@ WriteLiteral(@">
 WriteLiteral("    ");
 
             
-            #line 1068 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1052 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
      if (canDelete)
     {
-        
+
+            
+            #line default
+            #line hidden
+WriteLiteral("        <button");
+
+WriteLiteral(" id=\"buttonDelete\"");
+
+WriteLiteral(" type=\"button\"");
+
+WriteLiteral(" class=\"button\"");
+
+WriteLiteral(">Delete</button>\r\n");
+
+WriteLiteral("        <div");
+
+WriteLiteral(" id=\"dialogConfirmDelete\"");
+
+WriteLiteral(" class=\"dialog\"");
+
+WriteLiteral(" title=\"Delete this Device Profile?\"");
+
+WriteLiteral(">\r\n");
+
+            
+            #line 1056 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            
             
             #line default
             #line hidden
             
-            #line 1070 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
-   Write(Html.ActionLinkButton("Delete", MVC.API.DeviceProfile.Delete(Model.DeviceProfile.Id, true), "buttonDelete"));
+            #line 1056 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+             using (Html.BeginForm(MVC.API.DeviceProfile.Delete(Model.DeviceProfile.Id, true)))
+            {
+                
+            
+            #line default
+            #line hidden
+            
+            #line 1058 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+           Write(Html.AntiForgeryToken());
 
             
             #line default
             #line hidden
             
-            #line 1070 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
-                                                                                                                    
+            #line 1058 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+                                        
+            }
+
+            
+            #line default
+            #line hidden
+WriteLiteral("            <p>\r\n                <i");
+
+WriteLiteral(" class=\"fa fa-exclamation-triangle fa-lg warning\"");
+
+WriteLiteral("></i>\r\n                This item will be permanently deleted and cannot be recove" +
+"red. Are you sure?\r\n            </p>\r\n        </div>\r\n");
+
+WriteLiteral("        <script");
+
+WriteLiteral(" type=\"text/javascript\"");
+
+WriteLiteral(@">
+            $(function () {
+                let dialog = null;
+                $('#buttonDelete').on('click', function () {
+                    if (!dialog) {
+                        dialog = $(""#dialogConfirmDelete"").dialog({
+                            resizable: false,
+                            width: 300,
+                            modal: true,
+                            autoOpen: false,
+                            buttons: {
+                                ""Delete"": function () {
+                                    $(this)
+                                        .dialog(""option"", ""buttons"", null)
+                                        .find('form').trigger('submit');
+                                },
+                                Cancel: function () {
+                                    $(this).dialog(""close"");
+                                }
+                            }
+                        });
+                    }
+
+                    dialog.dialog('open');
+                });
+            });
+        </script>
+");
+
+            
+            #line 1092 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
     }
 
             
@@ -3231,7 +3271,7 @@ WriteLiteral("    ");
 WriteLiteral("    ");
 
             
-            #line 1072 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1093 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
      if (Authorization.Has(Claims.Device.Actions.Export))
     {
         
@@ -3239,14 +3279,14 @@ WriteLiteral("    ");
             #line default
             #line hidden
             
-            #line 1074 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1095 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
    Write(Html.ActionLinkButton("Export Devices", MVC.Device.Export(null, Disco.Models.Services.Devices.DeviceExportTypes.Profile, Model.DeviceProfile.Id)));
 
             
             #line default
             #line hidden
             
-            #line 1074 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1095 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                                                                                                                                                           
     }
 
@@ -3256,7 +3296,7 @@ WriteLiteral("    ");
 WriteLiteral("    ");
 
             
-            #line 1076 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1097 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
      if (Authorization.Has(Claims.Device.Search) && Model.DeviceCount > 0)
     {
         
@@ -3264,14 +3304,14 @@ WriteLiteral("    ");
             #line default
             #line hidden
             
-            #line 1078 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1099 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
    Write(Html.ActionLinkButton(string.Format("View {0} Device{1}", Model.DeviceCount, (Model.DeviceCount != 1 ? "s" : null)), MVC.Search.Query(Model.DeviceProfile.Id.ToString(), "DeviceProfile")));
 
             
             #line default
             #line hidden
             
-            #line 1078 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1099 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                                                                                                                                                                                                    
     }
 

Disco.Web/Areas/Config/Views/DocumentTemplate/BulkGenerate.cshtml

@@ -8,7 +8,7 @@
 }
 <div id="DocumentTemplate_BulkGenerate">
     <div class="actions">
-        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerate(Model.DocumentTemplate.Id), FormMethod.Post))
+        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerate(Model.DocumentTemplate.Id)))
         {
             if (Model.TemplatePageCount > 1 && Model.TemplatePageCount % 2 != 0)
             {
@@ -79,7 +79,7 @@
             <div class="example3 code">user6;smi0099;@(ActiveDirectory.Context.PrimaryDomain.NetBiosName)\rsmith;Domain Admins</div>
         </div>
     </div>
-    @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddUsers(), FormMethod.Post))
+    @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddUsers()))
     {
         <div class="field-validation-valid" data-valmsg-replace="true" data-valmsg-for="userIds"></div>
         <textarea id="inputBulkGenerateDataIds" name="userIds" data-val="true" data-val-required="Identifiers are required" required></textarea>
@@ -93,7 +93,7 @@
             Add all members of a group (including recursive members) to the bulk generation.
         </div>
     </div>
-    @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddGroupMembers(), FormMethod.Post))
+    @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddGroupMembers()))
     {
         <table class="input">
             <tbody>
@@ -119,7 +119,7 @@
                 Add all users associated with the flag to the bulk generation.
             </div>
         </div>
-        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddUserFlag(), FormMethod.Post))
+        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddUserFlag()))
         {
             <input name="flagId" type="hidden" required />
             <div class="dialog-item-picker">
@@ -144,7 +144,7 @@
                 Add all users associated with a device in the selected profile to the bulk generation.
             </div>
         </div>
-        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddDeviceProfile(), FormMethod.Post))
+        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddDeviceProfile()))
         {
             <input name="deviceProfileId" type="hidden" required />
             <div class="dialog-item-picker">
@@ -168,7 +168,7 @@
                 Add all users associated with a device in the selected batch to the bulk generation.
             </div>
         </div>
-        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddDeviceBatch(), FormMethod.Post))
+        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddDeviceBatch()))
         {
             <input name="deviceBatchId" type="hidden" required />
             <div class="dialog-item-picker">
@@ -192,7 +192,7 @@
                 Add all users associated with an attachment of the selected document template to the bulk generation.
             </div>
         </div>
-        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddDocumentAttachment(), FormMethod.Post))
+        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddDocumentAttachment()))
         {
             <input name="documentTemplateId" type="hidden" required />
             <div class="dialog-item-picker">
@@ -220,7 +220,7 @@
                 Add all users with a matching user detail to the bulk generation.
             </div>
         </div>
-        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddUserDetail(), FormMethod.Post))
+        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddUserDetail()))
         {
             <input name="key" type="hidden" required />
             <input name="value" type="hidden" />
@@ -236,7 +236,7 @@
 
             @Html.AntiForgeryToken()
         }
-        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateGetUserDetailValues(), FormMethod.Post))
+        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateGetUserDetailValues()))
         {
             <input name="key" type="hidden" required />
 

Disco.Web/Areas/Config/Views/DocumentTemplate/BulkGenerate.generated.cs

@@ -78,7 +78,7 @@ WriteLiteral(">\r\n");
             #line hidden
             
             #line 11 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerate(Model.DocumentTemplate.Id), FormMethod.Post))
+         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerate(Model.DocumentTemplate.Id)))
         {
             if (Model.TemplatePageCount > 1 && Model.TemplatePageCount % 2 != 0)
             {
@@ -314,17 +314,17 @@ WriteLiteral(" id=\"DocumentTemplate_BulkGenerate_Dialog_AddUsers\"");
 
 WriteLiteral(" class=\"dialog dialog-bulk-generate\"");
 
-WriteAttribute("title", Tuple.Create(" title=\"", 2917), Tuple.Create("\"", 2973)
+WriteAttribute("title", Tuple.Create(" title=\"", 2900), Tuple.Create("\"", 2956)
             
             #line 62 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-                    , Tuple.Create(Tuple.Create("", 2925), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
+                    , Tuple.Create(Tuple.Create("", 2908), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
             
             #line default
             #line hidden
-, 2925), false)
-, Tuple.Create(Tuple.Create("", 2962), Tuple.Create(":", 2962), true)
-, Tuple.Create(Tuple.Create(" ", 2963), Tuple.Create("Add", 2964), true)
-, Tuple.Create(Tuple.Create(" ", 2967), Tuple.Create("Users", 2968), true)
+, 2908), false)
+, Tuple.Create(Tuple.Create("", 2945), Tuple.Create(":", 2945), true)
+, Tuple.Create(Tuple.Create(" ", 2946), Tuple.Create("Add", 2947), true)
+, Tuple.Create(Tuple.Create(" ", 2950), Tuple.Create("Users", 2951), true)
 );
 
 WriteLiteral(">\r\n    <div");
@@ -396,7 +396,7 @@ WriteLiteral("\\rsmith;Domain Admins</div>\r\n        </div>\r\n    </div>\r\n")
             #line hidden
             
             #line 82 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-     using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddUsers(), FormMethod.Post))
+     using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddUsers()))
     {
 
             
@@ -451,18 +451,18 @@ WriteLiteral(" id=\"DocumentTemplate_BulkGenerate_Dialog_AddGroupMembers\"");
 
 WriteLiteral(" class=\"dialog dialog-bulk-generate\"");
 
-WriteAttribute("title", Tuple.Create(" title=\"", 4437), Tuple.Create("\"", 4501)
+WriteAttribute("title", Tuple.Create(" title=\"", 4403), Tuple.Create("\"", 4467)
             
             #line 90 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-                           , Tuple.Create(Tuple.Create("", 4445), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
+                           , Tuple.Create(Tuple.Create("", 4411), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
             
             #line default
             #line hidden
-, 4445), false)
-, Tuple.Create(Tuple.Create("", 4482), Tuple.Create(":", 4482), true)
-, Tuple.Create(Tuple.Create(" ", 4483), Tuple.Create("Add", 4484), true)
-, Tuple.Create(Tuple.Create(" ", 4487), Tuple.Create("Group", 4488), true)
-, Tuple.Create(Tuple.Create(" ", 4493), Tuple.Create("Members", 4494), true)
+, 4411), false)
+, Tuple.Create(Tuple.Create("", 4448), Tuple.Create(":", 4448), true)
+, Tuple.Create(Tuple.Create(" ", 4449), Tuple.Create("Add", 4450), true)
+, Tuple.Create(Tuple.Create(" ", 4453), Tuple.Create("Group", 4454), true)
+, Tuple.Create(Tuple.Create(" ", 4459), Tuple.Create("Members", 4460), true)
 );
 
 WriteLiteral(">\r\n    <div");
@@ -480,7 +480,7 @@ WriteLiteral(">\r\n        <div>\r\n            Add all members of a group (incl
             #line hidden
             
             #line 96 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-     using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddGroupMembers(), FormMethod.Post))
+     using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddGroupMembers()))
     {
 
             
@@ -555,19 +555,19 @@ WriteLiteral(" id=\"DocumentTemplate_BulkGenerate_Dialog_AddUserFlag\"");
 
 WriteLiteral(" class=\"dialog dialog-bulk-generate\"");
 
-WriteAttribute("title", Tuple.Create(" title=\"", 5539), Tuple.Create("\"", 5611)
+WriteAttribute("title", Tuple.Create(" title=\"", 5488), Tuple.Create("\"", 5560)
             
             #line 116 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-                           , Tuple.Create(Tuple.Create("", 5547), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
+                           , Tuple.Create(Tuple.Create("", 5496), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
             
             #line default
             #line hidden
-, 5547), false)
-, Tuple.Create(Tuple.Create("", 5584), Tuple.Create(":", 5584), true)
-, Tuple.Create(Tuple.Create(" ", 5585), Tuple.Create("Add", 5586), true)
-, Tuple.Create(Tuple.Create(" ", 5589), Tuple.Create("User", 5590), true)
-, Tuple.Create(Tuple.Create(" ", 5594), Tuple.Create("Flag", 5595), true)
-, Tuple.Create(Tuple.Create(" ", 5599), Tuple.Create("Assignments", 5600), true)
+, 5496), false)
+, Tuple.Create(Tuple.Create("", 5533), Tuple.Create(":", 5533), true)
+, Tuple.Create(Tuple.Create(" ", 5534), Tuple.Create("Add", 5535), true)
+, Tuple.Create(Tuple.Create(" ", 5538), Tuple.Create("User", 5539), true)
+, Tuple.Create(Tuple.Create(" ", 5543), Tuple.Create("Flag", 5544), true)
+, Tuple.Create(Tuple.Create(" ", 5548), Tuple.Create("Assignments", 5549), true)
 );
 
 WriteLiteral(">\r\n        <div");
@@ -585,7 +585,7 @@ WriteLiteral(">\r\n            <div>\r\n                Add all users associated
             #line hidden
             
             #line 122 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddUserFlag(), FormMethod.Post))
+         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddUserFlag()))
         {
 
             
@@ -621,15 +621,15 @@ WriteLiteral(">\r\n");
             #line hidden
 WriteLiteral("                    <div");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 6097), Tuple.Create("\"", 6148)
-, Tuple.Create(Tuple.Create("", 6105), Tuple.Create("item", 6105), true)
+WriteAttribute("class", Tuple.Create(" class=\"", 6029), Tuple.Create("\"", 6080)
+, Tuple.Create(Tuple.Create("", 6037), Tuple.Create("item", 6037), true)
             
             #line 128 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-, Tuple.Create(Tuple.Create(" ", 6109), Tuple.Create<System.Object, System.Int32>(flag.Count == 0 ? "disabled" : null
+, Tuple.Create(Tuple.Create(" ", 6041), Tuple.Create<System.Object, System.Int32>(flag.Count == 0 ? "disabled" : null
             
             #line default
             #line hidden
-, 6110), false)
+, 6042), false)
 );
 
 WriteLiteral(" data-userflagid=\"");
@@ -645,26 +645,26 @@ WriteLiteral("\"");
 
 WriteLiteral(">\r\n                        <i");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 6210), Tuple.Create("\"", 6279)
-, Tuple.Create(Tuple.Create("", 6218), Tuple.Create("fa", 6218), true)
-, Tuple.Create(Tuple.Create(" ", 6220), Tuple.Create("fa-", 6221), true)
+WriteAttribute("class", Tuple.Create(" class=\"", 6142), Tuple.Create("\"", 6211)
+, Tuple.Create(Tuple.Create("", 6150), Tuple.Create("fa", 6150), true)
+, Tuple.Create(Tuple.Create(" ", 6152), Tuple.Create("fa-", 6153), true)
             
             #line 129 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-, Tuple.Create(Tuple.Create("", 6224), Tuple.Create<System.Object, System.Int32>(flag.Item.Icon
+, Tuple.Create(Tuple.Create("", 6156), Tuple.Create<System.Object, System.Int32>(flag.Item.Icon
             
             #line default
             #line hidden
-, 6224), false)
-, Tuple.Create(Tuple.Create(" ", 6241), Tuple.Create("fa-fw", 6242), true)
-, Tuple.Create(Tuple.Create(" ", 6247), Tuple.Create("fa-lg", 6248), true)
-, Tuple.Create(Tuple.Create(" ", 6253), Tuple.Create("d-", 6254), true)
+, 6156), false)
+, Tuple.Create(Tuple.Create(" ", 6173), Tuple.Create("fa-fw", 6174), true)
+, Tuple.Create(Tuple.Create(" ", 6179), Tuple.Create("fa-lg", 6180), true)
+, Tuple.Create(Tuple.Create(" ", 6185), Tuple.Create("d-", 6186), true)
             
             #line 129 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-, Tuple.Create(Tuple.Create("", 6256), Tuple.Create<System.Object, System.Int32>(flag.Item.IconColour
+, Tuple.Create(Tuple.Create("", 6188), Tuple.Create<System.Object, System.Int32>(flag.Item.IconColour
             
             #line default
             #line hidden
-, 6256), false)
+, 6188), false)
 );
 
 WriteLiteral("></i>");
@@ -752,21 +752,21 @@ WriteLiteral(" id=\"DocumentTemplate_BulkGenerate_Dialog_AddDeviceProfile\"");
 
 WriteLiteral(" class=\"dialog dialog-bulk-generate\"");
 
-WriteAttribute("title", Tuple.Create(" title=\"", 6673), Tuple.Create("\"", 6755)
+WriteAttribute("title", Tuple.Create(" title=\"", 6605), Tuple.Create("\"", 6687)
             
             #line 141 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-                                , Tuple.Create(Tuple.Create("", 6681), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
+                                , Tuple.Create(Tuple.Create("", 6613), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
             
             #line default
             #line hidden
-, 6681), false)
-, Tuple.Create(Tuple.Create("", 6718), Tuple.Create(":", 6718), true)
-, Tuple.Create(Tuple.Create(" ", 6719), Tuple.Create("Add", 6720), true)
-, Tuple.Create(Tuple.Create(" ", 6723), Tuple.Create("User", 6724), true)
-, Tuple.Create(Tuple.Create(" ", 6728), Tuple.Create("by", 6729), true)
-, Tuple.Create(Tuple.Create(" ", 6731), Tuple.Create("Assigned", 6732), true)
-, Tuple.Create(Tuple.Create(" ", 6740), Tuple.Create("Device", 6741), true)
-, Tuple.Create(Tuple.Create(" ", 6747), Tuple.Create("Profile", 6748), true)
+, 6613), false)
+, Tuple.Create(Tuple.Create("", 6650), Tuple.Create(":", 6650), true)
+, Tuple.Create(Tuple.Create(" ", 6651), Tuple.Create("Add", 6652), true)
+, Tuple.Create(Tuple.Create(" ", 6655), Tuple.Create("User", 6656), true)
+, Tuple.Create(Tuple.Create(" ", 6660), Tuple.Create("by", 6661), true)
+, Tuple.Create(Tuple.Create(" ", 6663), Tuple.Create("Assigned", 6664), true)
+, Tuple.Create(Tuple.Create(" ", 6672), Tuple.Create("Device", 6673), true)
+, Tuple.Create(Tuple.Create(" ", 6679), Tuple.Create("Profile", 6680), true)
 );
 
 WriteLiteral(">\r\n        <div");
@@ -785,7 +785,7 @@ WriteLiteral(">\r\n            <div>\r\n                Add all users associated
             #line hidden
             
             #line 147 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddDeviceProfile(), FormMethod.Post))
+         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddDeviceProfile()))
         {
 
             
@@ -821,15 +821,15 @@ WriteLiteral(">\r\n");
             #line hidden
 WriteLiteral("                    <div");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 7287), Tuple.Create("\"", 7341)
-, Tuple.Create(Tuple.Create("", 7295), Tuple.Create("item", 7295), true)
+WriteAttribute("class", Tuple.Create(" class=\"", 7202), Tuple.Create("\"", 7256)
+, Tuple.Create(Tuple.Create("", 7210), Tuple.Create("item", 7210), true)
             
             #line 153 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-, Tuple.Create(Tuple.Create(" ", 7299), Tuple.Create<System.Object, System.Int32>(profile.Count == 0 ? "disabled" : null
+, Tuple.Create(Tuple.Create(" ", 7214), Tuple.Create<System.Object, System.Int32>(profile.Count == 0 ? "disabled" : null
             
             #line default
             #line hidden
-, 7300), false)
+, 7215), false)
 );
 
 WriteLiteral(" data-id=\"");
@@ -931,21 +931,21 @@ WriteLiteral(" id=\"DocumentTemplate_BulkGenerate_Dialog_AddDeviceBatch\"");
 
 WriteLiteral(" class=\"dialog dialog-bulk-generate\"");
 
-WriteAttribute("title", Tuple.Create(" title=\"", 7825), Tuple.Create("\"", 7905)
+WriteAttribute("title", Tuple.Create(" title=\"", 7740), Tuple.Create("\"", 7820)
             
             #line 165 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-                              , Tuple.Create(Tuple.Create("", 7833), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
+                              , Tuple.Create(Tuple.Create("", 7748), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
             
             #line default
             #line hidden
-, 7833), false)
-, Tuple.Create(Tuple.Create("", 7870), Tuple.Create(":", 7870), true)
-, Tuple.Create(Tuple.Create(" ", 7871), Tuple.Create("Add", 7872), true)
-, Tuple.Create(Tuple.Create(" ", 7875), Tuple.Create("User", 7876), true)
-, Tuple.Create(Tuple.Create(" ", 7880), Tuple.Create("by", 7881), true)
-, Tuple.Create(Tuple.Create(" ", 7883), Tuple.Create("Assigned", 7884), true)
-, Tuple.Create(Tuple.Create(" ", 7892), Tuple.Create("Device", 7893), true)
-, Tuple.Create(Tuple.Create(" ", 7899), Tuple.Create("Batch", 7900), true)
+, 7748), false)
+, Tuple.Create(Tuple.Create("", 7785), Tuple.Create(":", 7785), true)
+, Tuple.Create(Tuple.Create(" ", 7786), Tuple.Create("Add", 7787), true)
+, Tuple.Create(Tuple.Create(" ", 7790), Tuple.Create("User", 7791), true)
+, Tuple.Create(Tuple.Create(" ", 7795), Tuple.Create("by", 7796), true)
+, Tuple.Create(Tuple.Create(" ", 7798), Tuple.Create("Assigned", 7799), true)
+, Tuple.Create(Tuple.Create(" ", 7807), Tuple.Create("Device", 7808), true)
+, Tuple.Create(Tuple.Create(" ", 7814), Tuple.Create("Batch", 7815), true)
 );
 
 WriteLiteral(">\r\n        <div");
@@ -963,7 +963,7 @@ WriteLiteral(">\r\n            <div>\r\n                Add all users associated
             #line hidden
             
             #line 171 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddDeviceBatch(), FormMethod.Post))
+         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddDeviceBatch()))
         {
 
             
@@ -999,15 +999,15 @@ WriteLiteral(">\r\n");
             #line hidden
 WriteLiteral("                    <div");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 8428), Tuple.Create("\"", 8480)
-, Tuple.Create(Tuple.Create("", 8436), Tuple.Create("item", 8436), true)
+WriteAttribute("class", Tuple.Create(" class=\"", 8326), Tuple.Create("\"", 8378)
+, Tuple.Create(Tuple.Create("", 8334), Tuple.Create("item", 8334), true)
             
             #line 177 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-, Tuple.Create(Tuple.Create(" ", 8440), Tuple.Create<System.Object, System.Int32>(batch.Count == 0 ? "disabled" : null
+, Tuple.Create(Tuple.Create(" ", 8338), Tuple.Create<System.Object, System.Int32>(batch.Count == 0 ? "disabled" : null
             
             #line default
             #line hidden
-, 8441), false)
+, 8339), false)
 );
 
 WriteLiteral(" data-id=\"");
@@ -1109,21 +1109,21 @@ WriteLiteral(" id=\"DocumentTemplate_BulkGenerate_Dialog_AddDocumentAttachment\"
 
 WriteLiteral(" class=\"dialog dialog-bulk-generate\"");
 
-WriteAttribute("title", Tuple.Create(" title=\"", 8967), Tuple.Create("\"", 9047)
+WriteAttribute("title", Tuple.Create(" title=\"", 8865), Tuple.Create("\"", 8945)
             
             #line 189 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-                                     , Tuple.Create(Tuple.Create("", 8975), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
+                                     , Tuple.Create(Tuple.Create("", 8873), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
             
             #line default
             #line hidden
-, 8975), false)
-, Tuple.Create(Tuple.Create("", 9012), Tuple.Create(":", 9012), true)
-, Tuple.Create(Tuple.Create(" ", 9013), Tuple.Create("Add", 9014), true)
-, Tuple.Create(Tuple.Create(" ", 9017), Tuple.Create("User", 9018), true)
-, Tuple.Create(Tuple.Create(" ", 9022), Tuple.Create("by", 9023), true)
-, Tuple.Create(Tuple.Create(" ", 9025), Tuple.Create("Assigned", 9026), true)
-, Tuple.Create(Tuple.Create(" ", 9034), Tuple.Create("Device", 9035), true)
-, Tuple.Create(Tuple.Create(" ", 9041), Tuple.Create("Batch", 9042), true)
+, 8873), false)
+, Tuple.Create(Tuple.Create("", 8910), Tuple.Create(":", 8910), true)
+, Tuple.Create(Tuple.Create(" ", 8911), Tuple.Create("Add", 8912), true)
+, Tuple.Create(Tuple.Create(" ", 8915), Tuple.Create("User", 8916), true)
+, Tuple.Create(Tuple.Create(" ", 8920), Tuple.Create("by", 8921), true)
+, Tuple.Create(Tuple.Create(" ", 8923), Tuple.Create("Assigned", 8924), true)
+, Tuple.Create(Tuple.Create(" ", 8932), Tuple.Create("Device", 8933), true)
+, Tuple.Create(Tuple.Create(" ", 8939), Tuple.Create("Batch", 8940), true)
 );
 
 WriteLiteral(">\r\n        <div");
@@ -1142,7 +1142,7 @@ WriteLiteral(">\r\n            <div>\r\n                Add all users associated
             #line hidden
             
             #line 195 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddDocumentAttachment(), FormMethod.Post))
+         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddDocumentAttachment()))
         {
 
             
@@ -1178,15 +1178,15 @@ WriteLiteral(">\r\n");
             #line hidden
 WriteLiteral("                    <div");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 9606), Tuple.Create("\"", 9661)
-, Tuple.Create(Tuple.Create("", 9614), Tuple.Create("item", 9614), true)
+WriteAttribute("class", Tuple.Create(" class=\"", 9487), Tuple.Create("\"", 9542)
+, Tuple.Create(Tuple.Create("", 9495), Tuple.Create("item", 9495), true)
             
             #line 201 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-, Tuple.Create(Tuple.Create(" ", 9618), Tuple.Create<System.Object, System.Int32>(template.Count == 0 ? "disabled" : null
+, Tuple.Create(Tuple.Create(" ", 9499), Tuple.Create<System.Object, System.Int32>(template.Count == 0 ? "disabled" : null
             
             #line default
             #line hidden
-, 9619), false)
+, 9500), false)
 );
 
 WriteLiteral(" data-id=\"");
@@ -1316,19 +1316,19 @@ WriteLiteral(" id=\"DocumentTemplate_BulkGenerate_Dialog_AddUserDetail\"");
 
 WriteLiteral(" class=\"dialog dialog-bulk-generate\"");
 
-WriteAttribute("title", Tuple.Create(" title=\"", 10517), Tuple.Create("\"", 10582)
+WriteAttribute("title", Tuple.Create(" title=\"", 10398), Tuple.Create("\"", 10463)
             
             #line 217 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-                            , Tuple.Create(Tuple.Create("", 10525), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
+                            , Tuple.Create(Tuple.Create("", 10406), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
             
             #line default
             #line hidden
-, 10525), false)
-, Tuple.Create(Tuple.Create("", 10562), Tuple.Create(":", 10562), true)
-, Tuple.Create(Tuple.Create(" ", 10563), Tuple.Create("Add", 10564), true)
-, Tuple.Create(Tuple.Create(" ", 10567), Tuple.Create("User", 10568), true)
-, Tuple.Create(Tuple.Create(" ", 10572), Tuple.Create("by", 10573), true)
-, Tuple.Create(Tuple.Create(" ", 10575), Tuple.Create("Detail", 10576), true)
+, 10406), false)
+, Tuple.Create(Tuple.Create("", 10443), Tuple.Create(":", 10443), true)
+, Tuple.Create(Tuple.Create(" ", 10444), Tuple.Create("Add", 10445), true)
+, Tuple.Create(Tuple.Create(" ", 10448), Tuple.Create("User", 10449), true)
+, Tuple.Create(Tuple.Create(" ", 10453), Tuple.Create("by", 10454), true)
+, Tuple.Create(Tuple.Create(" ", 10456), Tuple.Create("Detail", 10457), true)
 );
 
 WriteLiteral(">\r\n        <div");
@@ -1346,7 +1346,7 @@ WriteLiteral(">\r\n            <div>\r\n                Add all users with a mat
             #line hidden
             
             #line 223 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddUserDetail(), FormMethod.Post))
+         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddUserDetail()))
         {
 
             
@@ -1401,15 +1401,15 @@ WriteLiteral(">\r\n");
             #line hidden
 WriteLiteral("                    <div");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 11216), Tuple.Create("\"", 11266)
-, Tuple.Create(Tuple.Create("", 11224), Tuple.Create("item", 11224), true)
+WriteAttribute("class", Tuple.Create(" class=\"", 11080), Tuple.Create("\"", 11130)
+, Tuple.Create(Tuple.Create("", 11088), Tuple.Create("item", 11088), true)
             
             #line 231 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-, Tuple.Create(Tuple.Create(" ", 11228), Tuple.Create<System.Object, System.Int32>(key.Count == 0 ? "disabled" : null
+, Tuple.Create(Tuple.Create(" ", 11092), Tuple.Create<System.Object, System.Int32>(key.Count == 0 ? "disabled" : null
             
             #line default
             #line hidden
-, 11229), false)
+, 11093), false)
 );
 
 WriteLiteral(" data-id=\"");
@@ -1491,7 +1491,7 @@ WriteLiteral("        ");
 
             
             #line 239 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateGetUserDetailValues(), FormMethod.Post))
+         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateGetUserDetailValues()))
         {
 
             

Disco.Web/Areas/Config/Views/DocumentTemplate/Create.cshtml

@@ -1,25 +1,28 @@
 @model Disco.Web.Areas.Config.Models.DocumentTemplate.CreateModel
 @{
     Authorization.RequireAll(Claims.Config.DocumentTemplate.Create, Claims.Config.DocumentTemplate.Configure);
-    
+
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Document Templates", MVC.Config.DocumentTemplate.Index(null), "Create");
 }
 @using (Html.BeginForm(MVC.Config.DocumentTemplate.Create(), FormMethod.Post, new { enctype = "multipart/form-data" }))
-{ 
+{
+    @Html.AntiForgeryToken()
     <div class="form" style="width: 650px">
         <table>
             <tr>
                 <th>
                     Id:
                 </th>
-                <td>@Html.TextBoxFor(model => model.DocumentTemplate.Id)<br />@Html.ValidationMessageFor(model => model.DocumentTemplate.Id)
+                <td>
+                    @Html.TextBoxFor(model => model.Id)<br />@Html.ValidationMessageFor(model => model.Id)
                 </td>
             </tr>
             <tr>
                 <th>
                     Description:
                 </th>
-                <td>@Html.TextBoxFor(model => model.DocumentTemplate.Description)<br />@Html.ValidationMessageFor(model => model.DocumentTemplate.Description)
+                <td>
+                    @Html.TextBoxFor(model => model.Description)<br />@Html.ValidationMessageFor(model => model.Description)
                 </td>
             </tr>
             <tr>
@@ -27,7 +30,7 @@
                     Scope:
                 </th>
                 <td>
-                    @Html.DropDownListFor(model => model.DocumentTemplate.Scope, Model.Scopes.ToSelectListItems(null))
+                    @Html.DropDownListFor(model => model.Scope, Model.Scopes.ToSelectListItems(null))
                 </td>
             </tr>
             <tr>
@@ -52,12 +55,13 @@
                     <th class="name">
                         @jt.Description<br />
                         Sub Types<br />
-                    @CommonHelpers.CheckboxBulkSelect(string.Format("CheckboxBulkSelect_{0}", jt.Id))
+                        @CommonHelpers.CheckboxBulkSelect(string.Format("CheckboxBulkSelect_{0}", jt.Id))
                     </th>
                     <td class="value">
                         @CommonHelpers.CheckBoxList("SubTypes", Model.JobSubTypes.Where(jst => jst.JobTypeId == jt.Id).ToList().ToSelectListItems(Model.SubTypes), 2)
                     </td>
-                </tr>   
+                </tr>
+
             }
         </table>
         <p class="actions">
@@ -68,7 +72,7 @@
         $(function () {
             $('#Name').focus().select();
 
-            var $scope = $('#DocumentTemplate_Scope');
+            var $scope = $('#Scope');
             var $trJobTypes = $('#trJobTypes');
             var $jobTypes = $trJobTypes.find('input[type="checkbox"]');
             $scope.change(scopeChange);
@@ -89,10 +93,10 @@
             function jobTypesChange() {
                 $('.jobSubTypes').hide();
                 $jobTypes.filter(':checked').each(function () {
-                    $('#trJobSubType' + $(this).val()).show();    
+                    $('#trJobSubType' + $(this).val()).show();
                 });
             }
 
         });
     </script>
-}
+}

Disco.Web/Areas/Config/Views/DocumentTemplate/Create.generated.cs

@@ -47,7 +47,7 @@ namespace Disco.Web.Areas.Config.Views.DocumentTemplate
             #line 2 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
   
     Authorization.RequireAll(Claims.Config.DocumentTemplate.Create, Claims.Config.DocumentTemplate.Configure);
-    
+
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Document Templates", MVC.Config.DocumentTemplate.Index(null), "Create");
 
             
@@ -58,7 +58,21 @@ WriteLiteral("\r\n");
             
             #line 7 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
  using (Html.BeginForm(MVC.Config.DocumentTemplate.Create(), FormMethod.Post, new { enctype = "multipart/form-data" }))
-{ 
+{
+    
+            
+            #line default
+            #line hidden
+            
+            #line 9 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+Write(Html.AntiForgeryToken());
+
+            
+            #line default
+            #line hidden
+            
+            #line 9 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+                            
 
             
             #line default
@@ -70,11 +84,13 @@ WriteLiteral(" class=\"form\"");
 WriteLiteral(" style=\"width: 650px\"");
 
 WriteLiteral(">\r\n        <table>\r\n            <tr>\r\n                <th>\r\n                    I" +
-"d:\r\n                </th>\r\n                <td>");
+"d:\r\n                </th>\r\n                <td>\r\n");
+
+WriteLiteral("                    ");
 
             
-            #line 15 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
-               Write(Html.TextBoxFor(model => model.DocumentTemplate.Id));
+            #line 17 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+               Write(Html.TextBoxFor(model => model.Id));
 
             
             #line default
@@ -82,19 +98,21 @@ WriteLiteral(">\r\n        <table>\r\n            <tr>\r\n                <th>\r
 WriteLiteral("<br />");
 
             
-            #line 15 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
-                                                                         Write(Html.ValidationMessageFor(model => model.DocumentTemplate.Id));
+            #line 17 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+                                                        Write(Html.ValidationMessageFor(model => model.Id));
 
             
             #line default
             #line hidden
 WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>\r\n                <th" +
 ">\r\n                    Description:\r\n                </th>\r\n                <td>" +
-"");
+"\r\n");
+
+WriteLiteral("                    ");
 
             
-            #line 22 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
-               Write(Html.TextBoxFor(model => model.DocumentTemplate.Description));
+            #line 25 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+               Write(Html.TextBoxFor(model => model.Description));
 
             
             #line default
@@ -102,8 +120,8 @@ WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>
 WriteLiteral("<br />");
 
             
-            #line 22 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
-                                                                                  Write(Html.ValidationMessageFor(model => model.DocumentTemplate.Description));
+            #line 25 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+                                                                 Write(Html.ValidationMessageFor(model => model.Description));
 
             
             #line default
@@ -114,8 +132,8 @@ WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>
 WriteLiteral("                    ");
 
             
-            #line 30 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
-               Write(Html.DropDownListFor(model => model.DocumentTemplate.Scope, Model.Scopes.ToSelectListItems(null)));
+            #line 33 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+               Write(Html.DropDownListFor(model => model.Scope, Model.Scopes.ToSelectListItems(null)));
 
             
             #line default
@@ -133,7 +151,7 @@ WriteLiteral(" accept=\".pdf\"");
 WriteLiteral(" /><br />");
 
             
-            #line 38 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+            #line 41 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
                                                                         Write(Html.ValidationMessage("Template"));
 
             
@@ -156,7 +174,7 @@ WriteLiteral(">\r\n");
 WriteLiteral("                    ");
 
             
-            #line 46 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+            #line 49 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
                Write(CommonHelpers.CheckBoxList("Types", Model.JobTypes.ToSelectListItems(Model.Types), 2));
 
             
@@ -165,13 +183,13 @@ WriteLiteral("                    ");
 WriteLiteral("\r\n                </td>\r\n            </tr>\r\n");
 
             
-            #line 49 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+            #line 52 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
             
             
             #line default
             #line hidden
             
-            #line 49 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+            #line 52 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
              foreach (var jt in Model.JobTypes)
             {
 
@@ -180,15 +198,15 @@ WriteLiteral("\r\n                </td>\r\n            </tr>\r\n");
             #line hidden
 WriteLiteral("                <tr");
 
-WriteAttribute("id", Tuple.Create(" id=\"", 2046), Tuple.Create("\"", 2071)
-, Tuple.Create(Tuple.Create("", 2051), Tuple.Create("trJobSubType", 2051), true)
+WriteAttribute("id", Tuple.Create(" id=\"", 2030), Tuple.Create("\"", 2055)
+, Tuple.Create(Tuple.Create("", 2035), Tuple.Create("trJobSubType", 2035), true)
             
-            #line 51 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
-, Tuple.Create(Tuple.Create("", 2063), Tuple.Create<System.Object, System.Int32>(jt.Id
+            #line 54 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+, Tuple.Create(Tuple.Create("", 2047), Tuple.Create<System.Object, System.Int32>(jt.Id
             
             #line default
             #line hidden
-, 2063), false)
+, 2047), false)
 );
 
 WriteLiteral(" class=\"jobSubTypes\"");
@@ -202,7 +220,7 @@ WriteLiteral(">\r\n");
 WriteLiteral("                        ");
 
             
-            #line 53 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+            #line 56 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
                    Write(jt.Description);
 
             
@@ -210,11 +228,11 @@ WriteLiteral("                        ");
             #line hidden
 WriteLiteral("<br />\r\n                        Sub Types<br />\r\n");
 
-WriteLiteral("                    ");
+WriteLiteral("                        ");
 
             
-            #line 55 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
-               Write(CommonHelpers.CheckboxBulkSelect(string.Format("CheckboxBulkSelect_{0}", jt.Id)));
+            #line 58 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+                   Write(CommonHelpers.CheckboxBulkSelect(string.Format("CheckboxBulkSelect_{0}", jt.Id)));
 
             
             #line default
@@ -228,16 +246,17 @@ WriteLiteral(">\r\n");
 WriteLiteral("                        ");
 
             
-            #line 58 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+            #line 61 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
                    Write(CommonHelpers.CheckBoxList("SubTypes", Model.JobSubTypes.Where(jst => jst.JobTypeId == jt.Id).ToList().ToSelectListItems(Model.SubTypes), 2));
 
             
             #line default
             #line hidden
-WriteLiteral("\r\n                    </td>\r\n                </tr>   \r\n");
+WriteLiteral("\r\n                    </td>\r\n                </tr>\r\n");
 
             
-            #line 61 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+            #line 64 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+
             }
 
             
@@ -265,7 +284,7 @@ WriteLiteral(@">
         $(function () {
             $('#Name').focus().select();
 
-            var $scope = $('#DocumentTemplate_Scope');
+            var $scope = $('#Scope');
             var $trJobTypes = $('#trJobTypes');
             var $jobTypes = $trJobTypes.find('input[type=""checkbox""]');
             $scope.change(scopeChange);
@@ -286,7 +305,7 @@ WriteLiteral(@">
             function jobTypesChange() {
                 $('.jobSubTypes').hide();
                 $jobTypes.filter(':checked').each(function () {
-                    $('#trJobSubType' + $(this).val()).show();    
+                    $('#trJobSubType' + $(this).val()).show();
                 });
             }
 
@@ -295,8 +314,9 @@ WriteLiteral(@">
 ");
 
             
-            #line 98 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+            #line 102 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
 }
+
             
             #line default
             #line hidden

Disco.Web/Areas/Config/Views/DocumentTemplate/CreatePackage.cshtml

@@ -1,25 +1,28 @@
 @model Disco.Web.Areas.Config.Models.DocumentTemplate.CreatePackageModel
 @{
     Authorization.RequireAll(Claims.Config.DocumentTemplate.Create, Claims.Config.DocumentTemplate.Configure);
-    
+
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Document Templates", MVC.Config.DocumentTemplate.Index(null), "Create Package");
 }
 @using (Html.BeginForm(MVC.Config.DocumentTemplate.CreatePackage()))
-{ 
+{
+    @Html.AntiForgeryToken()
     <div class="form" style="width: 650px">
         <table>
             <tr>
                 <th>
                     Id:
                 </th>
-                <td>@Html.TextBoxFor(model => model.Package.Id)<br />@Html.ValidationMessageFor(model => model.Package.Id)
+                <td>
+                    @Html.TextBoxFor(model => model.Id)<br />@Html.ValidationMessageFor(model => model.Id)
                 </td>
             </tr>
             <tr>
                 <th>
                     Description:
                 </th>
-                <td>@Html.TextBoxFor(model => model.Package.Description)<br />@Html.ValidationMessageFor(model => model.Package.Description)
+                <td>
+                    @Html.TextBoxFor(model => model.Description)<br />@Html.ValidationMessageFor(model => model.Description)
                 </td>
             </tr>
             <tr>
@@ -27,7 +30,7 @@
                     Scope:
                 </th>
                 <td>
-                    @Html.DropDownListFor(model => model.Package.Scope, Model.Scopes.ToSelectListItems(null))
+                    @Html.DropDownListFor(model => model.Scope, Model.Scopes.ToSelectListItems(null))
                 </td>
             </tr>
         </table>

Disco.Web/Areas/Config/Views/DocumentTemplate/CreatePackage.generated.cs

@@ -47,7 +47,7 @@ namespace Disco.Web.Areas.Config.Views.DocumentTemplate
             #line 2 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
   
     Authorization.RequireAll(Claims.Config.DocumentTemplate.Create, Claims.Config.DocumentTemplate.Configure);
-    
+
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Document Templates", MVC.Config.DocumentTemplate.Index(null), "Create Package");
 
             
@@ -58,7 +58,21 @@ WriteLiteral("\r\n");
             
             #line 7 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
  using (Html.BeginForm(MVC.Config.DocumentTemplate.CreatePackage()))
-{ 
+{
+    
+            
+            #line default
+            #line hidden
+            
+            #line 9 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
+Write(Html.AntiForgeryToken());
+
+            
+            #line default
+            #line hidden
+            
+            #line 9 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
+                            
 
             
             #line default
@@ -70,11 +84,13 @@ WriteLiteral(" class=\"form\"");
 WriteLiteral(" style=\"width: 650px\"");
 
 WriteLiteral(">\r\n        <table>\r\n            <tr>\r\n                <th>\r\n                    I" +
-"d:\r\n                </th>\r\n                <td>");
+"d:\r\n                </th>\r\n                <td>\r\n");
+
+WriteLiteral("                    ");
 
             
-            #line 15 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
-               Write(Html.TextBoxFor(model => model.Package.Id));
+            #line 17 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
+               Write(Html.TextBoxFor(model => model.Id));
 
             
             #line default
@@ -82,19 +98,21 @@ WriteLiteral(">\r\n        <table>\r\n            <tr>\r\n                <th>\r
 WriteLiteral("<br />");
 
             
-            #line 15 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
-                                                                Write(Html.ValidationMessageFor(model => model.Package.Id));
+            #line 17 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
+                                                        Write(Html.ValidationMessageFor(model => model.Id));
 
             
             #line default
             #line hidden
 WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>\r\n                <th" +
 ">\r\n                    Description:\r\n                </th>\r\n                <td>" +
-"");
+"\r\n");
+
+WriteLiteral("                    ");
 
             
-            #line 22 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
-               Write(Html.TextBoxFor(model => model.Package.Description));
+            #line 25 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
+               Write(Html.TextBoxFor(model => model.Description));
 
             
             #line default
@@ -102,8 +120,8 @@ WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>
 WriteLiteral("<br />");
 
             
-            #line 22 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
-                                                                         Write(Html.ValidationMessageFor(model => model.Package.Description));
+            #line 25 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
+                                                                 Write(Html.ValidationMessageFor(model => model.Description));
 
             
             #line default
@@ -114,8 +132,8 @@ WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>
 WriteLiteral("                    ");
 
             
-            #line 30 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
-               Write(Html.DropDownListFor(model => model.Package.Scope, Model.Scopes.ToSelectListItems(null)));
+            #line 33 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
+               Write(Html.DropDownListFor(model => model.Scope, Model.Scopes.ToSelectListItems(null)));
 
             
             #line default
@@ -135,7 +153,7 @@ WriteLiteral(" value=\"Create\"");
 WriteLiteral(" />\r\n        </p>\r\n    </div>\r\n");
 
             
-            #line 38 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
+            #line 41 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
 }
             
             #line default

Disco.Web/Areas/Config/Views/DocumentTemplate/ImportStatus.cshtml

@@ -9,7 +9,6 @@
     Documents Imported Today
 </h2>
 <div id="importStatus">
-    @Html.AntiForgeryToken()
     <div id="noSessions" data-bind="visible: noSessions">
         <h3>No imported documents today</h3>
     </div>
@@ -285,7 +284,7 @@
                 End: null,
                 ModuleId: 40,
                 Take: 2000,
-                '__RequestVerificationToken': host.find('input[name="__RequestVerificationToken"]').val()
+                '__RequestVerificationToken': document.body.dataset.antiforgery
             };
             $.ajax({
                 url: '@(Url.Action(MVC.API.Logging.RetrieveEvents()))',

Disco.Web/Areas/Config/Views/DocumentTemplate/ImportStatus.generated.cs

@@ -59,18 +59,7 @@ WriteLiteral("\r\n<h2>\r\n    Documents Imported Today\r\n</h2>\r\n<div");
 
 WriteLiteral(" id=\"importStatus\"");
 
-WriteLiteral(">\r\n");
-
-WriteLiteral("    ");
-
-            
-            #line 12 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
-Write(Html.AntiForgeryToken());
-
-            
-            #line default
-            #line hidden
-WriteLiteral("\r\n    <div");
+WriteLiteral(">\r\n    <div");
 
 WriteLiteral(" id=\"noSessions\"");
 
@@ -289,7 +278,7 @@ WriteLiteral(">\r\n    $(function () {\r\n        var vm;\r\n        var host =
 "var urlDeviceShow = \'");
 
             
-            #line 107 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
+            #line 106 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
                          Write(Url.Action(MVC.Device.Show()));
 
             
@@ -298,7 +287,7 @@ WriteLiteral(">\r\n    $(function () {\r\n        var vm;\r\n        var host =
 WriteLiteral("/\'\r\n        var urlJobShow = \'");
 
             
-            #line 108 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
+            #line 107 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
                       Write(Url.Action(MVC.Job.Show()));
 
             
@@ -307,7 +296,7 @@ WriteLiteral("/\'\r\n        var urlJobShow = \'");
 WriteLiteral("/\'\r\n        var urlUserShow = \'");
 
             
-            #line 109 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
+            #line 108 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
                        Write(Url.Action(MVC.User.Show()));
 
             
@@ -316,7 +305,7 @@ WriteLiteral("/\'\r\n        var urlUserShow = \'");
 WriteLiteral("/\'\r\n        var urlPageThumbnail = \'");
 
             
-            #line 110 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
+            #line 109 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
                             Write(Url.Action(MVC.API.DocumentTemplate.ImporterThumbnail()));
 
             
@@ -325,7 +314,7 @@ WriteLiteral("/\'\r\n        var urlPageThumbnail = \'");
 WriteLiteral("/\'\r\n        var urlDocumentTemplate = \'");
 
             
-            #line 111 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
+            #line 110 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
                                Write(Url.Action(MVC.Config.DocumentTemplate.Index()));
 
             
@@ -334,7 +323,7 @@ WriteLiteral("/\'\r\n        var urlDocumentTemplate = \'");
 WriteLiteral("/\';\r\n        var urlManuallyAssign = \'");
 
             
-            #line 112 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
+            #line 111 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
                              Write(Url.Action(MVC.Config.DocumentTemplate.UndetectedPages()));
 
             
@@ -442,11 +431,11 @@ WriteLiteral("\';\r\n        var isLive = false;\r\n\r\n        function pageVie
 "ar loadData = {\r\n                Format: \"json\",\r\n                Start: d.getFu" +
 "llYear() + \'-\' + (d.getMonth() + 1) + \'-\' + d.getDate(),\r\n                End: n" +
 "ull,\r\n                ModuleId: 40,\r\n                Take: 2000,\r\n              " +
-"  \'__RequestVerificationToken\': host.find(\'input[name=\"__RequestVerificationToke" +
-"n\"]\').val()\r\n            };\r\n            $.ajax({\r\n                url: \'");
+"  \'__RequestVerificationToken\': document.body.dataset.antiforgery\r\n            }" +
+";\r\n            $.ajax({\r\n                url: \'");
 
             
-            #line 291 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
+            #line 290 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
                   Write(Url.Action(MVC.API.Logging.RetrieveEvents()));
 
             
@@ -478,7 +467,7 @@ WriteLiteral(@"',
             $.connection.hub.qs = { LogModules: '");
 
             
-            #line 314 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
+            #line 313 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
                                              Write(Disco.Services.Documents.DocumentsLog.Current.LiveLogGroupName);
 
             

Disco.Web/Areas/Config/Views/DocumentTemplate/Show.cshtml

@@ -152,6 +152,7 @@
                             <div id="Config_DocumentTemplates_Scope_Dialog" title="Change Document Template Scope" class="dialog">
                                 @using (Html.BeginForm(MVC.API.DocumentTemplate.UpdateScope(Model.DocumentTemplate.Id, redirect: true)))
                                 {
+                                    @Html.AntiForgeryToken()
                                     <div class="input">
                                         <label for="Config_DocumentTemplates_Scope_Scope">Scope: </label>
                                         <select id="Config_DocumentTemplates_Scope_Scope" name="Scope">
@@ -178,10 +179,9 @@
                             </div>
                             <script type="text/javascript">
                                 $(function () {
-                                    var dialog;
-
-                                    function showDialog() {
-                                        if (dialog == null) {
+                                    let dialog = null;
+                                    $('#Config_DocumentTemplates_Scope_Button').on('click', function () {
+                                        if (!dialog) {
                                             dialog = $('#Config_DocumentTemplates_Scope_Dialog').dialog({
                                                 width: 400,
                                                 resizable: false,
@@ -189,23 +189,19 @@
                                                 autoOpen: false,
                                                 buttons: {
                                                     'Save Changes': function () {
-                                                        dialog.dialog('option', 'buttons', null);
-                                                        dialog.dialog('disable');
-                                                        $('#Config_DocumentTemplates_Scope_Scope').closest('form').submit();
+                                                        $(this)
+                                                            .dialog('option', 'buttons', null)
+                                                            .find('form').submit();
                                                     },
                                                     'Cancel': function () {
-                                                        dialog.dialog('close');
+                                                        $(this).dialog('close');
                                                     }
                                                 }
                                             });
                                         }
 
                                         dialog.dialog('open');
-
-                                        return false;
-                                    }
-
-                                    $('#Config_DocumentTemplates_Scope_Button').click(showDialog);
+                                    });
                                 });
                             </script>
                         }
@@ -250,6 +246,7 @@
                                     <div id="Config_DocumentTemplates_JobSubTypes_Update_Dialog" class="dialog" title="Job Type Filter">
                                         @using (Html.BeginForm(MVC.API.DocumentTemplate.UpdateJobSubTypes(Model.DocumentTemplate.Id, null, true)))
                                         {
+                                            @Html.AntiForgeryToken()
                                             var selectedTypes = Model.DocumentTemplate.JobSubTypes.Select(jst => jst.JobType).Distinct().ToList();
                                             foreach (var jt in Model.JobTypes)
                                             {
@@ -266,10 +263,9 @@
                                         }
                                     </div>
                                     <script>
-                                        (function () {
-                                            var dialog;
-
-                                            function showDialog() {
+                                        $(function () {
+                                            let dialog = null;
+                                            $('#Config_DocumentTemplates_JobSubTypes_Update').on('click', function () {
                                                 if (!dialog) {
                                                     dialog = $('#Config_DocumentTemplates_JobSubTypes_Update_Dialog').dialog({
                                                         resizable: false,
@@ -278,8 +274,19 @@
                                                         width: 750,
                                                         height: 580,
                                                         buttons: {
-                                                            "Save Changes": saveChanges,
-                                                            Cancel: cancel
+                                                            "Save Changes": function () {
+                                                                var form = dialog.find('form');
+                                                                $('input.jobType:unchecked').each(function () {
+                                                                    $('#SubTypes_' + $(this).val()).find('input').prop('checked', false);
+                                                                });
+                                                                form.trigger('submit');
+                                                                dialog.dialog("option", "buttons", null);
+                                                            },
+                                                            Cancel: function () {
+                                                                dialog.dialog("option", "buttons", null);
+                                                                // refresh Page
+                                                                window.location.reload(true);
+                                                            }
                                                         }
                                                     });
 
@@ -296,36 +303,8 @@
                                                 }
 
                                                 dialog.dialog('open');
-
-                                                return false;
-                                            }
-
-                                            function cancel() {
-                                                dialog.dialog("disable");
-                                                dialog.dialog("option", "buttons", null);
-
-                                                // Refresh Page
-                                                window.location.reload(true);
-                                            }
-
-                                            function saveChanges() {
-                                                var form = dialog.find('form');
-
-                                                $('input.jobType:unchecked').each(function () {
-                                                    $('#SubTypes_' + $(this).val()).find('input').prop('checked', false);
-                                                });
-
-                                                form.submit();
-
-                                                dialog.dialog("disable");
-                                                dialog.dialog("option", "buttons", null);
-                                            }
-
-                                            $(function () {
-                                                $('#Config_DocumentTemplates_JobSubTypes_Update').click(showDialog);
                                             });
-
-                                        })();
+                                        });
                                     </script>
                                 }
                             </div>
@@ -413,6 +392,7 @@
                                         <div>
                                             @using (Html.BeginForm(MVC.API.DocumentTemplate.Template(Model.DocumentTemplate.Id, true, null), FormMethod.Post, new { enctype = "multipart/form-data" }))
                                             {
+                                                @Html.AntiForgeryToken()
                                                 <input type="file" name="Template" id="Config_DocumentTemplates_TemplatePdf_Template" accept=".pdf" style="width: 250px;" />
                                             }
                                         </div>
@@ -737,7 +717,7 @@
                                 @Html.Hidden("ruleId", "")
                             }
                             <a id="DocumentTemplate_OnImportUserFlagRules_AddButton" href="#" class="button small">Add User Flag Rule</a>
-                            <div id="DocumentTemplate_OnImportUserFlagRules_AddDialog" class="hiddenDialog" title="On Import User Flag Rule: @(Model.DocumentTemplate.Id)">
+                            <div id="DocumentTemplate_OnImportUserFlagRules_AddDialog" class="dialog" title="On Import User Flag Rule: @(Model.DocumentTemplate.Id)">
                                 <div class="brief">
                                     @switch (Model.DocumentTemplate.Scope)
                                     {
@@ -758,7 +738,7 @@
                                             break;
                                     }
                                 </div>
-                                @using (Html.BeginForm(MVC.API.DocumentTemplate.AddOnImportUserFlagRule(Model.DocumentTemplate.Id), FormMethod.Post))
+                                @using (Html.BeginForm(MVC.API.DocumentTemplate.AddOnImportUserFlagRule(Model.DocumentTemplate.Id)))
                                 {
                                     @Html.AntiForgeryToken()
                                     <div class="distribute-evenly">
@@ -878,7 +858,7 @@
                                                             rulesTable.find('tbody').append(row);
 
                                                             rulesTable.find('tbody').find('tr').first().addClass('hidden');
-                                                            
+
                                                             dialog.dialog("close");
                                                         })
                                                         .catch(e => {
@@ -997,6 +977,10 @@
             </div>
         </div>
         <div id="dialogConfirmDelete" title="Delete this Document Template?" class="dialog">
+            @using (Html.BeginForm(MVC.API.DocumentTemplate.Delete(Model.DocumentTemplate.Id, true)))
+            {
+                @Html.AntiForgeryToken()
+            }
             <p>
                 <i class="fa fa-exclamation-triangle fa-lg warning"></i>This item will be permanently deleted and cannot be recovered.<br />
                 <em>
@@ -1008,31 +992,28 @@
         </div>
         <script type="text/javascript">
             $(function () {
-                var button = $('#buttonDelete');
-                var buttonDialog = $("#dialogConfirmDelete");
-                var buttonLink = button.attr('href');
-                button.attr('href', '#');
+                const button = $('#buttonDelete');
+                let buttonDialog = null;
                 button.click(function () {
-                    buttonDialog.dialog('open');
-                    return false;
-                });
-                buttonDialog.dialog({
-                    resizable: false,
-                    modal: true,
-                    autoOpen: false,
-                    buttons: {
-                        "Delete": function () {
-                            $this = $(this);
-                            $this.dialog('disable');
-                            $this.dialog("option", "buttons", null);
-                            window.location.href = buttonLink;
-                        },
-                        Cancel: function () {
-                            $(this).dialog("close");
-                        }
+                    if (!buttonDialog) {
+                        buttonDialog = $("#dialogConfirmDelete").dialog({
+                            resizable: false,
+                            modal: true,
+                            autoOpen: false,
+                            buttons: {
+                                "Delete": function () {
+                                    $(this)
+                                        .dialog("option", "buttons", null)
+                                        .find('form').trigger('submit');
+                                },
+                                Cancel: function () {
+                                    $(this).dialog("close");
+                                }
+                            }
+                        });
                     }
+                    buttonDialog.dialog('open');
                 });
-
             });
         </script>
         <div class="actionBar">
@@ -1065,7 +1046,7 @@
                 else
                 {
                     <a id="buttonBulkGenerate" href="#" class="button">Bulk Generate</a>
-                    <div id="dialogBulkGenerate" class="hiddenDialog dialog-bulk-generate" title="Bulk Generate: @(Model.DocumentTemplate.Id)">
+                    <div id="dialogBulkGenerate" class="dialog dialog-bulk-generate" title="Bulk Generate: @(Model.DocumentTemplate.Id)">
                         <div class="brief">
                             @switch (Model.DocumentTemplate.Scope)
                             {
@@ -1101,8 +1082,9 @@
                                     break;
                             }
                         </div>
-                        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerate(Model.DocumentTemplate.Id), FormMethod.Post))
+                        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerate(Model.DocumentTemplate.Id)))
                         {
+                            @Html.AntiForgeryToken()
                             <div class="field-validation-valid" data-valmsg-replace="true" data-valmsg-for="DataIds"></div>
                             <textarea id="inputBulkGenerateDataIds" name="DataIds" data-val="true" data-val-required="Identifiers are required"></textarea>
                             if (Model.TemplatePageCount > 1 && Model.TemplatePageCount % 2 != 0)
@@ -1127,8 +1109,7 @@
                                         width: 460,
                                         buttons: {
                                             "Bulk Generate": function () {
-                                                dialog.find('form').submit();
-                                                dialog.dialog("disable");
+                                                $(this).find('form').trigger('submit');
                                             },
                                             Close: function () {
                                                 $(this).dialog("close");
@@ -1148,13 +1129,13 @@
             }
             @if (Authorization.Has(Claims.Config.DocumentTemplate.Delete))
             {
-                @Html.ActionLinkButton("Delete", MVC.API.DocumentTemplate.Delete(Model.DocumentTemplate.Id, true), "buttonDelete")
+                <button id="buttonDelete" type="button" class="button">Delete</button>
             }
         </div>
-        @if (!string.IsNullOrWhiteSpace(Model.BulkGenerateDownloadId))
+        @if (Model.BulkGenerateDownloadId.HasValue)
         {
             <div id="Config_DocumentTemplates_Show_DownloadBulk_Dialog" class="dialog" title="Download Bulk Documents">
-                <a href="@Url.Action(MVC.API.DocumentTemplate.BulkGenerateDownload(Model.BulkGenerateDownloadId, Model.BulkGenerateDownloadFilename))" class="button"><i class="fa fa-download fa-lg"></i>Download Bulk Documents</a>
+                <a href="@Url.Action(MVC.API.DocumentTemplate.BulkGenerateDownload(Model.BulkGenerateDownloadId.Value, Model.BulkGenerateDownloadFilename))" class="button"><i class="fa fa-download fa-lg"></i>Download Bulk Documents</a>
             </div>
             <script>
                 $(function () {

Disco.Web/Areas/Config/Views/DocumentTemplate/ShowPackage.cshtml

@@ -169,29 +169,30 @@
                         </div>
                         @if (canConfig)
                         {
-                        <div id="Config_DocumentTemplatePackages_Scope_Dialog" title="Change Document Template Package Scope" class="dialog">
-                            @using (Html.BeginForm(MVC.API.DocumentTemplatePackage.UpdateScope(Model.Package.Id, redirect: true)))
+                            <div id="Config_DocumentTemplatePackages_Scope_Dialog" title="Change Document Template Package Scope" class="dialog">
+                                @using (Html.BeginForm(MVC.API.DocumentTemplatePackage.UpdateScope(Model.Package.Id, redirect: true)))
                                 {
-                                <div class="input">
-                                    <label for="Config_DocumentTemplatePackages_Scope_Scope">Scope: </label>
-                                    <select id="Config_DocumentTemplatePackages_Scope_Scope" name="Scope">
-                                        @foreach (var scope in Model.Scopes)
+                                    @Html.AntiForgeryToken()
+                                    <div class="input">
+                                        <label for="Config_DocumentTemplatePackages_Scope_Scope">Scope: </label>
+                                        <select id="Config_DocumentTemplatePackages_Scope_Scope" name="Scope">
+                                            @foreach (var scope in Model.Scopes)
                                             {
-                                            <option value="@scope" selected="@(scope == Model.Package.Scope.ToString() ? " selected" : null)">@scope</option>
+                                                <option value="@scope" selected="@(scope == Model.Package.Scope.ToString() ? " selected" : null)">@scope</option>
                                             }
-                                    </select>
-                                </div>
+                                        </select>
+                                    </div>
                                 }
-                            @if (Model.Package.DocumentTemplateIds != null && Model.Package.DocumentTemplateIds.Count > 0)
+                                @if (Model.Package.DocumentTemplateIds != null && Model.Package.DocumentTemplateIds.Count > 0)
                                 {
-                                <div class="info-box">
-                                    <p class="fa-p">
-                                        <i class="fa fa-info-circle"></i>If changed, all Document Templates will be unassociated with this Package.
-                                    </p>
-                                </div>
+                                    <div class="info-box">
+                                        <p class="fa-p">
+                                            <i class="fa fa-info-circle"></i>If changed, all Document Templates will be unassociated with this Package.
+                                        </p>
+                                    </div>
                                 }
-                        </div>
-                        <script type="text/javascript">
+                            </div>
+                            <script type="text/javascript">
                                 $(function () {
                                     var dialog;
 
@@ -204,12 +205,12 @@
                                                 autoOpen: false,
                                                 buttons: {
                                                     'Save Changes': function () {
-                                                        dialog.dialog('option', 'buttons', null);
-                                                        dialog.dialog('disable');
-                                                        $('#Config_DocumentTemplatePackages_Scope_Scope').closest('form').submit();
+                                                        $(this)
+                                                            .dialog('option', 'buttons', null)
+                                                            .find('form').trigger('submit');
                                                     },
                                                     'Cancel': function () {
-                                                        dialog.dialog('close');
+                                                        $(this).dialog('close');
                                                     }
                                                 }
                                             });
@@ -222,65 +223,66 @@
 
                                     $('#Config_DocumentTemplatePackages_Scope_Button').click(showDialog);
                                 });
-                        </script>
+                            </script>
                         }
                         @if (Model.Package.Scope == AttachmentTypes.Job)
                         {
-                        <hr />
-                        <h4>Job Type Filters:</h4>
-                        <div id="Config_DocumentTemplatePackages_JobSubTypes">
-                            <div>
-                                @if (Model.Package.JobSubTypes != null && Model.Package.JobSubTypes.Count > 0)
+                            <hr />
+                            <h4>Job Type Filters:</h4>
+                            <div id="Config_DocumentTemplatePackages_JobSubTypes">
+                                <div>
+                                    @if (Model.Package.JobSubTypes != null && Model.Package.JobSubTypes.Count > 0)
                                     {
-                                    <ul>
-                                        @foreach (var jobType in Model.JobSubTypesSelected.GroupBy(jst => jst.JobType).OrderBy(jtg => jtg.Key.Description))
+                                        <ul>
+                                            @foreach (var jobType in Model.JobSubTypesSelected.GroupBy(jst => jst.JobType).OrderBy(jtg => jtg.Key.Description))
                                             {
-                                            <li>
-                                                @jobType.Key.Description
-                                                <ul>
-                                                    @if (jobType.Count() == Model.JobTypes.FirstOrDefault(jt => jt.Id == jobType.Key.Id).JobSubTypes.Count)
+                                                <li>
+                                                    @jobType.Key.Description
+                                                    <ul>
+                                                        @if (jobType.Count() == Model.JobTypes.FirstOrDefault(jt => jt.Id == jobType.Key.Id).JobSubTypes.Count)
                                                         {
-                                                        <li><span class="smallMessage">[All Sub Types]</span></li>
+                                                            <li><span class="smallMessage">[All Sub Types]</span></li>
                                                         }
                                                         else
                                                         {
                                                             foreach (var jobSubType in jobType)
                                                             {
-                                                        <li>@jobSubType.Description</li>
+                                                                <li>@jobSubType.Description</li>
                                                             }
                                                         }
-                                                </ul>
-                                            </li>
+                                                    </ul>
+                                                </li>
                                             }
-                                    </ul>
+                                        </ul>
                                     }
                                     else
                                     {
-                                    <span class="smallMessage">&lt;No Filter&gt;</span>
+                                        <span class="smallMessage">&lt;No Filter&gt;</span>
                                     }
-                            </div>
-                            @if (canConfig)
+                                </div>
+                                @if (canConfig)
                                 {
-                                <a id="Config_DocumentTemplatePackages_JobSubTypes_Update" href="#" class="button small">Update</a>
-                                <div id="Config_DocumentTemplatePackages_JobSubTypes_Update_Dialog" class="dialog" title="Job Type Filter">
-                                    @using (Html.BeginForm(MVC.API.DocumentTemplatePackage.UpdateJobSubTypes(Model.Package.Id, null, true)))
+                                    <a id="Config_DocumentTemplatePackages_JobSubTypes_Update" href="#" class="button small">Update</a>
+                                    <div id="Config_DocumentTemplatePackages_JobSubTypes_Update_Dialog" class="dialog" title="Job Type Filter">
+                                        @using (Html.BeginForm(MVC.API.DocumentTemplatePackage.UpdateJobSubTypes(Model.Package.Id, null, true)))
                                         {
+                                            @Html.AntiForgeryToken()
                                             var selectedTypes = Model.JobSubTypesSelected.Select(jst => jst.JobType).Distinct().ToList();
                                             foreach (var jt in Model.JobTypes)
                                             {
-                                        <div class="jobTypes">
-                                            <h4>
-                                                <input id="Types_@(jt.Id)" class="jobType" type="checkbox" value="@(jt.Id)" @(selectedTypes.Contains(jt) ? "checked=\" checked\"" : null) /><label for="Types_@(jt.Id)">@jt.Description</label>
-                                            </h4>
-                                            <div id="SubTypes_@(jt.Id)" class="jobSubTypes">
-                                                @CommonHelpers.CheckboxBulkSelect(string.Format("CheckboxBulkSelect_{0}", jt.Id), "div")
-                                                @CommonHelpers.CheckBoxList("JobSubTypes", jt.JobSubTypes.OrderBy(jst => jst.Description).ToSelectListItems(Model.Package.JobSubTypes), 2)
-                                            </div>
-                                        </div>
+                                                <div class="jobTypes">
+                                                    <h4>
+                                                        <input id="Types_@(jt.Id)" class="jobType" type="checkbox" value="@(jt.Id)" @(selectedTypes.Contains(jt) ? "checked=\" checked\"" : null) /><label for="Types_@(jt.Id)">@jt.Description</label>
+                                                    </h4>
+                                                    <div id="SubTypes_@(jt.Id)" class="jobSubTypes">
+                                                        @CommonHelpers.CheckboxBulkSelect(string.Format("CheckboxBulkSelect_{0}", jt.Id), "div")
+                                                        @CommonHelpers.CheckBoxList("JobSubTypes", jt.JobSubTypes.OrderBy(jst => jst.Description).ToSelectListItems(Model.Package.JobSubTypes), 2)
+                                                    </div>
+                                                </div>
                                             }
                                         }
-                                </div>
-                                <script>
+                                    </div>
+                                    <script>
                                         (function () {
                                             var dialog;
 
@@ -316,10 +318,7 @@
                                             }
 
                                             function cancel() {
-                                                dialog.dialog("disable");
                                                 dialog.dialog("option", "buttons", null);
-
-                                                // Refresh Page
                                                 window.location.reload(true);
                                             }
 
@@ -330,9 +329,7 @@
                                                     $('#SubTypes_' + $(this).val()).find('input').prop('checked', false);
                                                 });
 
-                                                form.submit();
-
-                                                dialog.dialog("disable");
+                                                form.trigger('submit');
                                                 dialog.dialog("option", "buttons", null);
                                             }
 
@@ -341,9 +338,9 @@
                                             });
 
                                         })();
-                                </script>
+                                    </script>
                                 }
-                        </div>
+                            </div>
                         }
                     </td>
                 </tr>
@@ -388,6 +385,7 @@
                                     <h3>Package Templates</h3>
                                     @using (Html.BeginForm(MVC.API.DocumentTemplatePackage.UpdateDocumentTemplates(Model.Package.Id, redirect: true)))
                                     {
+                                        @Html.AntiForgeryToken()
                                         <ol class="templates_connected none">
                                             @foreach (var template in Model.DocumentTemplatesSelected)
                                             {
@@ -437,7 +435,6 @@
                                                         var $form = dialog.find('form');
                                                         if ($form.find('input').length > 0) {
                                                             dialog.dialog('option', 'buttons', null);
-                                                            dialog.dialog('disable');
                                                             $form.submit();
                                                         } else {
                                                             alert('The package templates must include at least one document template');
@@ -618,7 +615,11 @@
         </table>
     </div>
 </div>
-<div id="dialogConfirmDelete" title="Delete this Document Template?">
+<div id="dialogConfirmDelete" class="dialog" title="Delete this Document Template?">
+    @using (Html.BeginForm(MVC.API.DocumentTemplatePackage.Delete(Model.Package.Id, true)))
+    {
+        @Html.AntiForgeryToken()
+    }
     <p>
         <i class="fa fa-exclamation-triangle fa-lg warning"></i>This item will be permanently deleted.<br />
         Are you sure?
@@ -626,31 +627,29 @@
 </div>
 <script type="text/javascript">
     $(function () {
-        var button = $('#buttonDelete');
-        var buttonDialog = $("#dialogConfirmDelete");
-        var buttonLink = button.attr('href');
-        button.attr('href', '#');
-        button.click(function () {
+        const button = $('#buttonDelete');
+        let buttonDialog = null;
+        button.on('click', function () {
+            if (!buttonDialog) {
+                buttonDialog = $("#dialogConfirmDelete").dialog({
+                    resizable: false,
+                    modal: true,
+                    autoOpen: false,
+                    buttons: {
+                        "Delete": function () {
+                            $(this)
+                                .dialog("option", "buttons", null)
+                                .find('form').trigger('submit');
+                        },
+                        Cancel: function () {
+                            $(this).dialog("close");
+                        }
+                    }
+                });
+            }
             buttonDialog.dialog('open');
             return false;
         });
-        buttonDialog.dialog({
-            resizable: false,
-            modal: true,
-            autoOpen: false,
-            buttons: {
-                "Delete": function () {
-                    $this = $(this);
-                    $this.dialog('disable');
-                    $this.dialog("option", "buttons", null);
-                    window.location.href = buttonLink;
-                },
-                Cancel: function () {
-                    $(this).dialog("close");
-                }
-            }
-        });
-
     });
 </script>
 <div class="actionBar">
@@ -668,8 +667,8 @@
     }
     @if (canBulkGenerate)
     {
-        <a id="buttonBulkGenerate" href="#" class="button">Bulk Generate</a>
-        <div id="dialogBulkGenerate" class="hiddenDialog" title="Bulk Generate: @(Model.Package.Id)">
+        <button id="buttonBulkGenerate" type="button" class="button">Bulk Generate</button>
+        <div id="dialogBulkGenerate" class="dialog dialog-bulk-generate" title="Bulk Generate: @(Model.Package.Id)">
             <div class="brief">
                 @switch (Model.Package.Scope)
                 {
@@ -702,8 +701,8 @@
                             <div class="example2 code">86,99,44</div>
                             <div class="example3 code">86;99;44</div>
                         </div>
-                            break;
-                        case AttachmentTypes.User:
+                        break;
+                    case AttachmentTypes.User:
                         <div>
                             Enter multiple <span class="scopeDescBulkGenerate">User Ids</span> separated by <code>&lt;new line&gt;</code>, commas (<code>,</code>) or semicolons (<code>;</code>).
                         </div>
@@ -719,21 +718,18 @@
                         break;
                 }
             </div>
-            @using (Html.BeginForm(MVC.API.DocumentTemplatePackage.BulkGenerate(Model.Package.Id), FormMethod.Post))
+            @using (Html.BeginForm(MVC.API.DocumentTemplatePackage.BulkGenerate(Model.Package.Id)))
             {
-                <div class="field-validation-valid" data-valmsg-replace="true" data-valmsg-for="DataIds"></div>
-                <textarea id="inputBulkGenerateDataIds" name="DataIds" data-val="true" data-val-required="Identifiers are required"></textarea>
-                <div style="margin-top: 6px;">
-                    <input id="inputBulkGenerateInsertBlankPage" type="checkbox" name="InsertBlankPage" value="True" /><label for="inputBulkGenerateInsertBlankPage">Insert Blank Pages for Double-Sided Printing</label>
-                </div>
+                @Html.AntiForgeryToken()
+                <div class="field-validation-valid" data-valmsg-replace="true" data-valmsg-for="dataIds"></div>
+                <textarea id="inputBulkGenerateDataIds" name="dataIds" data-val="true" data-val-required="Identifiers are required"></textarea>
             }
         </div>
 
         <script>
             $(function () {
-                var dialog;
-
-                $('#buttonBulkGenerate').click(function () {
+                let dialog = null;
+                $('#buttonBulkGenerate').on('click', function () {
                     if (!dialog) {
                         dialog = $('#dialogBulkGenerate').dialog({
                             resizable: false,
@@ -742,11 +738,10 @@
                             width: 460,
                             buttons: {
                                 "Bulk Generate": function () {
-                                    dialog.find('form').submit();
-                                    dialog.dialog("disable");
+                                    $(this).find('form').trigger('submit');
                                 },
                                 Close: function () {
-                                    $(this).dialog("close");
+                                    $(this).dialog('close');
                                 }
                             }
                         });
@@ -762,6 +757,6 @@
     }
     @if (Authorization.Has(Claims.Config.DocumentTemplate.Delete))
     {
-        @Html.ActionLinkButton("Delete", MVC.API.DocumentTemplatePackage.Delete(Model.Package.Id, true), "buttonDelete")
+        <button id="buttonDelete" type="button" class="button">Delete</button>
     }
 </div>

Disco.Web/Areas/Config/Views/DocumentTemplate/UndetectedPages.cshtml

@@ -6,7 +6,14 @@
     Html.BundleDeferred("~/ClientScripts/Modules/Knockout");
     Html.BundleDeferred("~/ClientScripts/Modules/jQuery-SignalR");
 }
-<div id="undetectedPagesContainer">
+<div id="undetectedPagesContainer"
+     data-urlundetectedfiles="@(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedFiles()))"
+     data-urlundetectedpagethumbnail="@(new HtmlString(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedFile(null, false, true))))"
+     data-urlundetectedpagepreview="@(new HtmlString(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedFile(null, false, false))))"
+     data-urlundetectedpagesource="@(new HtmlString(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedFile(null, true, false))))"
+     data-urldataidlookupservice="@(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedDataIdLookup()))/"
+     data-urlimporterundetectedassign="@(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedAssign()))/"
+     data-urlimporterundetecteddelete="@(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedDelete()))">
     <div id="noUndetectedPages" data-bind="visible: noUndetectedPages">
         <h3>No Undetected Pages</h3>
     </div>
@@ -27,8 +34,8 @@
     <div class="actions">
         Type: @Html.DropDownList("dialogDocumentTemplateId", Model.DocumentTemplatesSelectListItems, new Dictionary<string, object> { { "data-bind", "value: dialogTemplateId" } })
         Data:
-        <input id="dialogDataId" type="text" data-bind="value: dialogDataId, autocomplete: { source: dialogDataIdService, minLength: 3, position: { my: 'left bottom', at: 'left top' } }" />
-        <a href="#" class="button" id="dialogAssignButton" data-bind="click: assignPage">Assign</a>
+        <input id="dialogDataId" type="text" data-bind="value: dialogDataId, autocomplete: { source: dialogDataIdService, minLength: 2, position: { my: 'left bottom', at: 'left top' } }" />
+        <button type="button" class="button" id="dialogAssignButton" data-bind="click: assignPage">Assign</button>
     </div>
 </div>
 <div id="dialogRemove" title="Delete this Page?">
@@ -61,14 +68,16 @@
 <script type="text/javascript">
     $(function () {
 
-        var vm;
-        var urlUndetectedPageThumbnail = '@(new HtmlString(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedFile(null, false, true))))';
-        var urlUndetectedPagePreview = '@(new HtmlString(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedFile(null, false, false))))';
-        var urlUndetectedPageSource = '@(new HtmlString(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedFile(null, true, false))))';
-        var urlDataIdLookupService = '@(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedDataIdLookup()))/';
-        var urlImporterUndetectedAssign = '@(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedAssign()))/';
-        var urlImporterUndetectedDelete = '@(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedDelete()))/';
-        var $undetectedPageDialog = $('#undetectedPageDialog').dialog({
+        const vm = new pageViewModel();
+        const $undetectedPagesContainer = $(undetectedPagesContainer);
+        const urlUndetectedFiles = $undetectedPagesContainer.attr('data-urlundetectedfiles');
+        const urlUndetectedPageThumbnail = $undetectedPagesContainer.attr('data-urlundetectedpagethumbnail');
+        const urlUndetectedPagePreview = $undetectedPagesContainer.attr('data-urlundetectedpagepreview');
+        const urlUndetectedPageSource = $undetectedPagesContainer.attr('data-urlundetectedpagesource');
+        const urlDataIdLookupService = $undetectedPagesContainer.attr('data-urldataidlookupservice');
+        const urlImporterUndetectedAssign = $undetectedPagesContainer.attr('data-urlimporterundetectedassign');
+        const urlImporterUndetectedDelete = $undetectedPagesContainer.attr('data-urlimporterundetecteddelete');
+        const $undetectedPageDialog = $('#undetectedPageDialog').dialog({
             modal: true,
             width: 800,
             resizable: false,
@@ -134,31 +143,32 @@
                 return urlDataIdLookupService + self.dialogTemplateId();
             });
             self.deletePage = function () {
-                $undetectedPageDialog.dialog('option', 'disabled', true);
-
                 $dialogRemove.dialog('option', 'buttons', {
                     "Remove": function () {
                         $dialogRemove.dialog("close");
-                        var data = { id: self.id };
-                        $.ajax({
-                            url: urlImporterUndetectedDelete,
-                            dataType: 'json',
-                            data: data,
-                            type: 'POST',
-                            success: function (d) {
-                                if (d == 'OK') {
-                                    vm.selectNextPage();
-                                    vm.undetectedPages.remove(self);
-                                } else {
-                                    alert('Unable to delete page: ' + d);
+
+                        async function removeAsync() {
+
+                            const body = new FormData();
+                            body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                            body.append('id', self.id);
+
+                            try {
+                                const response = await fetch(urlImporterUndetectedDelete, {
+                                    method: 'POST',
+                                    body: body
+                                });
+                                if (!response.ok) {
+                                    alert('Unable to delete page: ' + response.statusText);
+                                    return;
                                 }
-                                $undetectedPageDialog.dialog('option', 'disabled', false);
-                            },
-                            error: function (jqXHR, textStatus, errorThrown) {
-                                alert('Unable to delete page: ' + errorThrown);
-                                $undetectedPageDialog.dialog('option', 'disabled', false);
+                                vm.selectNextPage();
+                                vm.undetectedPages.remove(self);
+                            } catch (e) {
+                                alert('Unable to delete page: ' + e);
                             }
-                        });
+                        }
+                        removeAsync(self.id);
                     },
                     "Cancel": function () {
                         $dialogRemove.dialog("close");
@@ -170,55 +180,52 @@
 
                 return false;
             }
-            self.assignPage = function () {
+            self.assignPage = async function () {
                 var dtId = self.dialogTemplateId();
                 var dId = self.dialogDataId();
                 if (!dtId || !dId) {
                     alert('Please specify a valid Document Type and Data Id');
                 } else {
-                    $undetectedPageDialog.dialog('option', 'disabled', true);
+                    const body = new FormData();
+                    body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                    body.append('id', self.id);
+                    body.append('documentTemplateId', dtId);
+                    body.append('dataId', dId);
 
-                    var data = { id: self.id, DocumentTemplateId: dtId, DataId: dId };
-
-                    $.ajax({
-                        url: urlImporterUndetectedAssign,
-                        dataType: 'json',
-                        data: data,
-                        type: 'POST',
-                        success: function (d) {
-                            if (d == 'OK') {
-                                vm.selectNextPage();
-                                vm.undetectedPages.remove(self);
-                            } else {
-                                alert('Unable to assign page: ' + d);
-                            }
-                            $undetectedPageDialog.dialog('option', 'disabled', false);
-                        },
-                        error: function (jqXHR, textStatus, errorThrown) {
-                            alert('Unable to assign page: ' + errorThrown);
-                            $undetectedPageDialog.dialog('option', 'disabled', false);
+                    try {
+                        const response = await fetch(urlImporterUndetectedAssign, {
+                            method: 'POST',
+                            body: body
+                        });
+                        if (response.ok) {
+                            vm.selectNextPage();
+                            vm.undetectedPages.remove(self);
+                        } else {
+                            alert('Unable to assign page: ' + response.statusText);
                         }
-                    });
-
+                    } catch (e) {
+                        alert('Unable to assign page: ' + e);
+                    }
                 }
                 return false;
             };
         }
 
-        function init() {
-            vm = new pageViewModel();
-
-            $.ajax({
-                url: '@(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedFiles()))',
-                dataType: 'json',
-                type: 'POST',
-                success: init_loadedContent,
-                error: function (jqXHR, textStatus, errorThrown) {
-                    alert('Unable to load content: ' + errorThrown);
-                }
+        async function init() {
+            const body = new FormData();
+            body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+            const response = await fetch(urlUndetectedFiles, {
+                method: 'POST',
+                body: body
             });
-        }
-        function init_loadedContent(content) {
+
+            if (!response.ok) {
+                alert('Unable to load content: ' + response.statusText);
+                return;
+            }
+
+            const content = await response.json();
+
             if (content.length > 0) {
                 for (var i = 0; i < content.length; i++) {
                     var c = content[i];
@@ -228,9 +235,7 @@
             }
 
             ko.applyBindings(vm);
-            init_loadedOpen();
-        }
-        function init_loadedOpen() {
+
             var fileId = window.location.hash;
             if (fileId) {
                 fileId = fileId.substr(1);
@@ -243,7 +248,7 @@
                 }
             }
         }
-        init();
 
+        init();
     });
 </script>

Disco.Web/Areas/Config/Views/DocumentTemplate/UndetectedPages.generated.cs

@@ -59,6 +59,83 @@ WriteLiteral("\r\n<div");
 
 WriteLiteral(" id=\"undetectedPagesContainer\"");
 
+WriteLiteral("\r\n     data-urlundetectedfiles=\"");
+
+            
+            #line 10 "..\..\Areas\Config\Views\DocumentTemplate\UndetectedPages.cshtml"
+                          Write(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedFiles()));
+
+            
+            #line default
+            #line hidden
+WriteLiteral("\"");
+
+WriteLiteral("\r\n     data-urlundetectedpagethumbnail=\"");
+
+            
+            #line 11 "..\..\Areas\Config\Views\DocumentTemplate\UndetectedPages.cshtml"
+                                  Write(new HtmlString(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedFile(null, false, true))));
+
+            
+            #line default
+            #line hidden
+WriteLiteral("\"");
+
+WriteLiteral("\r\n     data-urlundetectedpagepreview=\"");
+
+            
+            #line 12 "..\..\Areas\Config\Views\DocumentTemplate\UndetectedPages.cshtml"
+                                Write(new HtmlString(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedFile(null, false, false))));
+
+            
+            #line default
+            #line hidden
+WriteLiteral("\"");
+
+WriteLiteral("\r\n     data-urlundetectedpagesource=\"");
+
+            
+            #line 13 "..\..\Areas\Config\Views\DocumentTemplate\UndetectedPages.cshtml"
+                               Write(new HtmlString(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedFile(null, true, false))));
+
+            
+            #line default
+            #line hidden
+WriteLiteral("\"");
+
+WriteLiteral("\r\n     data-urldataidlookupservice=\"");
+
+            
+            #line 14 "..\..\Areas\Config\Views\DocumentTemplate\UndetectedPages.cshtml"
+                              Write(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedDataIdLookup()));
+
+            
+            #line default
+            #line hidden
+WriteLiteral("/\"");
+
+WriteLiteral("\r\n     data-urlimporterundetectedassign=\"");
+
+            
+            #line 15 "..\..\Areas\Config\Views\DocumentTemplate\UndetectedPages.cshtml"
+                                   Write(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedAssign()));
+
+            
+            #line default
+            #line hidden
+WriteLiteral("/\"");
+
+WriteLiteral("\r\n     data-urlimporterundetecteddelete=\"");
+
+            
+            #line 16 "..\..\Areas\Config\Views\DocumentTemplate\UndetectedPages.cshtml"
+                                   Write(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedDelete()));
+
+            
+            #line default
+            #line hidden
+WriteLiteral("\"");
+
 WriteLiteral(">\r\n    <div");
 
 WriteLiteral(" id=\"noUndetectedPages\"");
@@ -128,7 +205,7 @@ WriteLiteral(" class=\"actions\"");
 WriteLiteral(">\r\n        Type: ");
 
             
-            #line 28 "..\..\Areas\Config\Views\DocumentTemplate\UndetectedPages.cshtml"
+            #line 35 "..\..\Areas\Config\Views\DocumentTemplate\UndetectedPages.cshtml"
          Write(Html.DropDownList("dialogDocumentTemplateId", Model.DocumentTemplatesSelectListItems, new Dictionary<string, object> { { "data-bind", "value: dialogTemplateId" } }));
 
             
@@ -141,11 +218,11 @@ WriteLiteral(" id=\"dialogDataId\"");
 WriteLiteral(" type=\"text\"");
 
 WriteLiteral(" data-bind=\"value: dialogDataId, autocomplete: { source: dialogDataIdService, min" +
-"Length: 3, position: { my: \'left bottom\', at: \'left top\' } }\"");
+"Length: 2, position: { my: \'left bottom\', at: \'left top\' } }\"");
 
-WriteLiteral(" />\r\n        <a");
+WriteLiteral(" />\r\n        <button");
 
-WriteLiteral(" href=\"#\"");
+WriteLiteral(" type=\"button\"");
 
 WriteLiteral(" class=\"button\"");
 
@@ -153,7 +230,7 @@ WriteLiteral(" id=\"dialogAssignButton\"");
 
 WriteLiteral(" data-bind=\"click: assignPage\"");
 
-WriteLiteral(">Assign</a>\r\n    </div>\r\n</div>\r\n<div");
+WriteLiteral(">Assign</button>\r\n    </div>\r\n</div>\r\n<div");
 
 WriteLiteral(" id=\"dialogRemove\"");
 
@@ -192,185 +269,106 @@ WriteLiteral(@">
 
 WriteLiteral(" type=\"text/javascript\"");
 
-WriteLiteral(">\r\n    $(function () {\r\n\r\n        var vm;\r\n        var urlUndetectedPageThumbnail" +
-" = \'");
-
-            
-            #line 65 "..\..\Areas\Config\Views\DocumentTemplate\UndetectedPages.cshtml"
-                                      Write(new HtmlString(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedFile(null, false, true))));
-
-            
-            #line default
-            #line hidden
-WriteLiteral("\';\r\n        var urlUndetectedPagePreview = \'");
-
-            
-            #line 66 "..\..\Areas\Config\Views\DocumentTemplate\UndetectedPages.cshtml"
-                                    Write(new HtmlString(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedFile(null, false, false))));
-
-            
-            #line default
-            #line hidden
-WriteLiteral("\';\r\n        var urlUndetectedPageSource = \'");
-
-            
-            #line 67 "..\..\Areas\Config\Views\DocumentTemplate\UndetectedPages.cshtml"
-                                   Write(new HtmlString(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedFile(null, true, false))));
-
-            
-            #line default
-            #line hidden
-WriteLiteral("\';\r\n        var urlDataIdLookupService = \'");
-
-            
-            #line 68 "..\..\Areas\Config\Views\DocumentTemplate\UndetectedPages.cshtml"
-                                  Write(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedDataIdLookup()));
-
-            
-            #line default
-            #line hidden
-WriteLiteral("/\';\r\n        var urlImporterUndetectedAssign = \'");
-
-            
-            #line 69 "..\..\Areas\Config\Views\DocumentTemplate\UndetectedPages.cshtml"
-                                       Write(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedAssign()));
-
-            
-            #line default
-            #line hidden
-WriteLiteral("/\';\r\n        var urlImporterUndetectedDelete = \'");
-
-            
-            #line 70 "..\..\Areas\Config\Views\DocumentTemplate\UndetectedPages.cshtml"
-                                       Write(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedDelete()));
-
-            
-            #line default
-            #line hidden
-WriteLiteral("/\';\r\n        var $undetectedPageDialog = $(\'#undetectedPageDialog\').dialog({\r\n   " +
-"         modal: true,\r\n            width: 800,\r\n            resizable: false,\r\n " +
-"           autoOpen: false\r\n        });\r\n\r\n        function resizeUndetectedPage" +
-"Dialog() {\r\n            var dialogHeight = Math.min($(window).height() - 120, 80" +
-"5);\r\n            $undetectedPageDialog.height(dialogHeight);\r\n            $undet" +
-"ectedPageDialog.find(\'.pagePreview\').height(dialogHeight - 105);\r\n        }\r\n   " +
-"     resizeUndetectedPageDialog();\r\n\r\n        $(window).resize(resizeUndetectedP" +
-"ageDialog);\r\n\r\n        $dialogRemove = $(\'#dialogRemove\').dialog({\r\n            " +
-"resizable: false,\r\n            height: 140,\r\n            modal: true,\r\n         " +
-"   autoOpen: false\r\n        });\r\n\r\n        function pageViewModel() {\r\n         " +
-"   var self = this;\r\n\r\n            self.selectedUndetectedPage = ko.observable(n" +
-"ull);\r\n            self.undetectedPages = ko.observableArray();\r\n            sel" +
-"f.noUndetectedPages = ko.computed(function () { return self.undetectedPages().le" +
-"ngth == 0 });\r\n            self.selectNextPage = function () {\r\n                " +
-"var oldSelected = self.selectedUndetectedPage();\r\n                var oldSelecte" +
-"dIndex = vm.undetectedPages.indexOf(oldSelected);\r\n\r\n                if (vm.unde" +
-"tectedPages().length > 1) {\r\n                    if (oldSelectedIndex + 1 <= vm." +
-"undetectedPages().length - 1)\r\n                        vm.selectedUndetectedPage" +
-"(vm.undetectedPages()[oldSelectedIndex + 1]);\r\n                    else\r\n       " +
-"                 vm.selectedUndetectedPage(vm.undetectedPages()[oldSelectedIndex" +
-" - 1]);\r\n                } else {\r\n                    $undetectedPageDialog.dia" +
-"log(\'close\');\r\n                    vm.selectedUndetectedPage(null);\r\n           " +
-"     }\r\n            }\r\n        }\r\n\r\n        function undetectedPageViewModel(id," +
-" timestamp, timestampFuzzy) {\r\n            var self = this;\r\n\r\n            self." +
-"id = id;\r\n            self.timestamp = timestamp;\r\n            self.timestampFuz" +
-"zy = timestampFuzzy;\r\n            self.thumbnailUrl = \"url(\" + urlUndetectedPage" +
-"Thumbnail + \"&id=\" + id + \")\";\r\n            self.previewUrl = \"url(\" + urlUndete" +
-"ctedPagePreview + \"&id=\" + id + \")\";\r\n            self.sourceUrl = urlUndetected" +
-"PageSource + \"&id=\" + id;\r\n            self.select = function (e, d) {\r\n        " +
-"        vm.selectedUndetectedPage(self);\r\n                $undetectedPageDialog." +
-"dialog(\'open\');\r\n            }\r\n\r\n            // Dialog Properties\r\n            " +
-"self.dialogTemplateId = ko.observable(null);\r\n            self.dialogDataId = ko" +
-".observable(null);\r\n            self.dialogDataIdService = ko.computed(function " +
-"() {\r\n                return urlDataIdLookupService + self.dialogTemplateId();\r\n" +
-"            });\r\n            self.deletePage = function () {\r\n                $u" +
-"ndetectedPageDialog.dialog(\'option\', \'disabled\', true);\r\n\r\n                $dial" +
-"ogRemove.dialog(\'option\', \'buttons\', {\r\n                    \"Remove\": function (" +
-") {\r\n                        $dialogRemove.dialog(\"close\");\r\n                   " +
-"     var data = { id: self.id };\r\n                        $.ajax({\r\n            " +
-"                url: urlImporterUndetectedDelete,\r\n                            d" +
-"ataType: \'json\',\r\n                            data: data,\r\n                     " +
-"       type: \'POST\',\r\n                            success: function (d) {\r\n     " +
-"                           if (d == \'OK\') {\r\n                                   " +
-" vm.selectNextPage();\r\n                                    vm.undetectedPages.re" +
-"move(self);\r\n                                } else {\r\n                         " +
-"           alert(\'Unable to delete page: \' + d);\r\n                              " +
-"  }\r\n                                $undetectedPageDialog.dialog(\'option\', \'dis" +
-"abled\', false);\r\n                            },\r\n                            err" +
-"or: function (jqXHR, textStatus, errorThrown) {\r\n                               " +
-" alert(\'Unable to delete page: \' + errorThrown);\r\n                              " +
-"  $undetectedPageDialog.dialog(\'option\', \'disabled\', false);\r\n                  " +
-"          }\r\n                        });\r\n                    },\r\n              " +
-"      \"Cancel\": function () {\r\n                        $dialogRemove.dialog(\"clo" +
-"se\");\r\n                        $undetectedPageDialog.dialog(\'option\', \'disabled\'" +
-", false);\r\n                    }\r\n                });\r\n\r\n                $dialog" +
-"Remove.dialog(\'open\');\r\n\r\n                return false;\r\n            }\r\n        " +
-"    self.assignPage = function () {\r\n                var dtId = self.dialogTempl" +
-"ateId();\r\n                var dId = self.dialogDataId();\r\n                if (!d" +
-"tId || !dId) {\r\n                    alert(\'Please specify a valid Document Type " +
-"and Data Id\');\r\n                } else {\r\n                    $undetectedPageDia" +
-"log.dialog(\'option\', \'disabled\', true);\r\n\r\n                    var data = { id: " +
-"self.id, DocumentTemplateId: dtId, DataId: dId };\r\n\r\n                    $.ajax(" +
-"{\r\n                        url: urlImporterUndetectedAssign,\r\n                  " +
-"      dataType: \'json\',\r\n                        data: data,\r\n                  " +
-"      type: \'POST\',\r\n                        success: function (d) {\r\n          " +
-"                  if (d == \'OK\') {\r\n                                vm.selectNex" +
-"tPage();\r\n                                vm.undetectedPages.remove(self);\r\n    " +
-"                        } else {\r\n                                alert(\'Unable " +
-"to assign page: \' + d);\r\n                            }\r\n                        " +
-"    $undetectedPageDialog.dialog(\'option\', \'disabled\', false);\r\n                " +
-"        },\r\n                        error: function (jqXHR, textStatus, errorThr" +
-"own) {\r\n                            alert(\'Unable to assign page: \' + errorThrow" +
-"n);\r\n                            $undetectedPageDialog.dialog(\'option\', \'disable" +
-"d\', false);\r\n                        }\r\n                    });\r\n\r\n             " +
-"   }\r\n                return false;\r\n            };\r\n        }\r\n\r\n        functi" +
-"on init() {\r\n            vm = new pageViewModel();\r\n\r\n            $.ajax({\r\n    " +
-"            url: \'");
-
-            
-            #line 212 "..\..\Areas\Config\Views\DocumentTemplate\UndetectedPages.cshtml"
-                  Write(Url.Action(MVC.API.DocumentTemplate.ImporterUndetectedFiles()));
-
-            
-            #line default
-            #line hidden
-WriteLiteral(@"',
-                dataType: 'json',
-                type: 'POST',
-                success: init_loadedContent,
-                error: function (jqXHR, textStatus, errorThrown) {
-                    alert('Unable to load content: ' + errorThrown);
-                }
-            });
-        }
-        function init_loadedContent(content) {
-            if (content.length > 0) {
-                for (var i = 0; i < content.length; i++) {
-                    var c = content[i];
-                    var up = new undetectedPageViewModel(c.Id, c.Timestamp, c.TimestampFuzzy);
-                    vm.undetectedPages.push(up);
-                }
-            }
-
-            ko.applyBindings(vm);
-            init_loadedOpen();
-        }
-        function init_loadedOpen() {
-            var fileId = window.location.hash;
-            if (fileId) {
-                fileId = fileId.substr(1);
-                for (var i = 0; i < vm.undetectedPages().length; i++) {
-                    var up = vm.undetectedPages()[i];
-                    if (up.id == fileId) {
-                        up.select();
-                        return;
-                    }
-                }
-            }
-        }
-        init();
-
-    });
-</script>
-");
+WriteLiteral(">\r\n    $(function () {\r\n\r\n        const vm = new pageViewModel();\r\n        const " +
+"$undetectedPagesContainer = $(undetectedPagesContainer);\r\n        const urlUndet" +
+"ectedFiles = $undetectedPagesContainer.attr(\'data-urlundetectedfiles\');\r\n       " +
+" const urlUndetectedPageThumbnail = $undetectedPagesContainer.attr(\'data-urlunde" +
+"tectedpagethumbnail\');\r\n        const urlUndetectedPagePreview = $undetectedPage" +
+"sContainer.attr(\'data-urlundetectedpagepreview\');\r\n        const urlUndetectedPa" +
+"geSource = $undetectedPagesContainer.attr(\'data-urlundetectedpagesource\');\r\n    " +
+"    const urlDataIdLookupService = $undetectedPagesContainer.attr(\'data-urldatai" +
+"dlookupservice\');\r\n        const urlImporterUndetectedAssign = $undetectedPagesC" +
+"ontainer.attr(\'data-urlimporterundetectedassign\');\r\n        const urlImporterUnd" +
+"etectedDelete = $undetectedPagesContainer.attr(\'data-urlimporterundetecteddelete" +
+"\');\r\n        const $undetectedPageDialog = $(\'#undetectedPageDialog\').dialog({\r\n" +
+"            modal: true,\r\n            width: 800,\r\n            resizable: false," +
+"\r\n            autoOpen: false\r\n        });\r\n\r\n        function resizeUndetectedP" +
+"ageDialog() {\r\n            var dialogHeight = Math.min($(window).height() - 120," +
+" 805);\r\n            $undetectedPageDialog.height(dialogHeight);\r\n            $un" +
+"detectedPageDialog.find(\'.pagePreview\').height(dialogHeight - 105);\r\n        }\r\n" +
+"        resizeUndetectedPageDialog();\r\n\r\n        $(window).resize(resizeUndetect" +
+"edPageDialog);\r\n\r\n        $dialogRemove = $(\'#dialogRemove\').dialog({\r\n         " +
+"   resizable: false,\r\n            height: 140,\r\n            modal: true,\r\n      " +
+"      autoOpen: false\r\n        });\r\n\r\n        function pageViewModel() {\r\n      " +
+"      var self = this;\r\n\r\n            self.selectedUndetectedPage = ko.observabl" +
+"e(null);\r\n            self.undetectedPages = ko.observableArray();\r\n            " +
+"self.noUndetectedPages = ko.computed(function () { return self.undetectedPages()" +
+".length == 0 });\r\n            self.selectNextPage = function () {\r\n             " +
+"   var oldSelected = self.selectedUndetectedPage();\r\n                var oldSele" +
+"ctedIndex = vm.undetectedPages.indexOf(oldSelected);\r\n\r\n                if (vm.u" +
+"ndetectedPages().length > 1) {\r\n                    if (oldSelectedIndex + 1 <= " +
+"vm.undetectedPages().length - 1)\r\n                        vm.selectedUndetectedP" +
+"age(vm.undetectedPages()[oldSelectedIndex + 1]);\r\n                    else\r\n    " +
+"                    vm.selectedUndetectedPage(vm.undetectedPages()[oldSelectedIn" +
+"dex - 1]);\r\n                } else {\r\n                    $undetectedPageDialog." +
+"dialog(\'close\');\r\n                    vm.selectedUndetectedPage(null);\r\n        " +
+"        }\r\n            }\r\n        }\r\n\r\n        function undetectedPageViewModel(" +
+"id, timestamp, timestampFuzzy) {\r\n            var self = this;\r\n\r\n            se" +
+"lf.id = id;\r\n            self.timestamp = timestamp;\r\n            self.timestamp" +
+"Fuzzy = timestampFuzzy;\r\n            self.thumbnailUrl = \"url(\" + urlUndetectedP" +
+"ageThumbnail + \"&id=\" + id + \")\";\r\n            self.previewUrl = \"url(\" + urlUnd" +
+"etectedPagePreview + \"&id=\" + id + \")\";\r\n            self.sourceUrl = urlUndetec" +
+"tedPageSource + \"&id=\" + id;\r\n            self.select = function (e, d) {\r\n     " +
+"           vm.selectedUndetectedPage(self);\r\n                $undetectedPageDial" +
+"og.dialog(\'open\');\r\n            }\r\n\r\n            // Dialog Properties\r\n         " +
+"   self.dialogTemplateId = ko.observable(null);\r\n            self.dialogDataId =" +
+" ko.observable(null);\r\n            self.dialogDataIdService = ko.computed(functi" +
+"on () {\r\n                return urlDataIdLookupService + self.dialogTemplateId()" +
+";\r\n            });\r\n            self.deletePage = function () {\r\n               " +
+" $dialogRemove.dialog(\'option\', \'buttons\', {\r\n                    \"Remove\": func" +
+"tion () {\r\n                        $dialogRemove.dialog(\"close\");\r\n\r\n           " +
+"             async function removeAsync() {\r\n\r\n                            const" +
+" body = new FormData();\r\n                            body.append(\'__RequestVerif" +
+"icationToken\', document.body.dataset.antiforgery);\r\n                            " +
+"body.append(\'id\', self.id);\r\n\r\n                            try {\r\n              " +
+"                  const response = await fetch(urlImporterUndetectedDelete, {\r\n " +
+"                                   method: \'POST\',\r\n                            " +
+"        body: body\r\n                                });\r\n                       " +
+"         if (!response.ok) {\r\n                                    alert(\'Unable " +
+"to delete page: \' + response.statusText);\r\n                                    r" +
+"eturn;\r\n                                }\r\n                                vm.se" +
+"lectNextPage();\r\n                                vm.undetectedPages.remove(self)" +
+";\r\n                            } catch (e) {\r\n                                al" +
+"ert(\'Unable to delete page: \' + e);\r\n                            }\r\n            " +
+"            }\r\n                        removeAsync(self.id);\r\n                  " +
+"  },\r\n                    \"Cancel\": function () {\r\n                        $dial" +
+"ogRemove.dialog(\"close\");\r\n                        $undetectedPageDialog.dialog(" +
+"\'option\', \'disabled\', false);\r\n                    }\r\n                });\r\n\r\n   " +
+"             $dialogRemove.dialog(\'open\');\r\n\r\n                return false;\r\n   " +
+"         }\r\n            self.assignPage = async function () {\r\n                v" +
+"ar dtId = self.dialogTemplateId();\r\n                var dId = self.dialogDataId(" +
+");\r\n                if (!dtId || !dId) {\r\n                    alert(\'Please spec" +
+"ify a valid Document Type and Data Id\');\r\n                } else {\r\n            " +
+"        const body = new FormData();\r\n                    body.append(\'__Request" +
+"VerificationToken\', document.body.dataset.antiforgery);\r\n                    bod" +
+"y.append(\'id\', self.id);\r\n                    body.append(\'documentTemplateId\', " +
+"dtId);\r\n                    body.append(\'dataId\', dId);\r\n\r\n                    t" +
+"ry {\r\n                        const response = await fetch(urlImporterUndetected" +
+"Assign, {\r\n                            method: \'POST\',\r\n                        " +
+"    body: body\r\n                        });\r\n                        if (respons" +
+"e.ok) {\r\n                            vm.selectNextPage();\r\n                     " +
+"       vm.undetectedPages.remove(self);\r\n                        } else {\r\n     " +
+"                       alert(\'Unable to assign page: \' + response.statusText);\r\n" +
+"                        }\r\n                    } catch (e) {\r\n                  " +
+"      alert(\'Unable to assign page: \' + e);\r\n                    }\r\n            " +
+"    }\r\n                return false;\r\n            };\r\n        }\r\n\r\n        async" +
+" function init() {\r\n            const body = new FormData();\r\n            body.a" +
+"ppend(\'__RequestVerificationToken\', document.body.dataset.antiforgery);\r\n       " +
+"     const response = await fetch(urlUndetectedFiles, {\r\n                method:" +
+" \'POST\',\r\n                body: body\r\n            });\r\n\r\n            if (!respon" +
+"se.ok) {\r\n                alert(\'Unable to load content: \' + response.statusText" +
+");\r\n                return;\r\n            }\r\n\r\n            const content = await " +
+"response.json();\r\n\r\n            if (content.length > 0) {\r\n                for (" +
+"var i = 0; i < content.length; i++) {\r\n                    var c = content[i];\r\n" +
+"                    var up = new undetectedPageViewModel(c.Id, c.Timestamp, c.Ti" +
+"mestampFuzzy);\r\n                    vm.undetectedPages.push(up);\r\n              " +
+"  }\r\n            }\r\n\r\n            ko.applyBindings(vm);\r\n\r\n            var fileI" +
+"d = window.location.hash;\r\n            if (fileId) {\r\n                fileId = f" +
+"ileId.substr(1);\r\n                for (var i = 0; i < vm.undetectedPages().lengt" +
+"h; i++) {\r\n                    var up = vm.undetectedPages()[i];\r\n              " +
+"      if (up.id == fileId) {\r\n                        up.select();\r\n            " +
+"            return;\r\n                    }\r\n                }\r\n            }\r\n  " +
+"      }\r\n\r\n        init();\r\n    });\r\n</script>\r\n");
 
         }
     }

Disco.Web/Areas/Config/Views/Enrolment/Index.cshtml

@@ -6,11 +6,13 @@
     var canShowStatus = Authorization.Has(Claims.Config.Enrolment.ShowStatus);
 
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Device Enrolment");
+
+    Html.BundleDeferred("~/ClientScripts/Modules/Disco-PropertyChangeHelpers");
 }
 <div class="form" style="width: 530px;">
     <table>
         <tr>
-            <th>
+            <th width="130">
                 Pending Timeout:
             </th>
             <td>
@@ -21,50 +23,14 @@
                     @AjaxHelpers.AjaxLoader()
                     <span> minutes <span class="smallText">(default: 30)</span></span>
                     <script type="text/javascript">
-                    $(function () {
-                        var $DOM = $('#PendingTimeoutMinutes');
-                        var $DOMAjaxSave = $DOM.next('.ajaxSave');
-                        $DOM
-                    .watermark('Minutes')
-                    .focus(function () { $DOM.select() })
-                    .keydown(function (e) {
-                        $DOMAjaxSave.show();
-                        if (e.which == 13) {
-                            $(this).blur();
-                        }
-                    }).blur(function () {
-                        $DOMAjaxSave.hide();
-                    })
-                    .change(function () {
-                        $DOMAjaxSave.hide();
-                        var $ajaxLoading = $DOMAjaxSave.next('.ajaxLoading').show();
-                        var data = { PendingTimeoutMinutes: parseInt($DOM.val()) };
-                        if (data.PendingTimeoutMinutes <= 0) {
-                            alert('Pending Timeout must be greater than zero');
-                            $ajaxLoading.hide();
-                            return;
-                        } else {
-                        $.ajax({
-                            url: '@Url.Action(MVC.API.Enrolment.PendingTimeoutMinutes())',
-                            dataType: 'json',
-                            method: 'POST',
-                            data: data,
-                            success: function (d) {
-                                if (d == 'OK') {
-                                    $ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
-                                } else {
-                                    $ajaxLoading.hide();
-                                    alert('Unable to update pending timeout: ' + d);
-                                }
-                            },
-                            error: function (jqXHR, textStatus, errorThrown) {
-                                alert('Unable to update pending timeout: ' + textStatus);
-                                $ajaxLoading.hide();
-                            }
+                        $(function () {
+                            document.DiscoFunctions.PropertyChangeHelper(
+                                $('#PendingTimeoutMinutes'),
+                                'Pending Timeout',
+                                '@(Url.Action(MVC.API.Enrolment.PendingTimeoutMinutes()))',
+                                'PendingTimeoutMinutes'
+                            );
                         });
-                        }
-                    });
-                    });
                     </script>
                 }
                 else
@@ -87,7 +53,7 @@
     <h2>Apple Mac Secure Enroll</h2>
     <table>
         <tr>
-            <th>
+            <th width="130">
                 Username:
             </th>
             <td>
@@ -97,43 +63,14 @@
                     @AjaxHelpers.AjaxSave()
                     @AjaxHelpers.AjaxLoader()
                     <script type="text/javascript">
-                    $(function () {
-                        var $DOM = $('#MacSshUsername');
-                        var $DOMAjaxSave = $DOM.next('.ajaxSave');
-                        $DOM
-                    .watermark('Username')
-                    .focus(function () { $DOM.select() })
-                    .keydown(function (e) {
-                        $DOMAjaxSave.show();
-                        if (e.which == 13) {
-                            $(this).blur();
-                        }
-                    }).blur(function () {
-                        $DOMAjaxSave.hide();
-                    })
-                    .change(function () {
-                        $DOMAjaxSave.hide();
-                        var $ajaxLoading = $DOMAjaxSave.next('.ajaxLoading').show();
-                        var data = { MacSshUsername: $DOM.val() };
-                        $.ajax({
-                            url: '@Url.Action(MVC.API.Bootstrapper.MacSshUsername())',
-                            dataType: 'json',
-                            data: data,
-                            success: function (d) {
-                                if (d == 'OK') {
-                                    $ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
-                                } else {
-                                    $ajaxLoading.hide();
-                                    alert('Unable to update Username: ' + d);
-                                }
-                            },
-                            error: function (jqXHR, textStatus, errorThrown) {
-                                alert('Unable to update Username: ' + textStatus);
-                                $ajaxLoading.hide();
-                            }
+                        $(function () {
+                            document.DiscoFunctions.PropertyChangeHelper(
+                                $('#MacSshUsername'),
+                                'Username',
+                                '@(Url.Action(MVC.API.Enrolment.MacSshUsername()))',
+                                'MacSshUsername'
+                            );
                         });
-                    });
-                    });
                     </script>
                 }
                 else
@@ -151,7 +88,7 @@
         </tr>
 
         <tr>
-            <th>
+            <th width="130">
                 Password:
             </th>
             <td>
@@ -161,43 +98,14 @@
                     @AjaxHelpers.AjaxSave()
                     @AjaxHelpers.AjaxLoader()
                     <script type="text/javascript">
-                    $(function () {
-                        var $DOM = $('#MacSshPassword');
-                        var $DOMAjaxSave = $DOM.next('.ajaxSave');
-                        $DOM
-                    .watermark('Password')
-                    .focus(function () { $DOM.select() })
-                    .keydown(function (e) {
-                        $DOMAjaxSave.show();
-                        if (e.which == 13) {
-                            $(this).blur();
-                        }
-                    }).blur(function () {
-                        $DOMAjaxSave.hide();
-                    })
-                    .change(function () {
-                        $DOMAjaxSave.hide();
-                        var $ajaxLoading = $DOMAjaxSave.next('.ajaxLoading').show();
-                        var data = { MacSshPassword: $DOM.val() };
-                        $.ajax({
-                            url: '@Url.Action(MVC.API.Bootstrapper.MacSshPassword())',
-                            dataType: 'json',
-                            data: data,
-                            success: function (d) {
-                                if (d == 'OK') {
-                                    $ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
-                                } else {
-                                    $ajaxLoading.hide();
-                                    alert('Unable to update Password: ' + d);
-                                }
-                            },
-                            error: function (jqXHR, textStatus, errorThrown) {
-                                alert('Unable to update Password: ' + textStatus);
-                                $ajaxLoading.hide();
-                            }
+                        $(function () {
+                            document.DiscoFunctions.PropertyChangeHelper(
+                                $('#MacSshPassword'),
+                                'Password',
+                                '@(Url.Action(MVC.API.Enrolment.MacSshPassword()))',
+                                'MacSshPassword'
+                            );
                         });
-                    });
-                    });
                     </script>
                 }
                 else

Disco.Web/Areas/Config/Views/Enrolment/Index.generated.cs

@@ -53,6 +53,8 @@ namespace Disco.Web.Areas.Config.Views.Enrolment
 
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Device Enrolment");
 
+    Html.BundleDeferred("~/ClientScripts/Modules/Disco-PropertyChangeHelpers");
+
             
             #line default
             #line hidden
@@ -62,17 +64,20 @@ WriteLiteral(" class=\"form\"");
 
 WriteLiteral(" style=\"width: 530px;\"");
 
-WriteLiteral(">\r\n    <table>\r\n        <tr>\r\n            <th>\r\n                Pending Timeout:\r" +
-"\n            </th>\r\n            <td>\r\n");
+WriteLiteral(">\r\n    <table>\r\n        <tr>\r\n            <th");
+
+WriteLiteral(" width=\"130\"");
+
+WriteLiteral(">\r\n                Pending Timeout:\r\n            </th>\r\n            <td>\r\n");
 
             
-            #line 17 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 19 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                 
             
             #line default
             #line hidden
             
-            #line 17 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 19 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                  if (canConfig)
                 {
                     
@@ -80,42 +85,42 @@ WriteLiteral(">\r\n    <table>\r\n        <tr>\r\n            <th>\r\n
             #line default
             #line hidden
             
-            #line 19 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 21 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                Write(Html.TextBoxFor(model => model.PendingTimeoutMinutes, new { type = "number", min = "1" }));
 
             
             #line default
             #line hidden
             
-            #line 19 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 21 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                                                                                                               
                     
             
             #line default
             #line hidden
             
-            #line 20 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 22 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                Write(AjaxHelpers.AjaxSave());
 
             
             #line default
             #line hidden
             
-            #line 20 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 22 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                                            
                     
             
             #line default
             #line hidden
             
-            #line 21 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 23 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                Write(AjaxHelpers.AjaxLoader());
 
             
             #line default
             #line hidden
             
-            #line 21 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 23 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                                              
 
             
@@ -132,64 +137,24 @@ WriteLiteral("                    <script");
 WriteLiteral(" type=\"text/javascript\"");
 
 WriteLiteral(@">
-                    $(function () {
-                        var $DOM = $('#PendingTimeoutMinutes');
-                        var $DOMAjaxSave = $DOM.next('.ajaxSave');
-                        $DOM
-                    .watermark('Minutes')
-                    .focus(function () { $DOM.select() })
-                    .keydown(function (e) {
-                        $DOMAjaxSave.show();
-                        if (e.which == 13) {
-                            $(this).blur();
-                        }
-                    }).blur(function () {
-                        $DOMAjaxSave.hide();
-                    })
-                    .change(function () {
-                        $DOMAjaxSave.hide();
-                        var $ajaxLoading = $DOMAjaxSave.next('.ajaxLoading').show();
-                        var data = { PendingTimeoutMinutes: parseInt($DOM.val()) };
-                        if (data.PendingTimeoutMinutes <= 0) {
-                            alert('Pending Timeout must be greater than zero');
-                            $ajaxLoading.hide();
-                            return;
-                        } else {
-                        $.ajax({
-                            url: '");
+                        $(function () {
+                            document.DiscoFunctions.PropertyChangeHelper(
+                                $('#PendingTimeoutMinutes'),
+                                'Pending Timeout',
+                                '");
 
             
-            #line 48 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 30 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                              Write(Url.Action(MVC.API.Enrolment.PendingTimeoutMinutes()));
 
             
             #line default
             #line hidden
-WriteLiteral(@"',
-                            dataType: 'json',
-                            method: 'POST',
-                            data: data,
-                            success: function (d) {
-                                if (d == 'OK') {
-                                    $ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
-                                } else {
-                                    $ajaxLoading.hide();
-                                    alert('Unable to update pending timeout: ' + d);
-                                }
-                            },
-                            error: function (jqXHR, textStatus, errorThrown) {
-                                alert('Unable to update pending timeout: ' + textStatus);
-                                $ajaxLoading.hide();
-                            }
-                        });
-                        }
-                    });
-                    });
-                    </script>
-");
+WriteLiteral("\',\r\n                                \'PendingTimeoutMinutes\'\r\n                    " +
+"        );\r\n                        });\r\n                    </script>\r\n");
 
             
-            #line 69 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 35 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                 }
                 else
                 {
@@ -198,14 +163,14 @@ WriteLiteral(@"',
             #line default
             #line hidden
             
-            #line 72 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 38 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                Write(TimeSpan.FromMinutes(Model.PendingTimeoutMinutes));
 
             
             #line default
             #line hidden
             
-            #line 72 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 38 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                                                                       
                 }
 
@@ -235,16 +200,20 @@ WriteLiteral(" class=\"form\"");
 WriteLiteral(" style=\"width: 530px; margin-top: 15px\"");
 
 WriteLiteral(">\r\n    <h2>Apple Mac Secure Enroll</h2>\r\n    <table>\r\n        <tr>\r\n            <" +
-"th>\r\n                Username:\r\n            </th>\r\n            <td>\r\n");
+"th");
+
+WriteLiteral(" width=\"130\"");
+
+WriteLiteral(">\r\n                Username:\r\n            </th>\r\n            <td>\r\n");
 
             
-            #line 94 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 60 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                 
             
             #line default
             #line hidden
             
-            #line 94 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 60 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                  if (canConfig)
                 {
                     
@@ -252,42 +221,42 @@ WriteLiteral(">\r\n    <h2>Apple Mac Secure Enroll</h2>\r\n    <table>\r\n
             #line default
             #line hidden
             
-            #line 96 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 62 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                Write(Html.TextBoxFor(model => model.MacSshUsername));
 
             
             #line default
             #line hidden
             
-            #line 96 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 62 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                                                                    
                     
             
             #line default
             #line hidden
             
-            #line 97 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 63 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                Write(AjaxHelpers.AjaxSave());
 
             
             #line default
             #line hidden
             
-            #line 97 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 63 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                                            
                     
             
             #line default
             #line hidden
             
-            #line 98 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 64 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                Write(AjaxHelpers.AjaxLoader());
 
             
             #line default
             #line hidden
             
-            #line 98 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 64 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                                              
 
             
@@ -297,58 +266,23 @@ WriteLiteral("                    <script");
 
 WriteLiteral(" type=\"text/javascript\"");
 
-WriteLiteral(@">
-                    $(function () {
-                        var $DOM = $('#MacSshUsername');
-                        var $DOMAjaxSave = $DOM.next('.ajaxSave');
-                        $DOM
-                    .watermark('Username')
-                    .focus(function () { $DOM.select() })
-                    .keydown(function (e) {
-                        $DOMAjaxSave.show();
-                        if (e.which == 13) {
-                            $(this).blur();
-                        }
-                    }).blur(function () {
-                        $DOMAjaxSave.hide();
-                    })
-                    .change(function () {
-                        $DOMAjaxSave.hide();
-                        var $ajaxLoading = $DOMAjaxSave.next('.ajaxLoading').show();
-                        var data = { MacSshUsername: $DOM.val() };
-                        $.ajax({
-                            url: '");
+WriteLiteral(">\r\n                        $(function () {\r\n                            document." +
+"DiscoFunctions.PropertyChangeHelper(\r\n                                $(\'#MacSsh" +
+"Username\'),\r\n                                \'Username\',\r\n                      " +
+"          \'");
 
             
-            #line 119 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
-                             Write(Url.Action(MVC.API.Bootstrapper.MacSshUsername()));
+            #line 70 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+                             Write(Url.Action(MVC.API.Enrolment.MacSshUsername()));
 
             
             #line default
             #line hidden
-WriteLiteral(@"',
-                            dataType: 'json',
-                            data: data,
-                            success: function (d) {
-                                if (d == 'OK') {
-                                    $ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
-                                } else {
-                                    $ajaxLoading.hide();
-                                    alert('Unable to update Username: ' + d);
-                                }
-                            },
-                            error: function (jqXHR, textStatus, errorThrown) {
-                                alert('Unable to update Username: ' + textStatus);
-                                $ajaxLoading.hide();
-                            }
-                        });
-                    });
-                    });
-                    </script>
-");
+WriteLiteral("\',\r\n                                \'MacSshUsername\'\r\n                           " +
+" );\r\n                        });\r\n                    </script>\r\n");
 
             
-            #line 138 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 75 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                 }
                 else
                 {
@@ -365,7 +299,7 @@ WriteLiteral(" class=\"smallMessage\"");
 WriteLiteral(">&lt;None Specified&gt;</span>\r\n");
 
             
-            #line 144 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 81 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                     }
                     else
                     {
@@ -374,14 +308,14 @@ WriteLiteral(">&lt;None Specified&gt;</span>\r\n");
             #line default
             #line hidden
             
-            #line 147 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 84 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                    Write(Model.MacSshUsername);
 
             
             #line default
             #line hidden
             
-            #line 147 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 84 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                                              
                     }
                 }
@@ -389,17 +323,20 @@ WriteLiteral(">&lt;None Specified&gt;</span>\r\n");
             
             #line default
             #line hidden
-WriteLiteral("            </td>\r\n        </tr>\r\n\r\n        <tr>\r\n            <th>\r\n             " +
-"   Password:\r\n            </th>\r\n            <td>\r\n");
+WriteLiteral("            </td>\r\n        </tr>\r\n\r\n        <tr>\r\n            <th");
+
+WriteLiteral(" width=\"130\"");
+
+WriteLiteral(">\r\n                Password:\r\n            </th>\r\n            <td>\r\n");
 
             
-            #line 158 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 95 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                 
             
             #line default
             #line hidden
             
-            #line 158 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 95 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                  if (canConfig)
                 {
 
@@ -415,34 +352,34 @@ WriteLiteral(" type=\"password\"");
 WriteLiteral(" />\r\n");
 
             
-            #line 161 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 98 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                     
             
             #line default
             #line hidden
             
-            #line 161 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 98 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                Write(AjaxHelpers.AjaxSave());
 
             
             #line default
             #line hidden
             
-            #line 161 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 98 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                                            
                     
             
             #line default
             #line hidden
             
-            #line 162 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 99 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                Write(AjaxHelpers.AjaxLoader());
 
             
             #line default
             #line hidden
             
-            #line 162 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 99 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                                              
 
             
@@ -452,58 +389,23 @@ WriteLiteral("                    <script");
 
 WriteLiteral(" type=\"text/javascript\"");
 
-WriteLiteral(@">
-                    $(function () {
-                        var $DOM = $('#MacSshPassword');
-                        var $DOMAjaxSave = $DOM.next('.ajaxSave');
-                        $DOM
-                    .watermark('Password')
-                    .focus(function () { $DOM.select() })
-                    .keydown(function (e) {
-                        $DOMAjaxSave.show();
-                        if (e.which == 13) {
-                            $(this).blur();
-                        }
-                    }).blur(function () {
-                        $DOMAjaxSave.hide();
-                    })
-                    .change(function () {
-                        $DOMAjaxSave.hide();
-                        var $ajaxLoading = $DOMAjaxSave.next('.ajaxLoading').show();
-                        var data = { MacSshPassword: $DOM.val() };
-                        $.ajax({
-                            url: '");
+WriteLiteral(">\r\n                        $(function () {\r\n                            document." +
+"DiscoFunctions.PropertyChangeHelper(\r\n                                $(\'#MacSsh" +
+"Password\'),\r\n                                \'Password\',\r\n                      " +
+"          \'");
 
             
-            #line 183 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
-                             Write(Url.Action(MVC.API.Bootstrapper.MacSshPassword()));
+            #line 105 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+                             Write(Url.Action(MVC.API.Enrolment.MacSshPassword()));
 
             
             #line default
             #line hidden
-WriteLiteral(@"',
-                            dataType: 'json',
-                            data: data,
-                            success: function (d) {
-                                if (d == 'OK') {
-                                    $ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
-                                } else {
-                                    $ajaxLoading.hide();
-                                    alert('Unable to update Password: ' + d);
-                                }
-                            },
-                            error: function (jqXHR, textStatus, errorThrown) {
-                                alert('Unable to update Password: ' + textStatus);
-                                $ajaxLoading.hide();
-                            }
-                        });
-                    });
-                    });
-                    </script>
-");
+WriteLiteral("\',\r\n                                \'MacSshPassword\'\r\n                           " +
+" );\r\n                        });\r\n                    </script>\r\n");
 
             
-            #line 202 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 110 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                 }
                 else
                 {
@@ -518,7 +420,7 @@ WriteLiteral("********");
 WriteLiteral("\r\n");
 
             
-            #line 206 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 114 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                 }
 
             
@@ -587,7 +489,7 @@ WriteLiteral(">&lt;script&gt;</span>\r\n                    tag embedded on the
 "\r\n</div>\r\n");
 
             
-            #line 228 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 136 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
  if (canShowStatus && Authorization.Has(Claims.Config.Logging.Show))
 {
 
@@ -597,13 +499,13 @@ WriteLiteral(">&lt;script&gt;</span>\r\n                    tag embedded on the
 WriteLiteral("    <h2>Live Enrolment Logging</h2>\r\n");
 
             
-            #line 231 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 139 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
     
             
             #line default
             #line hidden
             
-            #line 231 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 139 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
 Write(Html.Partial(MVC.Config.Shared.Views.LogEvents, new Disco.Web.Areas.Config.Models.Shared.LogEventsModel()
 {
     IsLive = true,
@@ -617,7 +519,7 @@ Write(Html.Partial(MVC.Config.Shared.Views.LogEvents, new Disco.Web.Areas.Config
             #line default
             #line hidden
             
-            #line 238 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 146 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
   
 }
 
@@ -631,13 +533,13 @@ WriteLiteral(" class=\"actionBar\"");
 WriteLiteral(">\r\n");
 
             
-            #line 241 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 149 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
     
             
             #line default
             #line hidden
             
-            #line 241 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 149 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
      if (Authorization.Has(Claims.Config.Enrolment.DownloadBootstrapper))
     {
         
@@ -645,14 +547,14 @@ WriteLiteral(">\r\n");
             #line default
             #line hidden
             
-            #line 243 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 151 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
    Write(Html.ActionLinkButton("Download Bootstrapper", MVC.Services.Client.Bootstrapper()));
 
             
             #line default
             #line hidden
             
-            #line 243 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 151 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                                                                                            
     }
 
@@ -662,7 +564,7 @@ WriteLiteral(">\r\n");
 WriteLiteral("    ");
 
             
-            #line 245 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 153 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
      if (canShowStatus)
     {
         
@@ -670,14 +572,14 @@ WriteLiteral("    ");
             #line default
             #line hidden
             
-            #line 247 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 155 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
    Write(Html.ActionLinkButton("Enrolment Status", MVC.Config.Enrolment.Status()));
 
             
             #line default
             #line hidden
             
-            #line 247 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
+            #line 155 "..\..\Areas\Config\Views\Enrolment\Index.cshtml"
                                                                                  
     }
 

Disco.Web/Areas/Config/Views/Enrolment/Status.cshtml

@@ -8,7 +8,6 @@
     Html.BundleDeferred("~/ClientScripts/Modules/jQuery-Isotope");
 }
 <div id="enrolStatus" data-defaultdeviceprofileid="@Model.DefaultDeviceProfileId">
-    @Html.AntiForgeryToken()
     <div id="noSessions" data-bind="visible: noSessions">
         <h2>No enrolment sessions today</h2>
     </div>
@@ -31,7 +30,7 @@
             <p class="sessionStatus" data-bind="text: progressStatus"></p>
             <div data-bind="visible: !sessionEnded() && progressValue >= 0, progressValue: progressValue"></div>
             <div id="formResolveSessionPending" data-bind="visible: isPending">
-                @using (Html.BeginForm(MVC.API.Enrolment.ResolveSessionPending(), FormMethod.Post))
+                @using (Html.BeginForm(MVC.API.Enrolment.ResolveSessionPending()))
                 {
                     <code data-bind="text: pendingIdentifier"></code>
                     @Html.AntiForgeryToken();
@@ -352,6 +351,9 @@
                 url: '@(Url.Action(MVC.API.DeviceModel.Index()))',
                 dataType: 'json',
                 type: 'POST',
+                data: {
+                    '__RequestVerificationToken': document.body.dataset.antiforgery
+                },
                 success: init_loadedDeviceModels,
                 error: function (jqXHR, textStatus, errorThrown) {
                     alert('Unable to retrieve device models: ' + errorThrown);
@@ -373,7 +375,7 @@
                 End: null,
                 ModuleId: 50,
                 Take: 2000,
-                '__RequestVerificationToken': host.find('input[name="__RequestVerificationToken"]').val()
+                '__RequestVerificationToken': document.body.dataset.antiforgery
             };
             $.ajax({
                 url: '@(Url.Action(MVC.API.Logging.RetrieveEvents()))',

Disco.Web/Areas/Config/Views/Enrolment/Status.generated.cs

@@ -71,18 +71,7 @@ WriteLiteral(" data-defaultdeviceprofileid=\"");
             #line hidden
 WriteLiteral("\"");
 
-WriteLiteral(">\r\n");
-
-WriteLiteral("    ");
-
-            
-            #line 11 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
-Write(Html.AntiForgeryToken());
-
-            
-            #line default
-            #line hidden
-WriteLiteral("\r\n    <div");
+WriteLiteral(">\r\n    <div");
 
 WriteLiteral(" id=\"noSessions\"");
 
@@ -182,14 +171,14 @@ WriteLiteral(" data-bind=\"visible: isPending\"");
 WriteLiteral(">\r\n");
 
             
-            #line 34 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
+            #line 33 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
                 
             
             #line default
             #line hidden
             
-            #line 34 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
-                 using (Html.BeginForm(MVC.API.Enrolment.ResolveSessionPending(), FormMethod.Post))
+            #line 33 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
+                 using (Html.BeginForm(MVC.API.Enrolment.ResolveSessionPending()))
                 {
 
             
@@ -202,20 +191,20 @@ WriteLiteral(" data-bind=\"text: pendingIdentifier\"");
 WriteLiteral("></code>\r\n");
 
             
-            #line 37 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
+            #line 36 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
                     
             
             #line default
             #line hidden
             
-            #line 37 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
+            #line 36 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
                Write(Html.AntiForgeryToken());
 
             
             #line default
             #line hidden
             
-            #line 37 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
+            #line 36 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
                                             ;
 
             
@@ -245,13 +234,13 @@ WriteLiteral(" data-bind=\"value: deviceProfileId\"");
 WriteLiteral(">\r\n");
 
             
-            #line 43 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
+            #line 42 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
                                 
             
             #line default
             #line hidden
             
-            #line 43 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
+            #line 42 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
                                  foreach (var deviceProfile in Model.DeviceProfiles)
                                 {
 
@@ -260,20 +249,20 @@ WriteLiteral(">\r\n");
             #line hidden
 WriteLiteral("                                    <option");
 
-WriteAttribute("value", Tuple.Create(" value=\"", 2814), Tuple.Create("\"", 2839)
+WriteAttribute("value", Tuple.Create(" value=\"", 2767), Tuple.Create("\"", 2792)
             
-            #line 45 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
-, Tuple.Create(Tuple.Create("", 2822), Tuple.Create<System.Object, System.Int32>(deviceProfile.Id
+            #line 44 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
+, Tuple.Create(Tuple.Create("", 2775), Tuple.Create<System.Object, System.Int32>(deviceProfile.Id
             
             #line default
             #line hidden
-, 2822), false)
+, 2775), false)
 );
 
 WriteLiteral(">");
 
             
-            #line 45 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
+            #line 44 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
                                                                  Write(deviceProfile.Name);
 
             
@@ -282,7 +271,7 @@ WriteLiteral(">");
 WriteLiteral(" (");
 
             
-            #line 45 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
+            #line 44 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
                                                                                       Write(deviceProfile.Id);
 
             
@@ -291,7 +280,7 @@ WriteLiteral(" (");
 WriteLiteral(")</option>\r\n");
 
             
-            #line 46 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
+            #line 45 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
                                 }
 
             
@@ -301,7 +290,7 @@ WriteLiteral("                            </select>\r\n                        <
 "            </div>\r\n");
 
             
-            #line 50 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
+            #line 49 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
                     if (Model.DeviceBatches.Count != 0)
                     {
 
@@ -326,13 +315,13 @@ WriteLiteral(" value=\"\"");
 WriteLiteral(" selected>&lt;None&gt;</option>\r\n");
 
             
-            #line 57 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
+            #line 56 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
                                     
             
             #line default
             #line hidden
             
-            #line 57 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
+            #line 56 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
                                      foreach (var deviceBatch in Model.DeviceBatches)
                                     {
 
@@ -341,20 +330,20 @@ WriteLiteral(" selected>&lt;None&gt;</option>\r\n");
             #line hidden
 WriteLiteral("                                        <option");
 
-WriteAttribute("value", Tuple.Create(" value=\"", 3596), Tuple.Create("\"", 3619)
+WriteAttribute("value", Tuple.Create(" value=\"", 3549), Tuple.Create("\"", 3572)
             
-            #line 59 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
-, Tuple.Create(Tuple.Create("", 3604), Tuple.Create<System.Object, System.Int32>(deviceBatch.Id
+            #line 58 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
+, Tuple.Create(Tuple.Create("", 3557), Tuple.Create<System.Object, System.Int32>(deviceBatch.Id
             
             #line default
             #line hidden
-, 3604), false)
+, 3557), false)
 );
 
 WriteLiteral(">");
 
             
-            #line 59 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
+            #line 58 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
                                                                    Write(deviceBatch.Name);
 
             
@@ -363,7 +352,7 @@ WriteLiteral(">");
 WriteLiteral(" (");
 
             
-            #line 59 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
+            #line 58 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
                                                                                       Write(deviceBatch.Id);
 
             
@@ -372,7 +361,7 @@ WriteLiteral(" (");
 WriteLiteral(")</option>\r\n");
 
             
-            #line 60 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
+            #line 59 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
                                     }
 
             
@@ -382,7 +371,7 @@ WriteLiteral("                                </select>\r\n
 "                        </div>\r\n");
 
             
-            #line 64 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
+            #line 63 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
                     }
 
             
@@ -417,7 +406,7 @@ WriteLiteral(" class=\"button\"");
 WriteLiteral(">Reject</button>\r\n                    </div>\r\n");
 
             
-            #line 70 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
+            #line 69 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
                 }
 
             
@@ -596,7 +585,7 @@ WriteLiteral(@">
         var deviceBaseUrl = '");
 
             
-            #line 149 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
+            #line 148 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
                          Write(Url.Action(MVC.Device.Show()));
 
             
@@ -605,7 +594,7 @@ WriteLiteral(@">
 WriteLiteral("/\'\r\n        var deviceModelImageUrl = \'");
 
             
-            #line 150 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
+            #line 149 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
                                Write(Url.Action(MVC.API.DeviceModel.Image()));
 
             
@@ -614,7 +603,7 @@ WriteLiteral("/\'\r\n        var deviceModelImageUrl = \'");
 WriteLiteral("/\'\r\n        var iconWarningUrl = \'url(");
 
             
-            #line 151 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
+            #line 150 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
                               Write(Links.ClientSource.Style.Images.Status.warning32_png);
 
             
@@ -623,7 +612,7 @@ WriteLiteral("/\'\r\n        var iconWarningUrl = \'url(");
 WriteLiteral(")\';\r\n        var iconErrorUrl = \'url(");
 
             
-            #line 152 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
+            #line 151 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
                             Write(Links.ClientSource.Style.Images.Status.fail32_png);
 
             
@@ -750,7 +739,7 @@ WriteLiteral(")\';\r\n\r\n        function pageViewModel() {\r\n            var
 "= new pageViewModel();\r\n            $.ajax({\r\n                url: \'");
 
             
-            #line 352 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
+            #line 351 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
                   Write(Url.Action(MVC.API.DeviceModel.Index()));
 
             
@@ -759,6 +748,9 @@ WriteLiteral(")\';\r\n\r\n        function pageViewModel() {\r\n            var
 WriteLiteral(@"',
                 dataType: 'json',
                 type: 'POST',
+                data: {
+                    '__RequestVerificationToken': document.body.dataset.antiforgery
+                },
                 success: init_loadedDeviceModels,
                 error: function (jqXHR, textStatus, errorThrown) {
                     alert('Unable to retrieve device models: ' + errorThrown);
@@ -780,13 +772,13 @@ WriteLiteral(@"',
                 End: null,
                 ModuleId: 50,
                 Take: 2000,
-                '__RequestVerificationToken': host.find('input[name=""__RequestVerificationToken""]').val()
+                '__RequestVerificationToken': document.body.dataset.antiforgery
             };
             $.ajax({
                 url: '");
 
             
-            #line 379 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
+            #line 381 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
                   Write(Url.Action(MVC.API.Logging.RetrieveEvents()));
 
             
@@ -825,7 +817,7 @@ WriteLiteral(@"',
             $.connection.hub.qs = { LogModules: '");
 
             
-            #line 409 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
+            #line 411 "..\..\Areas\Config\Views\Enrolment\Status.cshtml"
                                              Write(Disco.Services.Devices.Enrolment.EnrolmentLog.Current.LiveLogGroupName);
 
             

Disco.Web/Areas/Config/Views/Export/_Edit.cshtml

@@ -1,5 +1,5 @@
 @model Disco.Web.Areas.Config.Models.Export.EditModel
-@using (Html.BeginForm(MVC.API.Export.Update(), FormMethod.Post))
+@using (Html.BeginForm(MVC.API.Export.Update()))
 {
     @Html.AntiForgeryToken();
     @Html.HiddenFor(m => m.Id)
@@ -199,7 +199,7 @@
                 <i class="fa fa-exclamation-triangle"></i>Are you sure you want to delete the Saved @Model.ExportTypeName: @Model.Name?
             </p>
         </div>
-        @using (Html.BeginForm(MVC.API.Export.Delete(), FormMethod.Post))
+        @using (Html.BeginForm(MVC.API.Export.Delete()))
         {
             @Html.AntiForgeryToken()
             <input type="hidden" name="id" value="@Model.Id" />

Disco.Web/Areas/Config/Views/Export/_Edit.generated.cs

@@ -45,7 +45,7 @@ namespace Disco.Web.Areas.Config.Views.Export
         {
             
             #line 2 "..\..\Areas\Config\Views\Export\_Edit.cshtml"
- using (Html.BeginForm(MVC.API.Export.Update(), FormMethod.Post))
+ using (Html.BeginForm(MVC.API.Export.Update()))
 {
     
             
@@ -164,14 +164,14 @@ WriteLiteral("                        ");
 WriteLiteral("\r\n                        Enable Scheduled Export\r\n                    </label>\r\n" +
 "                </td>\r\n            </tr>\r\n            <tr");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 1306), Tuple.Create("\"", 1356)
+WriteAttribute("class", Tuple.Create(" class=\"", 1289), Tuple.Create("\"", 1339)
             
             #line 40 "..\..\Areas\Config\Views\Export\_Edit.cshtml"
-, Tuple.Create(Tuple.Create("", 1314), Tuple.Create<System.Object, System.Int32>(Model.ScheduleEnabled ? null : "hidden"
+, Tuple.Create(Tuple.Create("", 1297), Tuple.Create<System.Object, System.Int32>(Model.ScheduleEnabled ? null : "hidden"
             
             #line default
             #line hidden
-, 1314), false)
+, 1297), false)
 );
 
 WriteLiteral(">\r\n                <th>\r\n                    Days:\r\n                </th>\r\n      " +
@@ -245,14 +245,14 @@ WriteLiteral(" Saturday</label></li>\r\n                        <li><label>");
 WriteLiteral(" Sunday</label></li>\r\n                    </ul>\r\n                </td>\r\n         " +
 "   </tr>\r\n            <tr");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 2258), Tuple.Create("\"", 2308)
+WriteAttribute("class", Tuple.Create(" class=\"", 2241), Tuple.Create("\"", 2291)
             
             #line 56 "..\..\Areas\Config\Views\Export\_Edit.cshtml"
-, Tuple.Create(Tuple.Create("", 2266), Tuple.Create<System.Object, System.Int32>(Model.ScheduleEnabled ? null : "hidden"
+, Tuple.Create(Tuple.Create("", 2249), Tuple.Create<System.Object, System.Int32>(Model.ScheduleEnabled ? null : "hidden"
             
             #line default
             #line hidden
-, 2266), false)
+, 2249), false)
 );
 
 WriteLiteral(">\r\n                <th>\r\n                    Start Time:\r\n                </th>\r\n" +
@@ -300,14 +300,14 @@ WriteLiteral(">12:00 AM</option>\r\n");
             #line hidden
 WriteLiteral("                                <option");
 
-WriteAttribute("value", Tuple.Create(" value=\"", 2740), Tuple.Create("\"", 2750)
+WriteAttribute("value", Tuple.Create(" value=\"", 2723), Tuple.Create("\"", 2733)
             
             #line 66 "..\..\Areas\Config\Views\Export\_Edit.cshtml"
-, Tuple.Create(Tuple.Create("", 2748), Tuple.Create<System.Object, System.Int32>(i
+, Tuple.Create(Tuple.Create("", 2731), Tuple.Create<System.Object, System.Int32>(i
             
             #line default
             #line hidden
-, 2748), false)
+, 2731), false)
 );
 
 WriteLiteral(" ");
@@ -362,14 +362,14 @@ WriteLiteral(">12:00 PM</option>\r\n");
             #line hidden
 WriteLiteral("                                <option");
 
-WriteAttribute("value", Tuple.Create(" value=\"", 3102), Tuple.Create("\"", 3112)
+WriteAttribute("value", Tuple.Create(" value=\"", 3085), Tuple.Create("\"", 3095)
             
             #line 71 "..\..\Areas\Config\Views\Export\_Edit.cshtml"
-, Tuple.Create(Tuple.Create("", 3110), Tuple.Create<System.Object, System.Int32>(i
+, Tuple.Create(Tuple.Create("", 3093), Tuple.Create<System.Object, System.Int32>(i
             
             #line default
             #line hidden
-, 3110), false)
+, 3093), false)
 );
 
 WriteLiteral(" ");
@@ -418,14 +418,14 @@ WriteLiteral(@"></i> By default, Disco ICT shuts down at 1:30am and does not res
             </tr>
             <tr");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 3737), Tuple.Create("\"", 3787)
+WriteAttribute("class", Tuple.Create(" class=\"", 3720), Tuple.Create("\"", 3770)
             
             #line 82 "..\..\Areas\Config\Views\Export\_Edit.cshtml"
-, Tuple.Create(Tuple.Create("", 3745), Tuple.Create<System.Object, System.Int32>(Model.ScheduleEnabled ? null : "hidden"
+, Tuple.Create(Tuple.Create("", 3728), Tuple.Create<System.Object, System.Int32>(Model.ScheduleEnabled ? null : "hidden"
             
             #line default
             #line hidden
-, 3745), false)
+, 3728), false)
 );
 
 WriteLiteral(">\r\n                <th>\r\n                    Repeat Hourly Until:\r\n              " +
@@ -465,14 +465,14 @@ WriteLiteral(">Run once</option>\r\n");
             #line hidden
 WriteLiteral("                                <option");
 
-WriteAttribute("value", Tuple.Create(" value=\"", 4223), Tuple.Create("\"", 4233)
+WriteAttribute("value", Tuple.Create(" value=\"", 4206), Tuple.Create("\"", 4216)
             
             #line 92 "..\..\Areas\Config\Views\Export\_Edit.cshtml"
-, Tuple.Create(Tuple.Create("", 4231), Tuple.Create<System.Object, System.Int32>(i
+, Tuple.Create(Tuple.Create("", 4214), Tuple.Create<System.Object, System.Int32>(i
             
             #line default
             #line hidden
-, 4231), false)
+, 4214), false)
 );
 
 WriteLiteral(" ");
@@ -527,14 +527,14 @@ WriteLiteral(">12:00 PM</option>\r\n");
             #line hidden
 WriteLiteral("                                <option");
 
-WriteAttribute("value", Tuple.Create(" value=\"", 4581), Tuple.Create("\"", 4591)
+WriteAttribute("value", Tuple.Create(" value=\"", 4564), Tuple.Create("\"", 4574)
             
             #line 97 "..\..\Areas\Config\Views\Export\_Edit.cshtml"
-, Tuple.Create(Tuple.Create("", 4589), Tuple.Create<System.Object, System.Int32>(i
+, Tuple.Create(Tuple.Create("", 4572), Tuple.Create<System.Object, System.Int32>(i
             
             #line default
             #line hidden
-, 4589), false)
+, 4572), false)
 );
 
 WriteLiteral(" ");
@@ -567,14 +567,14 @@ WriteLiteral(":00 PM</option>\r\n");
 WriteLiteral("\r\n                    </select>\r\n                </td>\r\n            </tr>\r\n      " +
 "      <tr");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 4815), Tuple.Create("\"", 4865)
+WriteAttribute("class", Tuple.Create(" class=\"", 4798), Tuple.Create("\"", 4848)
             
             #line 103 "..\..\Areas\Config\Views\Export\_Edit.cshtml"
-, Tuple.Create(Tuple.Create("", 4823), Tuple.Create<System.Object, System.Int32>(Model.ScheduleEnabled ? null : "hidden"
+, Tuple.Create(Tuple.Create("", 4806), Tuple.Create<System.Object, System.Int32>(Model.ScheduleEnabled ? null : "hidden"
             
             #line default
             #line hidden
-, 4823), false)
+, 4806), false)
 );
 
 WriteLiteral(">\r\n                <th>\r\n                    File System Location:\r\n             " +
@@ -709,29 +709,29 @@ WriteLiteral(" type=\"hidden\"");
 
 WriteLiteral(" name=\"OnDemandPrincipals\"");
 
-WriteAttribute("value", Tuple.Create(" value=\"", 6700), Tuple.Create("\"", 6714)
+WriteAttribute("value", Tuple.Create(" value=\"", 6683), Tuple.Create("\"", 6697)
             
             #line 141 "..\..\Areas\Config\Views\Export\_Edit.cshtml"
-          , Tuple.Create(Tuple.Create("", 6708), Tuple.Create<System.Object, System.Int32>(sg.Id
+          , Tuple.Create(Tuple.Create("", 6691), Tuple.Create<System.Object, System.Int32>(sg.Id
             
             #line default
             #line hidden
-, 6708), false)
+, 6691), false)
 );
 
 WriteLiteral(" />\r\n                                    <i");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 6758), Tuple.Create("\"", 6808)
-, Tuple.Create(Tuple.Create("", 6766), Tuple.Create("fa", 6766), true)
-, Tuple.Create(Tuple.Create(" ", 6768), Tuple.Create("fa-user", 6769), true)
+WriteAttribute("class", Tuple.Create(" class=\"", 6741), Tuple.Create("\"", 6791)
+, Tuple.Create(Tuple.Create("", 6749), Tuple.Create("fa", 6749), true)
+, Tuple.Create(Tuple.Create(" ", 6751), Tuple.Create("fa-user", 6752), true)
             
             #line 142 "..\..\Areas\Config\Views\Export\_Edit.cshtml"
-, Tuple.Create(Tuple.Create("", 6776), Tuple.Create<System.Object, System.Int32>(sg.IsGroup ? "s" : null
+, Tuple.Create(Tuple.Create("", 6759), Tuple.Create<System.Object, System.Int32>(sg.IsGroup ? "s" : null
             
             #line default
             #line hidden
-, 6776), false)
-, Tuple.Create(Tuple.Create(" ", 6802), Tuple.Create("fa-lg", 6803), true)
+, 6759), false)
+, Tuple.Create(Tuple.Create(" ", 6785), Tuple.Create("fa-lg", 6786), true)
 );
 
 WriteLiteral("></i>\r\n");
@@ -874,14 +874,14 @@ WriteLiteral("                <tr>\r\n                    <th>Link</th>\r\n
 
 WriteLiteral(" type=\"text\"");
 
-WriteAttribute("value", Tuple.Create(" value=\"", 8472), Tuple.Create("\"", 8485)
+WriteAttribute("value", Tuple.Create(" value=\"", 8455), Tuple.Create("\"", 8468)
             
             #line 171 "..\..\Areas\Config\Views\Export\_Edit.cshtml"
-, Tuple.Create(Tuple.Create("", 8480), Tuple.Create<System.Object, System.Int32>(link
+, Tuple.Create(Tuple.Create("", 8463), Tuple.Create<System.Object, System.Int32>(link
             
             #line default
             #line hidden
-, 8480), false)
+, 8463), false)
 );
 
 WriteLiteral(" style=\"width: 90%;\"");
@@ -928,14 +928,14 @@ WriteLiteral(">\r\n");
             #line hidden
 WriteLiteral("                <a");
 
-WriteAttribute("href", Tuple.Create(" href=\"", 8776), Tuple.Create("\"", 8836)
+WriteAttribute("href", Tuple.Create(" href=\"", 8759), Tuple.Create("\"", 8819)
             
             #line 183 "..\..\Areas\Config\Views\Export\_Edit.cshtml"
-, Tuple.Create(Tuple.Create("", 8783), Tuple.Create<System.Object, System.Int32>(Url.Action(MVC.Config.Export.RunScheduled(Model.Id))
+, Tuple.Create(Tuple.Create("", 8766), Tuple.Create<System.Object, System.Int32>(Url.Action(MVC.Config.Export.RunScheduled(Model.Id))
             
             #line default
             #line hidden
-, 8783), false)
+, 8766), false)
 );
 
 WriteLiteral(" class=\"button\"");
@@ -952,14 +952,14 @@ WriteLiteral(">Schedule Now</a>\r\n");
             #line hidden
 WriteLiteral("            <a");
 
-WriteAttribute("href", Tuple.Create(" href=\"", 8902), Tuple.Create("\"", 8953)
+WriteAttribute("href", Tuple.Create(" href=\"", 8885), Tuple.Create("\"", 8936)
             
             #line 186 "..\..\Areas\Config\Views\Export\_Edit.cshtml"
-, Tuple.Create(Tuple.Create("", 8909), Tuple.Create<System.Object, System.Int32>(Url.Action(MVC.Config.Export.Run(Model.Id))
+, Tuple.Create(Tuple.Create("", 8892), Tuple.Create<System.Object, System.Int32>(Url.Action(MVC.Config.Export.Run(Model.Id))
             
             #line default
             #line hidden
-, 8909), false)
+, 8892), false)
 );
 
 WriteLiteral(" class=\"button\"");
@@ -1017,24 +1017,24 @@ WriteLiteral("    <div");
 
 WriteLiteral(" id=\"Config_Export_Edit_DeleteDialog\"");
 
-WriteAttribute("title", Tuple.Create(" title=\"", 9256), Tuple.Create("\"", 9311)
-, Tuple.Create(Tuple.Create("", 9264), Tuple.Create("Delete", 9264), true)
-, Tuple.Create(Tuple.Create(" ", 9270), Tuple.Create("Saved", 9271), true)
+WriteAttribute("title", Tuple.Create(" title=\"", 9239), Tuple.Create("\"", 9294)
+, Tuple.Create(Tuple.Create("", 9247), Tuple.Create("Delete", 9247), true)
+, Tuple.Create(Tuple.Create(" ", 9253), Tuple.Create("Saved", 9254), true)
             
             #line 196 "..\..\Areas\Config\Views\Export\_Edit.cshtml"
-, Tuple.Create(Tuple.Create(" ", 9276), Tuple.Create<System.Object, System.Int32>(Model.ExportTypeName
+, Tuple.Create(Tuple.Create(" ", 9259), Tuple.Create<System.Object, System.Int32>(Model.ExportTypeName
             
             #line default
             #line hidden
-, 9277), false)
-, Tuple.Create(Tuple.Create("", 9298), Tuple.Create(":", 9298), true)
+, 9260), false)
+, Tuple.Create(Tuple.Create("", 9281), Tuple.Create(":", 9281), true)
             
             #line 196 "..\..\Areas\Config\Views\Export\_Edit.cshtml"
-        , Tuple.Create(Tuple.Create(" ", 9299), Tuple.Create<System.Object, System.Int32>(Model.Name
+        , Tuple.Create(Tuple.Create(" ", 9282), Tuple.Create<System.Object, System.Int32>(Model.Name
             
             #line default
             #line hidden
-, 9300), false)
+, 9283), false)
 );
 
 WriteLiteral(" class=\"dialog\"");
@@ -1079,7 +1079,7 @@ WriteLiteral("?\r\n            </p>\r\n        </div>\r\n");
             #line hidden
             
             #line 202 "..\..\Areas\Config\Views\Export\_Edit.cshtml"
-         using (Html.BeginForm(MVC.API.Export.Delete(), FormMethod.Post))
+         using (Html.BeginForm(MVC.API.Export.Delete()))
         {
             
             
@@ -1105,14 +1105,14 @@ WriteLiteral(" type=\"hidden\"");
 
 WriteLiteral(" name=\"id\"");
 
-WriteAttribute("value", Tuple.Create(" value=\"", 9729), Tuple.Create("\"", 9746)
+WriteAttribute("value", Tuple.Create(" value=\"", 9695), Tuple.Create("\"", 9712)
             
             #line 205 "..\..\Areas\Config\Views\Export\_Edit.cshtml"
-, Tuple.Create(Tuple.Create("", 9737), Tuple.Create<System.Object, System.Int32>(Model.Id
+, Tuple.Create(Tuple.Create("", 9703), Tuple.Create<System.Object, System.Int32>(Model.Id
             
             #line default
             #line hidden
-, 9737), false)
+, 9703), false)
 );
 
 WriteLiteral(" />\r\n");

Disco.Web/Areas/Config/Views/JobPreferences/Parts/Locations.cshtml

@@ -8,68 +8,75 @@
     <h2>Job Locations</h2>
     <table>
         <tr>
-            <th style="width: 140px">Mode:
+            <th style="width: 140px">
+                Mode:
             </th>
-            <td>@if (canConfig)
+            <td>
+                @if (canConfig)
                 {
-                @Html.DropDownListFor(model => model.LocationMode, Model.LocationModeOptions().Select(o => new SelectListItem() { Value = o.Key.ToString(), Text = o.Value }))
-                @AjaxHelpers.AjaxSave()
-                @AjaxHelpers.AjaxLoader()
-                <div id="Config_Location_Unrestricted">
-                    <div class="info-box">
-                        <p class="fa-p">
-                            <i class="fa fa-info-circle"></i>Technicians will be able to specify <em>any</em> value when entering a location. A selection of locations used historically will be offered.
-                        </p>
-                    </div>
-                </div>
-                <div id="Config_Location_List">
-                    <a id="Config_Location_List_Button" href="#" class="button small">Update List</a> <a id="Config_Location_List_ImportButton" href="#" class="button small">Import List</a>
-                    <div id="Config_Location_List_Dialog" class="dialog" title="Locations">
-                        <div id="Config_Location_List_Dialog_ListContainer">
-                            <span id="Config_Location_List_Dialog_None" class="smallMessage">The List is Empty</span>
-                            <ul id="Config_Location_List_Dialog_List" class="none">
-                                @foreach (var loc in Model.LocationList)
-                                {
-                                    <li data-location="@loc">@loc<i class="fa fa-times-circle remove"></i></li>
-                                }
-                            </ul>
+                    @Html.DropDownListFor(model => model.LocationMode, Model.LocationModeOptions().Select(o => new SelectListItem() { Value = o.Key.ToString(), Text = o.Value }))
+                    @AjaxHelpers.AjaxSave()
+                    @AjaxHelpers.AjaxLoader()
+                    <div id="Config_Location_Unrestricted">
+                        <div class="info-box">
+                            <p class="fa-p">
+                                <i class="fa fa-info-circle"></i>Technicians will be able to specify <em>any</em> value when entering a location. A selection of locations used historically will be offered.
+                            </p>
                         </div>
-                        <div id="Config_Location_List_Dialog_AddContainer">
-                            <input type="text" id="Config_Location_List_Dialog_TextAdd" />
-                            <a id="Config_Location_List_Dialog_Add" href="#" class="button small">Add</a>
+                    </div>
+                    <div id="Config_Location_List">
+                        <a id="Config_Location_List_Button" href="#" class="button small">Update List</a> <a id="Config_Location_List_ImportButton" href="#" class="button small">Import List</a>
+                        <div id="Config_Location_List_Dialog" class="dialog" title="Locations">
+                            @using (Html.BeginForm(MVC.API.JobPreferences.UpdateLocationList(null, redirect: true)))
+                            {
+                                @Html.AntiForgeryToken()
+                                <div id="Config_Location_List_Dialog_ListContainer">
+                                    <span id="Config_Location_List_Dialog_None" class="smallMessage">The List is Empty</span>
+                                    <ul id="Config_Location_List_Dialog_List" class="none">
+                                        @foreach (var loc in Model.LocationList)
+                                        {
+                                            <li data-location="@loc"><input type="hidden" name="locationList" value="@loc" />@loc<i class="fa fa-times-circle remove"></i></li>
+                                        }
+                                    </ul>
+                                </div>
+                            }
+                            <div id="Config_Location_List_Dialog_AddContainer">
+                                <input type="text" id="Config_Location_List_Dialog_TextAdd" />
+                                <button id="Config_Location_List_Dialog_Add" type="button" class="button small">Add</button>
+                            </div>
+                        </div>
+                        <div id="Config_Location_ListImport_Dialog" class="dialog" title="Import Locations">
+                            @using (Html.BeginForm(MVC.API.JobPreferences.ImportLocationList(null, redirect: true)))
+                            {
+                                @Html.AntiForgeryToken()
+                                <input type="hidden" id="Config_Location_ListImport_Dialog_AutomaticList" name="AutomaticList" value="False" />
+                                <div id="Config_Location_ListImport_Dialog_Overwrite_Container">
+                                    <input type="checkbox" id="Config_Location_ListImport_Dialog_Overwrite" name="Override" value="True" /><label for="Config_Location_ListImport_Dialog_Overwrite">Override Existing List</label>
+                                </div>
+                                <textarea id="Config_Location_ListImport_Dialog_LocationList" name="LocationList"></textarea>
+                                <div class="info-box">
+                                    <p class="fa-p">
+                                        <i class="fa fa-info-circle"></i>Enter multiple locations separated by <code>&lt;new line&gt;</code>, commas (<code>,</code>) or semicolons (<code>;</code>).
+                                    </p>
+                                </div>
+                            }
                         </div>
-                        <form id="Config_Location_List_Dialog_Form" action="@(Url.Action(MVC.API.JobPreferences.UpdateLocationList(null, redirect: true)))" method="post"></form>
                     </div>
-                    <div id="Config_Location_ListImport_Dialog" class="dialog" title="Import Locations">
-                        <form id="Config_Location_ListImport_Dialog_Form" action="@(Url.Action(MVC.API.JobPreferences.ImportLocationList(null, redirect: true)))" method="post">
-                            <input type="hidden" id="Config_Location_ListImport_Dialog_AutomaticList" name="AutomaticList" value="False" />
-                            <div id="Config_Location_ListImport_Dialog_Overwrite_Container">
-                                <input type="checkbox" id="Config_Location_ListImport_Dialog_Overwrite" name="Override" value="True" /><label for="Config_Location_ListImport_Dialog_Overwrite">Override Existing List</label>
-                            </div>
-                            <textarea id="Config_Location_ListImport_Dialog_LocationList" name="LocationList"></textarea>
-                            <div class="info-box">
-                                <p class="fa-p">
-                                    <i class="fa fa-info-circle"></i>Enter multiple locations separated by <code>&lt;new line&gt;</code>, commas (<code>,</code>) or semicolons (<code>;</code>).
-                                </p>
-                            </div>
-                        </form>
+                    <div id="Config_Location_Optional">
+                        <div class="info-box">
+                            <p class="fa-p">
+                                <i class="fa fa-info-circle"></i>Technicians will be able to specify <em>any</em> value when entering a location. A defined list of location options is suggested.
+                            </p>
+                        </div>
                     </div>
-                </div>
-                <div id="Config_Location_Optional">
-                    <div class="info-box">
-                        <p class="fa-p">
-                            <i class="fa fa-info-circle"></i>Technicians will be able to specify <em>any</em> value when entering a location. A defined list of location options is suggested.
-                        </p>
+                    <div id="Config_Location_Restricted">
+                        <div class="info-box">
+                            <p class="fa-p">
+                                <i class="fa fa-info-circle"></i>Technicians are restricted to select a location from the defined list.
+                            </p>
+                        </div>
                     </div>
-                </div>
-                <div id="Config_Location_Restricted">
-                    <div class="info-box">
-                        <p class="fa-p">
-                            <i class="fa fa-info-circle"></i>Technicians are restricted to select a location from the defined list.
-                        </p>
-                    </div>
-                </div>
-                <script type="text/javascript">
+                    <script type="text/javascript">
                     $(function () {
                         document.DiscoFunctions.PropertyChangeHelper(
                             $('#LocationMode'),
@@ -114,7 +121,7 @@
                         update();
                         $locationMode.change(update);
 
-                        var dialog, textAdd, list, noList, form;
+                        var dialog, textAdd, list, originalList, noList, form;
 
                         $('#Config_Location_List_Button').click(showDialog);
 
@@ -134,6 +141,7 @@
                                 dialog.on('click', '.remove', remove);
 
                                 list = $('#Config_Location_List_Dialog_List');
+                                originalList = list.html();
                                 noList = $('#Config_Location_List_Dialog_None');
 
                                 textAdd = $('#Config_Location_List_Dialog_TextAdd');
@@ -155,28 +163,11 @@
 
                         function cancel() {
                             $(this).dialog("close");
-
-                            list.find('li').each(function () {
-                                $this = $(this);
-                                if ($this.is('[data-status="new"]')) {
-                                    $this.remove();
-                                } else {
-                                    if ($this.is('[data-status="removed"]')) {
-                                        $this.show();
-                                        $this.attr('data-status', '')
-                                    }
-                                }
-                            });
+                            list.html(originalList);
                         }
 
                         function remove() {
-                            $this = $(this).closest('li');
-
-                            if ($this.is('[data-status="new"]')) {
-                                $this.remove();
-                            } else {
-                                $this.attr('data-status', 'removed').hide();
-                            }
+                            $(this).closest('li').remove();
 
                             updateNoList();
                         }
@@ -194,7 +185,7 @@
                             }
 
                             // Already Exists
-                            var existingValues = list.find('li[data-location]').filter('[data-status!="removed"]').map(function () { return $(this).attr('data-location') }).get();
+                            var existingValues = list.find('li[data-location]').map(function () { return $(this).attr('data-location') }).get();
                             if (jQuery.inArray(value, existingValues) >= 0) {
                                 alert('That item already exists in the list');
                                 return;
@@ -202,6 +193,7 @@
 
                             // Add Item
                             var li = $('<li>')
+                                .append($('<input>').attr({ type: 'hidden', name: 'locationList', value: value }))
                                 .append($('<span>').text(value))
                                 .append($('<i>').addClass('fa fa-times-circle remove'))
                                 .attr('data-location', value)
@@ -222,21 +214,7 @@
                         }
 
                         function saveChanges() {
-                            var form = $('#Config_Location_List_Dialog_Form').empty();
-
-                            list.find('li[data-status!="removed"]').each(function () {
-                                var location = $(this).attr('data-location');
-
-                                form.append($('<input>').attr({
-                                    'name': 'LocationList',
-                                    'type': 'hidden'
-                                }).val(location));
-
-                            }).get();
-
-                            form.submit();
-
-                            dialog.dialog("disable");
+                            dialog.find('form').submit();
                             dialog.dialog("option", "buttons", null);
                         }
 
@@ -276,11 +254,11 @@
                         }
 
                     });
-                </script>
+                    </script>
                 }
                 else
                 {
-                @Model.LocationModeOptions().First(o => o.Key == Model.LocationMode.ToString()).Value
+                    @Model.LocationModeOptions().First(o => o.Key == Model.LocationMode.ToString()).Value
                 }
             </td>
         </tr>

Disco.Web/Areas/Config/Views/JobPreferences/Parts/Locations.generated.cs

@@ -65,83 +65,90 @@ WriteLiteral(">\r\n    <h2>Job Locations</h2>\r\n    <table>\r\n        <tr>\r\n
 
 WriteLiteral(" style=\"width: 140px\"");
 
-WriteLiteral(">Mode:\r\n            </th>\r\n            <td>");
+WriteLiteral(">\r\n                Mode:\r\n            </th>\r\n            <td>\r\n");
 
             
-            #line 13 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
+            #line 15 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
+                
+            
+            #line default
+            #line hidden
+            
+            #line 15 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
                  if (canConfig)
                 {
-                
-            
-            #line default
-            #line hidden
-            
-            #line 15 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
-           Write(Html.DropDownListFor(model => model.LocationMode, Model.LocationModeOptions().Select(o => new SelectListItem() { Value = o.Key.ToString(), Text = o.Value })));
-
-            
-            #line default
-            #line hidden
-            
-            #line 15 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
-                                                                                                                                                                              
-                
-            
-            #line default
-            #line hidden
-            
-            #line 16 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
-           Write(AjaxHelpers.AjaxSave());
-
-            
-            #line default
-            #line hidden
-            
-            #line 16 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
-                                       
-                
+                    
             
             #line default
             #line hidden
             
             #line 17 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
-           Write(AjaxHelpers.AjaxLoader());
+               Write(Html.DropDownListFor(model => model.LocationMode, Model.LocationModeOptions().Select(o => new SelectListItem() { Value = o.Key.ToString(), Text = o.Value })));
 
             
             #line default
             #line hidden
             
             #line 17 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
-                                         
+                                                                                                                                                                                  
+                    
+            
+            #line default
+            #line hidden
+            
+            #line 18 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
+               Write(AjaxHelpers.AjaxSave());
 
             
             #line default
             #line hidden
-WriteLiteral("                <div");
+            
+            #line 18 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
+                                           
+                    
+            
+            #line default
+            #line hidden
+            
+            #line 19 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
+               Write(AjaxHelpers.AjaxLoader());
+
+            
+            #line default
+            #line hidden
+            
+            #line 19 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
+                                             
+
+            
+            #line default
+            #line hidden
+WriteLiteral("                    <div");
 
 WriteLiteral(" id=\"Config_Location_Unrestricted\"");
 
-WriteLiteral(">\r\n                    <div");
+WriteLiteral(">\r\n                        <div");
 
 WriteLiteral(" class=\"info-box\"");
 
-WriteLiteral(">\r\n                        <p");
+WriteLiteral(">\r\n                            <p");
 
 WriteLiteral(" class=\"fa-p\"");
 
-WriteLiteral(">\r\n                            <i");
+WriteLiteral(">\r\n                                <i");
 
 WriteLiteral(" class=\"fa fa-info-circle\"");
 
 WriteLiteral("></i>Technicians will be able to specify <em>any</em> value when entering a locat" +
 "ion. A selection of locations used historically will be offered.\r\n              " +
-"          </p>\r\n                    </div>\r\n                </div>\r\n");
+"              </p>\r\n                        </div>\r\n                    </div>\r\n" +
+"");
 
-WriteLiteral("                <div");
+WriteLiteral("                    <div");
 
 WriteLiteral(" id=\"Config_Location_List\"");
 
-WriteLiteral(">\r\n                    <a");
+WriteLiteral(">\r\n                        <a");
 
 WriteLiteral(" id=\"Config_Location_List_Button\"");
 
@@ -157,7 +164,7 @@ WriteLiteral(" href=\"#\"");
 
 WriteLiteral(" class=\"button small\"");
 
-WriteLiteral(">Import List</a>\r\n                    <div");
+WriteLiteral(">Import List</a>\r\n                        <div");
 
 WriteLiteral(" id=\"Config_Location_List_Dialog\"");
 
@@ -165,17 +172,47 @@ WriteLiteral(" class=\"dialog\"");
 
 WriteLiteral(" title=\"Locations\"");
 
-WriteLiteral(">\r\n                        <div");
+WriteLiteral(">\r\n");
+
+            
+            #line 30 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
+                            
+            
+            #line default
+            #line hidden
+            
+            #line 30 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
+                             using (Html.BeginForm(MVC.API.JobPreferences.UpdateLocationList(null, redirect: true)))
+                            {
+                                
+            
+            #line default
+            #line hidden
+            
+            #line 32 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
+                           Write(Html.AntiForgeryToken());
+
+            
+            #line default
+            #line hidden
+            
+            #line 32 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
+                                                        
+
+            
+            #line default
+            #line hidden
+WriteLiteral("                                <div");
 
 WriteLiteral(" id=\"Config_Location_List_Dialog_ListContainer\"");
 
-WriteLiteral(">\r\n                            <span");
+WriteLiteral(">\r\n                                    <span");
 
 WriteLiteral(" id=\"Config_Location_List_Dialog_None\"");
 
 WriteLiteral(" class=\"smallMessage\"");
 
-WriteLiteral(">The List is Empty</span>\r\n                            <ul");
+WriteLiteral(">The List is Empty</span>\r\n                                    <ul");
 
 WriteLiteral(" id=\"Config_Location_List_Dialog_List\"");
 
@@ -184,37 +221,53 @@ WriteLiteral(" class=\"none\"");
 WriteLiteral(">\r\n");
 
             
-            #line 31 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
-                                
+            #line 36 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
+                                        
             
             #line default
             #line hidden
             
-            #line 31 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
-                                 foreach (var loc in Model.LocationList)
-                                {
+            #line 36 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
+                                         foreach (var loc in Model.LocationList)
+                                        {
 
             
             #line default
             #line hidden
-WriteLiteral("                                    <li");
+WriteLiteral("                                            <li");
 
 WriteLiteral(" data-location=\"");
 
             
-            #line 33 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
-                                                  Write(loc);
+            #line 38 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
+                                                          Write(loc);
 
             
             #line default
             #line hidden
 WriteLiteral("\"");
 
-WriteLiteral(">");
+WriteLiteral("><input");
+
+WriteLiteral(" type=\"hidden\"");
+
+WriteLiteral(" name=\"locationList\"");
+
+WriteAttribute("value", Tuple.Create(" value=\"", 2305), Tuple.Create("\"", 2317)
+            
+            #line 38 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
+                                     , Tuple.Create(Tuple.Create("", 2313), Tuple.Create<System.Object, System.Int32>(loc
+            
+            #line default
+            #line hidden
+, 2313), false)
+);
+
+WriteLiteral(" />");
 
             
-            #line 33 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
-                                                        Write(loc);
+            #line 38 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
+                                                                                                                        Write(loc);
 
             
             #line default
@@ -226,48 +279,42 @@ WriteLiteral(" class=\"fa fa-times-circle remove\"");
 WriteLiteral("></i></li>\r\n");
 
             
-            #line 34 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
-                                }
+            #line 39 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
+                                        }
 
             
             #line default
             #line hidden
-WriteLiteral("                            </ul>\r\n                        </div>\r\n              " +
-"          <div");
+WriteLiteral("                                    </ul>\r\n                                </div>" +
+"\r\n");
+
+            
+            #line 42 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
+                            }
+
+            
+            #line default
+            #line hidden
+WriteLiteral("                            <div");
 
 WriteLiteral(" id=\"Config_Location_List_Dialog_AddContainer\"");
 
-WriteLiteral(">\r\n                            <input");
+WriteLiteral(">\r\n                                <input");
 
 WriteLiteral(" type=\"text\"");
 
 WriteLiteral(" id=\"Config_Location_List_Dialog_TextAdd\"");
 
-WriteLiteral(" />\r\n                            <a");
+WriteLiteral(" />\r\n                                <button");
 
 WriteLiteral(" id=\"Config_Location_List_Dialog_Add\"");
 
-WriteLiteral(" href=\"#\"");
+WriteLiteral(" type=\"button\"");
 
 WriteLiteral(" class=\"button small\"");
 
-WriteLiteral(">Add</a>\r\n                        </div>\r\n                        <form");
-
-WriteLiteral(" id=\"Config_Location_List_Dialog_Form\"");
-
-WriteAttribute("action", Tuple.Create(" action=\"", 2451), Tuple.Create("\"", 2538)
-            
-            #line 41 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
-, Tuple.Create(Tuple.Create("", 2460), Tuple.Create<System.Object, System.Int32>(Url.Action(MVC.API.JobPreferences.UpdateLocationList(null, redirect: true))
-            
-            #line default
-            #line hidden
-, 2460), false)
-);
-
-WriteLiteral(" method=\"post\"");
-
-WriteLiteral("></form>\r\n                    </div>\r\n                    <div");
+WriteLiteral(">Add</button>\r\n                            </div>\r\n                        </div>" +
+"\r\n                        <div");
 
 WriteLiteral(" id=\"Config_Location_ListImport_Dialog\"");
 
@@ -275,23 +322,37 @@ WriteLiteral(" class=\"dialog\"");
 
 WriteLiteral(" title=\"Import Locations\"");
 
-WriteLiteral(">\r\n                        <form");
+WriteLiteral(">\r\n");
 
-WriteLiteral(" id=\"Config_Location_ListImport_Dialog_Form\"");
-
-WriteAttribute("action", Tuple.Create(" action=\"", 2770), Tuple.Create("\"", 2857)
             
-            #line 44 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
-   , Tuple.Create(Tuple.Create("", 2779), Tuple.Create<System.Object, System.Int32>(Url.Action(MVC.API.JobPreferences.ImportLocationList(null, redirect: true))
+            #line 49 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
+                            
             
             #line default
             #line hidden
-, 2779), false)
-);
+            
+            #line 49 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
+                             using (Html.BeginForm(MVC.API.JobPreferences.ImportLocationList(null, redirect: true)))
+                            {
+                                
+            
+            #line default
+            #line hidden
+            
+            #line 51 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
+                           Write(Html.AntiForgeryToken());
 
-WriteLiteral(" method=\"post\"");
+            
+            #line default
+            #line hidden
+            
+            #line 51 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
+                                                        
 
-WriteLiteral(">\r\n                            <input");
+            
+            #line default
+            #line hidden
+WriteLiteral("                                <input");
 
 WriteLiteral(" type=\"hidden\"");
 
@@ -301,11 +362,13 @@ WriteLiteral(" name=\"AutomaticList\"");
 
 WriteLiteral(" value=\"False\"");
 
-WriteLiteral(" />\r\n                            <div");
+WriteLiteral(" />\r\n");
+
+WriteLiteral("                                <div");
 
 WriteLiteral(" id=\"Config_Location_ListImport_Dialog_Overwrite_Container\"");
 
-WriteLiteral(">\r\n                                <input");
+WriteLiteral(">\r\n                                    <input");
 
 WriteLiteral(" type=\"checkbox\"");
 
@@ -319,73 +382,82 @@ WriteLiteral(" /><label");
 
 WriteLiteral(" for=\"Config_Location_ListImport_Dialog_Overwrite\"");
 
-WriteLiteral(">Override Existing List</label>\r\n                            </div>\r\n            " +
-"                <textarea");
+WriteLiteral(">Override Existing List</label>\r\n                                </div>\r\n");
+
+WriteLiteral("                                <textarea");
 
 WriteLiteral(" id=\"Config_Location_ListImport_Dialog_LocationList\"");
 
 WriteLiteral(" name=\"LocationList\"");
 
-WriteLiteral("></textarea>\r\n                            <div");
+WriteLiteral("></textarea>\r\n");
+
+WriteLiteral("                                <div");
 
 WriteLiteral(" class=\"info-box\"");
 
-WriteLiteral(">\r\n                                <p");
+WriteLiteral(">\r\n                                    <p");
 
 WriteLiteral(" class=\"fa-p\"");
 
-WriteLiteral(">\r\n                                    <i");
+WriteLiteral(">\r\n                                        <i");
 
 WriteLiteral(" class=\"fa fa-info-circle\"");
 
-WriteLiteral(@"></i>Enter multiple locations separated by <code>&lt;new line&gt;</code>, commas (<code>,</code>) or semicolons (<code>;</code>).
-                                </p>
-                            </div>
-                        </form>
-                    </div>
-                </div>
-");
+WriteLiteral("></i>Enter multiple locations separated by <code>&lt;new line&gt;</code>, commas " +
+"(<code>,</code>) or semicolons (<code>;</code>).\r\n                              " +
+"      </p>\r\n                                </div>\r\n");
 
-WriteLiteral("                <div");
+            
+            #line 62 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
+                            }
+
+            
+            #line default
+            #line hidden
+WriteLiteral("                        </div>\r\n                    </div>\r\n");
+
+WriteLiteral("                    <div");
 
 WriteLiteral(" id=\"Config_Location_Optional\"");
 
-WriteLiteral(">\r\n                    <div");
+WriteLiteral(">\r\n                        <div");
 
 WriteLiteral(" class=\"info-box\"");
 
-WriteLiteral(">\r\n                        <p");
+WriteLiteral(">\r\n                            <p");
 
 WriteLiteral(" class=\"fa-p\"");
 
-WriteLiteral(">\r\n                            <i");
+WriteLiteral(">\r\n                                <i");
 
 WriteLiteral(" class=\"fa fa-info-circle\"");
 
 WriteLiteral("></i>Technicians will be able to specify <em>any</em> value when entering a locat" +
-"ion. A defined list of location options is suggested.\r\n                        <" +
-"/p>\r\n                    </div>\r\n                </div>\r\n");
+"ion. A defined list of location options is suggested.\r\n                         " +
+"   </p>\r\n                        </div>\r\n                    </div>\r\n");
 
-WriteLiteral("                <div");
+WriteLiteral("                    <div");
 
 WriteLiteral(" id=\"Config_Location_Restricted\"");
 
-WriteLiteral(">\r\n                    <div");
+WriteLiteral(">\r\n                        <div");
 
 WriteLiteral(" class=\"info-box\"");
 
-WriteLiteral(">\r\n                        <p");
+WriteLiteral(">\r\n                            <p");
 
 WriteLiteral(" class=\"fa-p\"");
 
-WriteLiteral(">\r\n                            <i");
+WriteLiteral(">\r\n                                <i");
 
 WriteLiteral(" class=\"fa fa-info-circle\"");
 
 WriteLiteral("></i>Technicians are restricted to select a location from the defined list.\r\n    " +
-"                    </p>\r\n                    </div>\r\n                </div>\r\n");
+"                        </p>\r\n                        </div>\r\n                  " +
+"  </div>\r\n");
 
-WriteLiteral("                <script");
+WriteLiteral("                    <script");
 
 WriteLiteral(" type=\"text/javascript\"");
 
@@ -394,7 +466,7 @@ WriteLiteral(">\r\n                    $(function () {\r\n
 "                           null,\r\n                            \'");
 
             
-            #line 77 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
+            #line 84 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
                          Write(Url.Action(MVC.API.JobPreferences.UpdateLocationMode()));
 
             
@@ -424,117 +496,102 @@ WriteLiteral("\',\r\n                            \'LocationMode\');\r\n\r\n
 "    $Config_Location_Restricted.show();\r\n                                    bre" +
 "ak;\r\n                            }\r\n                        }\r\n                 " +
 "       update();\r\n                        $locationMode.change(update);\r\n\r\n     " +
-"                   var dialog, textAdd, list, noList, form;\r\n\r\n                 " +
-"       $(\'#Config_Location_List_Button\').click(showDialog);\r\n\r\n                 " +
-"       function showDialog() {\r\n                            if (!dialog) {\r\n    " +
-"                            dialog = $(\'#Config_Location_List_Dialog\').dialog({\r" +
-"\n                                    resizable: false,\r\n                        " +
-"            modal: true,\r\n                                    autoOpen: false,\r\n" +
-"                                    width: 350,\r\n                               " +
-"     buttons: {\r\n                                        \"Save Changes\": saveCha" +
-"nges,\r\n                                        Cancel: cancel\r\n                 " +
-"                   }\r\n                                });\r\n\r\n                   " +
-"             dialog.on(\'click\', \'.remove\', remove);\r\n\r\n                         " +
-"       list = $(\'#Config_Location_List_Dialog_List\');\r\n                         " +
-"       noList = $(\'#Config_Location_List_Dialog_None\');\r\n\r\n                     " +
-"           textAdd = $(\'#Config_Location_List_Dialog_TextAdd\');\r\n\r\n             " +
-"                   textAdd.watermark(\'Location\');\r\n                             " +
-"   textAdd.keydown(function (e) {\r\n                                    if (e.key" +
-"Code == 13)\r\n                                        add();\r\n                   " +
-"             });\r\n\r\n                                $(\'#Config_Location_List_Dia" +
-"log_Add\').click(add);\r\n                            }\r\n\r\n                        " +
-"    dialog.dialog(\'open\');\r\n\r\n                            updateNoList();\r\n     " +
-"                       return false;\r\n                        }\r\n\r\n             " +
-"           function cancel() {\r\n                            $(this).dialog(\"clos" +
-"e\");\r\n\r\n                            list.find(\'li\').each(function () {\r\n        " +
-"                        $this = $(this);\r\n                                if ($t" +
-"his.is(\'[data-status=\"new\"]\')) {\r\n                                    $this.remo" +
-"ve();\r\n                                } else {\r\n                               " +
-"     if ($this.is(\'[data-status=\"removed\"]\')) {\r\n                               " +
-"         $this.show();\r\n                                        $this.attr(\'data" +
-"-status\', \'\')\r\n                                    }\r\n                          " +
-"      }\r\n                            });\r\n                        }\r\n\r\n         " +
-"               function remove() {\r\n                            $this = $(this)." +
-"closest(\'li\');\r\n\r\n                            if ($this.is(\'[data-status=\"new\"]\'" +
-")) {\r\n                                $this.remove();\r\n                         " +
-"   } else {\r\n                                $this.attr(\'data-status\', \'removed\'" +
-").hide();\r\n                            }\r\n\r\n                            updateNo" +
-"List();\r\n                        }\r\n\r\n                        function add() {\r\n" +
-"\r\n                            var value = textAdd.val();\r\n\r\n                    " +
-"        // Trim\r\n                            value = jQuery.trim(value);\r\n\r\n    " +
-"                        if (!value) {\r\n                                alert(\'En" +
-"ter a location to be added\');\r\n                                return;\r\n        " +
-"                    }\r\n\r\n                            // Already Exists\r\n        " +
-"                    var existingValues = list.find(\'li[data-location]\').filter(\'" +
-"[data-status!=\"removed\"]\').map(function () { return $(this).attr(\'data-location\'" +
-") }).get();\r\n                            if (jQuery.inArray(value, existingValue" +
-"s) >= 0) {\r\n                                alert(\'That item already exists in t" +
-"he list\');\r\n                                return;\r\n                           " +
-" }\r\n\r\n                            // Add Item\r\n                            var l" +
-"i = $(\'<li>\')\r\n                                .append($(\'<span>\').text(value))\r" +
-"\n                                .append($(\'<i>\').addClass(\'fa fa-times-circle r" +
-"emove\'))\r\n                                .attr(\'data-location\', value)\r\n       " +
-"                         .attr(\'data-status\', \'new\');\r\n\r\n                       " +
-"     list.append(li);\r\n\r\n                            textAdd.focus();\r\n\r\n       " +
-"                     updateNoList();\r\n                        }\r\n\r\n             " +
-"           function updateNoList() {\r\n                            if (list.find(" +
-"\'li:visible\').length > 0)\r\n                                noList.hide();\r\n     " +
-"                       else\r\n                                noList.show();\r\n   " +
-"                     }\r\n\r\n                        function saveChanges() {\r\n    " +
-"                        var form = $(\'#Config_Location_List_Dialog_Form\').empty(" +
-");\r\n\r\n                            list.find(\'li[data-status!=\"removed\"]\').each(f" +
-"unction () {\r\n                                var location = $(this).attr(\'data-" +
-"location\');\r\n\r\n                                form.append($(\'<input>\').attr({\r\n" +
-"                                    \'name\': \'LocationList\',\r\n                   " +
-"                 \'type\': \'hidden\'\r\n                                }).val(locati" +
-"on));\r\n\r\n                            }).get();\r\n\r\n                            fo" +
-"rm.submit();\r\n\r\n                            dialog.dialog(\"disable\");\r\n         " +
-"                   dialog.dialog(\"option\", \"buttons\", null);\r\n                  " +
-"      }\r\n\r\n                        // Import\r\n                        var dialog" +
-"Import, formImport;\r\n\r\n                        $(\'#Config_Location_List_ImportBu" +
-"tton\').click(showDialogImport);\r\n\r\n                        function showDialogIm" +
-"port() {\r\n                            if (!dialogImport) {\r\n                    " +
-"            dialogImport = $(\'#Config_Location_ListImport_Dialog\').dialog({\r\n   " +
-"                                 resizable: false,\r\n                            " +
-"        modal: true,\r\n                                    autoOpen: false,\r\n    " +
-"                                width: 350,\r\n                                   " +
-" buttons: {\r\n                                        \"Build Automatic List\": fun" +
-"ction () {\r\n                                            $(\'#Config_Location_List" +
-"Import_Dialog_AutomaticList\').val(\'True\').closest(\'form\').submit();\r\n           " +
-"                                 dialogImport.dialog(\"disable\");\r\n              " +
-"                              dialogImport.dialog(\"option\", \"buttons\", null);\r\n " +
-"                                       },\r\n                                     " +
-"   \"Import List\": function () {\r\n                                            $(\'" +
-"#Config_Location_ListImport_Dialog_LocationList\').closest(\'form\').submit();\r\n   " +
-"                                         dialogImport.dialog(\"disable\");\r\n      " +
-"                                      dialogImport.dialog(\"option\", \"buttons\", n" +
-"ull);\r\n                                        },\r\n                             " +
-"           Cancel: function () {\r\n                                            di" +
-"alogImport.dialog(\"close\");\r\n                                        }\r\n        " +
-"                            }\r\n                                });\r\n            " +
-"                }\r\n\r\n                            dialogImport.dialog(\'open\');\r\n\r" +
-"\n                            return false;\r\n                        }\r\n\r\n       " +
-"             });\r\n                </script>\r\n");
+"                   var dialog, textAdd, list, originalList, noList, form;\r\n\r\n   " +
+"                     $(\'#Config_Location_List_Button\').click(showDialog);\r\n\r\n   " +
+"                     function showDialog() {\r\n                            if (!d" +
+"ialog) {\r\n                                dialog = $(\'#Config_Location_List_Dial" +
+"og\').dialog({\r\n                                    resizable: false,\r\n          " +
+"                          modal: true,\r\n                                    auto" +
+"Open: false,\r\n                                    width: 350,\r\n                 " +
+"                   buttons: {\r\n                                        \"Save Cha" +
+"nges\": saveChanges,\r\n                                        Cancel: cancel\r\n   " +
+"                                 }\r\n                                });\r\n\r\n     " +
+"                           dialog.on(\'click\', \'.remove\', remove);\r\n\r\n           " +
+"                     list = $(\'#Config_Location_List_Dialog_List\');\r\n           " +
+"                     originalList = list.html();\r\n                              " +
+"  noList = $(\'#Config_Location_List_Dialog_None\');\r\n\r\n                          " +
+"      textAdd = $(\'#Config_Location_List_Dialog_TextAdd\');\r\n\r\n                  " +
+"              textAdd.watermark(\'Location\');\r\n                                te" +
+"xtAdd.keydown(function (e) {\r\n                                    if (e.keyCode " +
+"== 13)\r\n                                        add();\r\n                        " +
+"        });\r\n\r\n                                $(\'#Config_Location_List_Dialog_A" +
+"dd\').click(add);\r\n                            }\r\n\r\n                            d" +
+"ialog.dialog(\'open\');\r\n\r\n                            updateNoList();\r\n          " +
+"                  return false;\r\n                        }\r\n\r\n                  " +
+"      function cancel() {\r\n                            $(this).dialog(\"close\");\r" +
+"\n                            list.html(originalList);\r\n                        }" +
+"\r\n\r\n                        function remove() {\r\n                            $(t" +
+"his).closest(\'li\').remove();\r\n\r\n                            updateNoList();\r\n   " +
+"                     }\r\n\r\n                        function add() {\r\n\r\n          " +
+"                  var value = textAdd.val();\r\n\r\n                            // T" +
+"rim\r\n                            value = jQuery.trim(value);\r\n\r\n                " +
+"            if (!value) {\r\n                                alert(\'Enter a locati" +
+"on to be added\');\r\n                                return;\r\n                    " +
+"        }\r\n\r\n                            // Already Exists\r\n                    " +
+"        var existingValues = list.find(\'li[data-location]\').map(function () { re" +
+"turn $(this).attr(\'data-location\') }).get();\r\n                            if (jQ" +
+"uery.inArray(value, existingValues) >= 0) {\r\n                                ale" +
+"rt(\'That item already exists in the list\');\r\n                                ret" +
+"urn;\r\n                            }\r\n\r\n                            // Add Item\r\n" +
+"                            var li = $(\'<li>\')\r\n                                " +
+".append($(\'<input>\').attr({ type: \'hidden\', name: \'locationList\', value: value }" +
+"))\r\n                                .append($(\'<span>\').text(value))\r\n          " +
+"                      .append($(\'<i>\').addClass(\'fa fa-times-circle remove\'))\r\n " +
+"                               .attr(\'data-location\', value)\r\n                  " +
+"              .attr(\'data-status\', \'new\');\r\n\r\n                            list.a" +
+"ppend(li);\r\n\r\n                            textAdd.focus();\r\n\r\n                  " +
+"          updateNoList();\r\n                        }\r\n\r\n                        " +
+"function updateNoList() {\r\n                            if (list.find(\'li:visible" +
+"\').length > 0)\r\n                                noList.hide();\r\n                " +
+"            else\r\n                                noList.show();\r\n              " +
+"          }\r\n\r\n                        function saveChanges() {\r\n               " +
+"             dialog.find(\'form\').submit();\r\n                            dialog.d" +
+"ialog(\"option\", \"buttons\", null);\r\n                        }\r\n\r\n                " +
+"        // Import\r\n                        var dialogImport, formImport;\r\n\r\n    " +
+"                    $(\'#Config_Location_List_ImportButton\').click(showDialogImpo" +
+"rt);\r\n\r\n                        function showDialogImport() {\r\n                 " +
+"           if (!dialogImport) {\r\n                                dialogImport = " +
+"$(\'#Config_Location_ListImport_Dialog\').dialog({\r\n                              " +
+"      resizable: false,\r\n                                    modal: true,\r\n     " +
+"                               autoOpen: false,\r\n                               " +
+"     width: 350,\r\n                                    buttons: {\r\n              " +
+"                          \"Build Automatic List\": function () {\r\n               " +
+"                             $(\'#Config_Location_ListImport_Dialog_AutomaticList" +
+"\').val(\'True\').closest(\'form\').submit();\r\n                                      " +
+"      dialogImport.dialog(\"disable\");\r\n                                         " +
+"   dialogImport.dialog(\"option\", \"buttons\", null);\r\n                            " +
+"            },\r\n                                        \"Import List\": function " +
+"() {\r\n                                            $(\'#Config_Location_ListImport" +
+"_Dialog_LocationList\').closest(\'form\').submit();\r\n                              " +
+"              dialogImport.dialog(\"disable\");\r\n                                 " +
+"           dialogImport.dialog(\"option\", \"buttons\", null);\r\n                    " +
+"                    },\r\n                                        Cancel: function" +
+" () {\r\n                                            dialogImport.dialog(\"close\");" +
+"\r\n                                        }\r\n                                   " +
+" }\r\n                                });\r\n                            }\r\n\r\n      " +
+"                      dialogImport.dialog(\'open\');\r\n\r\n                          " +
+"  return false;\r\n                        }\r\n\r\n                    });\r\n         " +
+"           </script>\r\n");
 
             
-            #line 280 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
+            #line 258 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
                 }
                 else
                 {
-                
+                    
             
             #line default
             #line hidden
             
-            #line 283 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
-           Write(Model.LocationModeOptions().First(o => o.Key == Model.LocationMode.ToString()).Value);
+            #line 261 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
+               Write(Model.LocationModeOptions().First(o => o.Key == Model.LocationMode.ToString()).Value);
 
             
             #line default
             #line hidden
             
-            #line 283 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
-                                                                                                     
+            #line 261 "..\..\Areas\Config\Views\JobPreferences\Parts\Locations.cshtml"
+                                                                                                         
                 }
 
             

Disco.Web/Areas/Config/Views/JobQueue/Create.cshtml

@@ -4,10 +4,8 @@
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Job Queues", MVC.Config.JobQueue.Index(null), "Create");
 }
 @using (Html.BeginForm())
-{ 
-    @Html.HiddenFor(m => m.JobQueue.Icon)
-    @Html.HiddenFor(m => m.JobQueue.IconColour)
-    @Html.HiddenFor(m => m.JobQueue.Priority)
+{
+    @Html.AntiForgeryToken()
     <div class="form" style="width: 450px">
         <table>
             <tr>
@@ -15,7 +13,7 @@
                     Name:
                 </th>
                 <td>
-                    @Html.EditorFor(model => model.JobQueue.Name)<br />@Html.ValidationMessageFor(model => model.JobQueue.Name)
+                    @Html.EditorFor(model => model.Name)<br />@Html.ValidationMessageFor(model => model.Name)
                 </td>
             </tr>
             <tr>
@@ -23,7 +21,7 @@
                     Description:
                 </th>
                 <td>
-                    @Html.EditorFor(model => model.JobQueue.Description)<br />@Html.ValidationMessageFor(model => model.JobQueue.Description)
+                    @Html.EditorFor(model => model.Description)<br />@Html.ValidationMessageFor(model => model.Description)
                 </td>
             </tr>
         </table>
@@ -33,7 +31,7 @@
     </div>
     <script type="text/javascript">
         $(function () {
-            $('#JobQueue_Name').focus().select();
+            $('#Name').focus().select();
         });
     </script>
 }

Disco.Web/Areas/Config/Views/JobQueue/Create.generated.cs

@@ -57,49 +57,21 @@ WriteLiteral("\r\n");
             
             #line 6 "..\..\Areas\Config\Views\JobQueue\Create.cshtml"
  using (Html.BeginForm())
-{ 
+{
     
             
             #line default
             #line hidden
             
             #line 8 "..\..\Areas\Config\Views\JobQueue\Create.cshtml"
-Write(Html.HiddenFor(m => m.JobQueue.Icon));
+Write(Html.AntiForgeryToken());
 
             
             #line default
             #line hidden
             
             #line 8 "..\..\Areas\Config\Views\JobQueue\Create.cshtml"
-                                         
-    
-            
-            #line default
-            #line hidden
-            
-            #line 9 "..\..\Areas\Config\Views\JobQueue\Create.cshtml"
-Write(Html.HiddenFor(m => m.JobQueue.IconColour));
-
-            
-            #line default
-            #line hidden
-            
-            #line 9 "..\..\Areas\Config\Views\JobQueue\Create.cshtml"
-                                               
-    
-            
-            #line default
-            #line hidden
-            
-            #line 10 "..\..\Areas\Config\Views\JobQueue\Create.cshtml"
-Write(Html.HiddenFor(m => m.JobQueue.Priority));
-
-            
-            #line default
-            #line hidden
-            
-            #line 10 "..\..\Areas\Config\Views\JobQueue\Create.cshtml"
-                                             
+                            
 
             
             #line default
@@ -116,8 +88,8 @@ WriteLiteral(">\r\n        <table>\r\n            <tr>\r\n                <th>\r
 WriteLiteral("                    ");
 
             
-            #line 18 "..\..\Areas\Config\Views\JobQueue\Create.cshtml"
-               Write(Html.EditorFor(model => model.JobQueue.Name));
+            #line 16 "..\..\Areas\Config\Views\JobQueue\Create.cshtml"
+               Write(Html.EditorFor(model => model.Name));
 
             
             #line default
@@ -125,8 +97,8 @@ WriteLiteral("                    ");
 WriteLiteral("<br />");
 
             
-            #line 18 "..\..\Areas\Config\Views\JobQueue\Create.cshtml"
-                                                                  Write(Html.ValidationMessageFor(model => model.JobQueue.Name));
+            #line 16 "..\..\Areas\Config\Views\JobQueue\Create.cshtml"
+                                                         Write(Html.ValidationMessageFor(model => model.Name));
 
             
             #line default
@@ -138,8 +110,8 @@ WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>
 WriteLiteral("                    ");
 
             
-            #line 26 "..\..\Areas\Config\Views\JobQueue\Create.cshtml"
-               Write(Html.EditorFor(model => model.JobQueue.Description));
+            #line 24 "..\..\Areas\Config\Views\JobQueue\Create.cshtml"
+               Write(Html.EditorFor(model => model.Description));
 
             
             #line default
@@ -147,8 +119,8 @@ WriteLiteral("                    ");
 WriteLiteral("<br />");
 
             
-            #line 26 "..\..\Areas\Config\Views\JobQueue\Create.cshtml"
-                                                                         Write(Html.ValidationMessageFor(model => model.JobQueue.Description));
+            #line 24 "..\..\Areas\Config\Views\JobQueue\Create.cshtml"
+                                                                Write(Html.ValidationMessageFor(model => model.Description));
 
             
             #line default
@@ -171,11 +143,11 @@ WriteLiteral("    <script");
 
 WriteLiteral(" type=\"text/javascript\"");
 
-WriteLiteral(">\r\n        $(function () {\r\n            $(\'#JobQueue_Name\').focus().select();\r\n  " +
-"      });\r\n    </script>\r\n");
+WriteLiteral(">\r\n        $(function () {\r\n            $(\'#Name\').focus().select();\r\n        });" +
+"\r\n    </script>\r\n");
 
             
-            #line 39 "..\..\Areas\Config\Views\JobQueue\Create.cshtml"
+            #line 37 "..\..\Areas\Config\Views\JobQueue\Create.cshtml"
 }
             
             #line default

Disco.Web/Areas/Config/Views/JobQueue/Show.cshtml

@@ -27,7 +27,7 @@
             </th>
             <td>
                 @if (canConfig)
-            {@Html.EditorFor(model => model.Token.JobQueue.Name)
+                {@Html.EditorFor(model => model.Token.JobQueue.Name)
                 @AjaxHelpers.AjaxSave()
                 @AjaxHelpers.AjaxLoader()
                 <script type="text/javascript">
@@ -45,18 +45,18 @@
             {
                 @Model.Token.JobQueue.Name
             }
-        </td>
-    </tr>
-    <tr>
-        <th>
-            Description:
-        </th>
-        <td>
-            @if (canConfig)
-        {@Html.EditorFor(model => model.Token.JobQueue.Description)
-            @AjaxHelpers.AjaxSave()
-            @AjaxHelpers.AjaxLoader()
-            <script type="text/javascript">
+            </td>
+        </tr>
+        <tr>
+            <th>
+                Description:
+            </th>
+            <td>
+                @if (canConfig)
+                {@Html.EditorFor(model => model.Token.JobQueue.Description)
+                @AjaxHelpers.AjaxSave()
+                @AjaxHelpers.AjaxLoader()
+                <script type="text/javascript">
                 $(function () {
                     document.DiscoFunctions.PropertyChangeHelper(
                         $('#Token_JobQueue_Description'),
@@ -65,11 +65,11 @@
                         'Description'
                     );
                 });
-            </script>
-        }
-        else
-        {
-            <pre>@if (string.IsNullOrEmpty(Model.Token.JobQueue.Description))
+                </script>
+            }
+            else
+            {
+                <pre>@if (string.IsNullOrEmpty(Model.Token.JobQueue.Description))
                      {
                     <text>&lt;None&gt;</text>
                      }
@@ -78,139 +78,140 @@
                         @Model.Token.JobQueue.Description.ToHtmlComment()
                      }
                     </pre>
-        }
-    </td>
-</tr>
-<tr>
-    <th>
-        Statistics:
-    </th>
-    <td>
-        <div><strong>@Model.OpenJobCount job@(Model.OpenJobCount != 1 ? "s" : null) open</strong></div>
-        <div>@Model.TotalJobCount total job@(Model.TotalJobCount != 1 ? "s" : null)</div>
-    </td>
-</tr>
-<tr>
-    <th>
-        Icon:
-    </th>
-    <td>
-        <i id="Config_JobQueues_Icon" data-icon="@(Model.Token.JobQueue.Icon)" data-colour="@(Model.Token.JobQueue.IconColour)" class="fa fa-@(Model.Token.JobQueue.Icon) fa-4x d-@(Model.Token.JobQueue.IconColour)"></i>
-        @if (canConfig)
-        {
-            <div>
-                <a id="Config_JobQueues_Icon_Update" href="#" class="button small">Update</a>
-                <div id="Config_JobQueues_Icon_Update_Dialog" class="dialog" title="Job Queue Icon">
+            }
+            </td>
+        </tr>
+        <tr>
+            <th>
+                Statistics:
+            </th>
+            <td>
+                <div><strong>@Model.OpenJobCount job@(Model.OpenJobCount != 1 ? "s" : null) open</strong></div>
+                <div>@Model.TotalJobCount total job@(Model.TotalJobCount != 1 ? "s" : null)</div>
+            </td>
+        </tr>
+        <tr>
+            <th>
+                Icon:
+            </th>
+            <td>
+                <i id="Config_JobQueues_Icon" data-icon="@(Model.Token.JobQueue.Icon)" data-colour="@(Model.Token.JobQueue.IconColour)" class="fa fa-@(Model.Token.JobQueue.Icon) fa-4x d-@(Model.Token.JobQueue.IconColour)"></i>
+                @if (canConfig)
+                {
                     <div>
-                        <div class="icons">
-                            @foreach (var icon in Model.Icons)
+                        <a id="Config_JobQueues_Icon_Update" href="#" class="button small">Update</a>
+                        <div id="Config_JobQueues_Icon_Update_Dialog" class="dialog" title="Job Queue Icon">
+                            @using (Html.BeginForm(MVC.API.JobQueue.UpdateIconAndColour(id: Model.Token.JobQueue.Id, redirect: true)))
                             {
-                                <i data-icon="@(icon.Key)" class="fa fa-@(icon.Key)" title="@icon.Value"></i>
+                                @Html.AntiForgeryToken()
+                                <input type="hidden" name="icon" />
+                                <input type="hidden" name="iconColour" />
                             }
-                        </div>
-                        <div class="colours">
-                            @foreach (var colour in Model.ThemeColours)
-                            {
-                                <i data-colour="@(colour.Key)" class="fa fa-square d-@(colour.Key)" title="@colour.Value"></i>
-                            }
-                        </div>
-                    </div>
-                </div>
-                <script>
-                    (function () {
-                        var dialog, icon, colours, icons;
-
-                        function showDialog() {
-                            if (!dialog) {
-                                dialog = $('#Config_JobQueues_Icon_Update_Dialog').dialog({
-                                    resizable: false,
-                                    modal: true,
-                                    autoOpen: false,
-                                    width: 780,
-                                    height: 540,
-                                    buttons: {
-                                        "Save": save,
-                                        Cancel: cancel
+                            <div>
+                                <div class="colours">
+                                    @foreach (var colour in Model.ThemeColours)
+                                    {
+                                        <i data-colour="@(colour.Key)" class="fa fa-square d-@(colour.Key)" title="@colour.Value"></i>
                                     }
+                                </div>
+                                <div class="icons">
+                                    @foreach (var icon in Model.Icons)
+                                    {
+                                        <i data-icon="@(icon.Key)" class="fa fa-@(icon.Key)" title="@icon.Value"></i>
+                                    }
+                                </div>
+                            </div>
+                        </div>
+                        <script>
+                            (function () {
+                                var dialog, icon, colours, icons;
+
+                                function showDialog() {
+                                    if (!dialog) {
+                                        dialog = $('#Config_JobQueues_Icon_Update_Dialog').dialog({
+                                            resizable: false,
+                                            modal: true,
+                                            autoOpen: false,
+                                            width: 1000,
+                                            buttons: {
+                                                "Save": save,
+                                                Cancel: cancel
+                                            }
+                                        });
+
+                                        colours = dialog.find('.colours');
+                                        icons = dialog.find('.icons');
+
+                                        colours.on('click', 'i', selectColour);
+                                        icons.on('click', 'i', selectIcon);
+                                    }
+
+                                    colours.find('i[data-colour="' + icon.attr('data-colour') + '"]').each(selectColour);
+                                    icons.find('i[data-icon="' + icon.attr('data-icon') + '"]').each(selectIcon);
+
+                                    dialog.dialog('open');
+
+                                    return false;
+                                }
+
+                                function selectColour() {
+                                    var $this = $(this),
+                                        colourCode = $this.attr('data-colour'),
+                                        previousColourCode = icons.attr('data-colour');
+
+
+                                    colours.find('i').removeClass('selected fa-check-square').addClass('fa-square');
+                                    $this.removeClass('fa-square').addClass('fa-check-square selected');
+
+                                    if (previousColourCode)
+                                        icons.removeClass('d-' + previousColourCode);
+                                    icons.attr('data-colour', colourCode)
+                                    icons.addClass('d-' + colourCode);
+                                }
+                                function selectIcon() {
+                                    var $this = $(this),
+                                        iconCode = $this.attr('data-icon');
+
+                                    icons.find('i').removeClass('selected');
+                                    $this.addClass('selected');
+                                }
+
+                                function save() {
+                                    const $form = dialog.find('form');
+                                    $form.find('input[name="icon"]').val(icons.find('i.selected').attr('data-icon'));
+                                    $form.find('input[name="iconColour"]').val(colours.find('i.selected').attr('data-colour'));
+                                    $form.trigger('submit');
+                                    dialog.dialog("option", "buttons", null);
+                                }
+
+                                function cancel() {
+                                    $(this).dialog("close");
+                                }
+
+                                $(function () {
+                                    icon = $('#Config_JobQueues_Icon');
+                                    $('#Config_JobQueues_Icon_Update').click(showDialog);
                                 });
-
-                                colours = dialog.find('.colours');
-                                icons = dialog.find('.icons');
-
-                                colours.on('click', 'i', selectColour);
-                                icons.on('click', 'i', selectIcon);
-                            }
-
-                            colours.find('i[data-colour="' + icon.attr('data-colour') + '"]').each(selectColour);
-                            icons.find('i[data-icon="' + icon.attr('data-icon') + '"]').each(selectIcon);
-
-                            dialog.dialog('open');
-
-                            return false;
-                        }
-
-                        function selectColour() {
-                            var $this = $(this),
-                                colourCode = $this.attr('data-colour'),
-                                previousColourCode = icons.attr('data-colour');
-
-
-                            colours.find('i').removeClass('selected fa-check-square').addClass('fa-square');
-                            $this.removeClass('fa-square').addClass('fa-check-square selected');
-
-                            if (previousColourCode)
-                                icons.removeClass('d-' + previousColourCode);
-                            icons.attr('data-colour', colourCode)
-                            icons.addClass('d-' + colourCode);
-                        }
-                        function selectIcon() {
-                            var $this = $(this),
-                                iconCode = $this.attr('data-icon');
-
-                            icons.find('i').removeClass('selected');
-                            $this.addClass('selected');
-                        }
-
-                        function save() {
-                            var url = '@(Url.Action(MVC.API.JobQueue.UpdateIconAndColour(id: Model.Token.JobQueue.Id, redirect: true)))',
-                                data = {
-                                    Icon: icons.find('i.selected').attr('data-icon'),
-                                    IconColour: colours.find('i.selected').attr('data-colour')
-                                };
-                            window.location.href = url + '&' + $.param(data);
-
-                            dialog.dialog("disable");
-                            dialog.dialog("option", "buttons", null);
-                        }
-
-                        function cancel() {
-                            $(this).dialog("close");
-                        }
-
-                        $(function () {
-                            icon = $('#Config_JobQueues_Icon');
-                            $('#Config_JobQueues_Icon_Update').click(showDialog);
-                        });
-                    }());
-                </script>
-            </div>
-        }
-    </td>
-</tr>
-<tr>
-    <th>
-        Priority:
-    </th>
-    <td>
-        @if (canConfig)
-    {
-        var priorityValue = Model.Token.JobQueue.Priority.ToString();
-        var priorityItems = Enum.GetNames(typeof(JobQueuePriority)).Select(i => new SelectListItem() { Text = i, Value = i, Selected = (i == priorityValue) }).ToList();
-        <i class="fa d-priority-@(priorityValue.ToLower())" title="@(priorityValue) Priority"></i>
-                @Html.DropDownListFor(m => m.Token.JobQueue.Priority, priorityItems)
-                @AjaxHelpers.AjaxSave()
-                @AjaxHelpers.AjaxLoader()
-                <script type="text/javascript">
+                            }());
+                        </script>
+                    </div>
+                }
+            </td>
+        </tr>
+        <tr>
+            <th>
+                Priority:
+            </th>
+            <td>
+                @if (canConfig)
+                {
+                    var priorityValue = Model.Token.JobQueue.Priority.ToString();
+                    var priorityItems = Enum.GetNames(typeof(JobQueuePriority)).Select(i => new SelectListItem() { Text = i, Value = i, Selected = (i == priorityValue) }).ToList();
+                    <i class="fa d-priority-@(priorityValue.ToLower())" title="@(priorityValue) Priority"></i>
+                    @Html.DropDownListFor(m => m.Token.JobQueue.Priority, priorityItems)
+                    @AjaxHelpers.AjaxSave()
+                    @AjaxHelpers.AjaxLoader()
+                    <script type="text/javascript">
                     $(function () {
                         var element = $('#Token_JobQueue_Priority');
 
@@ -227,47 +228,47 @@
                             icon.addClass('fa d-priority-' + element.val().toLowerCase()).attr('title', element.val() + ' Priority');
                         });
                     });
-                </script>
-    }
-    else
-    {
-        @Model.Token.JobQueue.Priority.ToString()
-    }
-</td>
-</tr>
-<tr>
-    <th>
-        Default SLA:
-    </th>
-    <td>
-        @if (canConfig)
-    {
-        var slaOptions = JobQueueService.SlaOptions.Select(o => new SelectListItem() { Text = o.Value, Value = o.Key.ToString() }).ToList();
-
-        if (this.Model.Token.JobQueue.DefaultSLAExpiry.HasValue)
-        {
-            var slaValue = this.Model.Token.JobQueue.DefaultSLAExpiry.Value;
-            if (JobQueueService.SlaOptions.Where(o => o.Key == slaValue).Count() == 0)
-            {
-                string slaValueText;
-                if (slaValue % (60 * 24 * 7 * 4) == 0)
-                { slaValueText = string.Format("{0} months", slaValue / (60 * 24 * 7 * 4)); }
-                else if (slaValue % (60 * 24 * 7) == 0)
-                { slaValueText = string.Format("{0} weeks", slaValue / (60 * 24 * 7)); }
-                else if (slaValue % (60 * 24) == 0)
-                { slaValueText = string.Format("{0} days", slaValue / (60 * 24)); }
-                else if (slaValue % (60) == 0)
-                { slaValueText = string.Format("{0} hours", slaValue / 60); }
+                    </script>
+                }
                 else
-                { slaValueText = string.Format("{0} minutes", slaValue); }
+                {
+                    @Model.Token.JobQueue.Priority.ToString()
+                }
+            </td>
+        </tr>
+        <tr>
+            <th>
+                Default SLA:
+            </th>
+            <td>
+                @if (canConfig)
+                {
+                    var slaOptions = JobQueueService.SlaOptions.Select(o => new SelectListItem() { Text = o.Value, Value = o.Key.ToString() }).ToList();
 
-                slaOptions.Insert(0, new SelectListItem() { Text = string.Format("{0} <Custom>", slaValueText), Value = slaValue.ToString() });
-            }
-        }
-        @Html.DropDownListFor(m => m.Token.JobQueue.DefaultSLAExpiry, slaOptions)
-        @AjaxHelpers.AjaxSave()
-        @AjaxHelpers.AjaxLoader()
-        <script type="text/javascript">
+                    if (this.Model.Token.JobQueue.DefaultSLAExpiry.HasValue)
+                    {
+                        var slaValue = this.Model.Token.JobQueue.DefaultSLAExpiry.Value;
+                        if (JobQueueService.SlaOptions.Where(o => o.Key == slaValue).Count() == 0)
+                        {
+                            string slaValueText;
+                            if (slaValue % (60 * 24 * 7 * 4) == 0)
+                            { slaValueText = string.Format("{0} months", slaValue / (60 * 24 * 7 * 4)); }
+                            else if (slaValue % (60 * 24 * 7) == 0)
+                            { slaValueText = string.Format("{0} weeks", slaValue / (60 * 24 * 7)); }
+                            else if (slaValue % (60 * 24) == 0)
+                            { slaValueText = string.Format("{0} days", slaValue / (60 * 24)); }
+                            else if (slaValue % (60) == 0)
+                            { slaValueText = string.Format("{0} hours", slaValue / 60); }
+                            else
+                            { slaValueText = string.Format("{0} minutes", slaValue); }
+
+                            slaOptions.Insert(0, new SelectListItem() { Text = string.Format("{0} <Custom>", slaValueText), Value = slaValue.ToString() });
+                        }
+                    }
+                    @Html.DropDownListFor(m => m.Token.JobQueue.DefaultSLAExpiry, slaOptions)
+                    @AjaxHelpers.AjaxSave()
+                    @AjaxHelpers.AjaxLoader()
+                    <script type="text/javascript">
             $(function () {
                 document.DiscoFunctions.PropertyChangeHelper(
                     $('#Token_JobQueue_DefaultSLAExpiry'),
@@ -276,89 +277,93 @@
                     'DefaultSLAExpiry'
                 );
             });
-        </script>
-    }
-    else
-    {
-        if (this.Model.Token.JobQueue.DefaultSLAExpiry.HasValue)
-        {
-            var slaValue = this.Model.Token.JobQueue.DefaultSLAExpiry.Value;
-            var slaOption = JobQueueService.SlaOptions.Where(o => o.Key == slaValue).ToArray();
-            if (slaOption.Length > 0)
-            {
-                @slaOption[0].Value
-            }
-            else
-            {
-                <text>&lt;None&gt;</text>
-            }
-        }
-        else
-        {
-            <text>&lt;None&gt;</text>
-        }
-    }
-</td>
-</tr>
-<tr>
-    <th>Member Groups/Users:</th>
-    <td>
-        @if (Model.Token.SubjectIds.Count == 0)
-        {
-            <span class="smallMessage">None Associated</span>
-        }
-        else
-        {
-            <ul id="Config_JobQueues_Subjects" class="none">
-                @foreach (var sg in Model.Subjects)
+                    </script>
+                }
+                else
                 {
-                    var displayName = sg.Id == sg.Name ? sg.Id : string.Format("{0} [{1}]", sg.Name, sg.Id);
-                    <li class="@(sg.IsGroup ? "group" : "user")">
-                        @if (sg.IsGroup)
+                    if (this.Model.Token.JobQueue.DefaultSLAExpiry.HasValue)
                     {
-                        <i class="fa fa-users fa-lg"></i>@displayName
+                        var slaValue = this.Model.Token.JobQueue.DefaultSLAExpiry.Value;
+                        var slaOption = JobQueueService.SlaOptions.Where(o => o.Key == slaValue).ToArray();
+                        if (slaOption.Length > 0)
+                        {
+                            @slaOption[0].Value
+                        }
+                        else
+                        {
+                            <text>&lt;None&gt;</text>
+                        }
                     }
                     else
                     {
-                        <a href="@(Url.Action(MVC.User.Show(sg.Id)))"><i class="fa fa-user fa-lg"></i>@displayName</a>
+                        <text>&lt;None&gt;</text>
                     }
-                </li>
                 }
-            </ul>
-        }
-        @if (canConfig)
-        {
-            <div>
-                <a id="Config_JobQueues_Subjects_Update" href="#" class="button small">Update</a>
-                <div id="Config_JobQueues_Subjects_Update_Dialog" class="dialog" title="Job Queue Member Groups/Users">
-                    <div id="Config_JobQueues_Subjects_Update_Dialog_ListContainer">
-                        <span id="Config_JobQueues_Subjects_Update_Dialog_None" class="smallMessage">None Associated</span>
-                        <ul id="Config_JobQueues_Subjects_Update_Dialog_List" class="none">
-                            @foreach (var sg in Model.Subjects)
-                            {
-                                var displayName = sg.Id == sg.Name ? sg.Id : string.Format("{0} [{1}]", sg.Name, sg.Id);
-                                <li class="@(sg.IsGroup ? "group" : "user")" data-subjectid="@sg.Id">
-                                    @if (sg.IsGroup)
+            </td>
+        </tr>
+        <tr>
+            <th>Member Groups/Users:</th>
+            <td>
+                @if (Model.Token.SubjectIds.Count == 0)
+                {
+                    <span class="smallMessage">None Associated</span>
+                }
+                else
+                {
+                    <ul id="Config_JobQueues_Subjects" class="none">
+                        @foreach (var sg in Model.Subjects)
+                        {
+                            var displayName = sg.Id == sg.Name ? sg.Id : string.Format("{0} [{1}]", sg.Name, sg.Id);
+                            <li class="@(sg.IsGroup ? "group" : "user")">
+                                @if (sg.IsGroup)
                                 {
                                     <i class="fa fa-users fa-lg"></i>@displayName
                                 }
                                 else
                                 {
-                                    <i class="fa fa-user fa-lg"></i>@displayName
-                                }<i class="fa fa-times-circle remove"></i>
+                                    <a href="@(Url.Action(MVC.User.Show(sg.Id)))"><i class="fa fa-user fa-lg"></i>@displayName</a>
+                                }
                             </li>
+                        }
+                    </ul>
+                }
+                @if (canConfig)
+                {
+                    <div>
+                        <a id="Config_JobQueues_Subjects_Update" href="#" class="button small">Update</a>
+                        <div id="Config_JobQueues_Subjects_Update_Dialog" class="dialog" title="Job Queue Member Groups/Users">
+                            @using (Html.BeginForm(MVC.API.JobQueue.UpdateSubjects(Model.Token.JobQueue.Id, null, true)))
+                            {
+                                @Html.AntiForgeryToken()
+                                <div id="Config_JobQueues_Subjects_Update_Dialog_ListContainer">
+                                    <span id="Config_JobQueues_Subjects_Update_Dialog_None" class="smallMessage">None Associated</span>
+                                    <ul id="Config_JobQueues_Subjects_Update_Dialog_List" class="none">
+                                        @foreach (var sg in Model.Subjects)
+                                        {
+                                            var displayName = sg.Id == sg.Name ? sg.Id : string.Format("{0} [{1}]", sg.Name, sg.Id);
+                                            <li class="@(sg.IsGroup ? "group" : "user")" data-subjectid="@sg.Id">
+                                                <input type="hidden" name="subjects" value="@sg.Id" />
+                                                @if (sg.IsGroup)
+                                                {
+                                                    <i class="fa fa-users fa-lg"></i>@displayName
+                                                }
+                                                else
+                                                {
+                                                    <i class="fa fa-user fa-lg"></i>@displayName
+                                                }<i class="fa fa-times-circle remove"></i>
+                                            </li>
+                                        }
+                                    </ul>
+                                </div>
                             }
-                        </ul>
-                    </div>
-                    <div id="Config_JobQueues_Subjects_Update_Dialog_AddContainer">
-                        <input type="text" id="Config_JobQueues_Subjects_Update_Dialog_TextAdd" />
-                        <a id="Config_JobQueues_Subjects_Update_Dialog_Add" href="#" class="button small">Add</a>
-                    </div>
-                    <form id="Config_JobQueues_Subjects_Update_Dialog_Form" action="@(Url.Action(MVC.API.JobQueue.UpdateSubjects(Model.Token.JobQueue.Id, null, true)))" method="post"></form>
-                </div>
-                <script>
+                            <div id="Config_JobQueues_Subjects_Update_Dialog_AddContainer">
+                                <input type="text" id="Config_JobQueues_Subjects_Update_Dialog_TextAdd" />
+                                <a id="Config_JobQueues_Subjects_Update_Dialog_Add" href="#" class="button small">Add</a>
+                            </div>
+                        </div>
+                        <script>
                     (function () {
-                        var dialog, textAdd, list, noSubjects, form;
+                        var dialog, textAdd, list, originalList, noSubjects, form;
 
                         function showDialog() {
                             if (!dialog) {
@@ -367,7 +372,6 @@
                                     modal: true,
                                     autoOpen: false,
                                     width: 350,
-                                    height: 420,
                                     buttons: {
                                         "Save Changes": saveChanges,
                                         Cancel: cancel
@@ -377,6 +381,7 @@
                                 dialog.on('click', '.remove', remove);
 
                                 list = $('#Config_JobQueues_Subjects_Update_Dialog_List');
+                                originalList = list.html();
                                 noSubjects = $('#Config_JobQueues_Subjects_Update_Dialog_None');
 
                                 textAdd = $('#Config_JobQueues_Subjects_Update_Dialog_TextAdd');
@@ -412,27 +417,11 @@
                         function cancel() {
                             $(this).dialog("close");
 
-                            list.find('li').each(function () {
-                                $this = $(this);
-                                if ($this.is('[data-subjectstatus="new"]')) {
-                                    $this.remove();
-                                } else {
-                                    if ($this.is('[data-subjectstatus="removed"]')) {
-                                        $this.show();
-                                        $this.attr('data-status', '')
-                                    }
-                                }
-                            });
+                            list.html(originalList);
                         }
 
                         function remove() {
-                            $this = $(this).closest('li');
-
-                            if ($this.is('[data-subjectstatus="new"]')) {
-                                $this.remove();
-                            } else {
-                                $this.attr('data-subjectstatus', 'removed').hide();
-                            }
+                            $(this).closest('li').remove();
 
                             updateNoSubjects();
 
@@ -450,7 +439,7 @@
                             }).done(function (response) {
                                 if (response) {
                                     if (response.IsGroup || response.IsUserAccount) {
-                                        if (list.find('li[data-subjectid="' + response.Id + '"]').filter('[data-status!="removed"]').length == 0) {
+                                        if (list.find('li[data-subjectid="' + response.Id + '"]').length == 0) {
 
                                             var liIcon = $('<i>').addClass('fa fa-lg');
                                             if (response.Type === 'user')
@@ -459,6 +448,7 @@
                                                 liIcon.addClass('fa-users');
 
                                             var li = $('<li>')
+                                                .append($('<input>').attr({ type: 'hidden', name: 'subjects', value: response.Id }))
                                                 .append(liIcon)
                                                 .append($('<span>').text(response.Id == response.Name ? response.Id : response.Name + ' [' + response.Id + ']'))
                                                 .append($('<i>').addClass('fa fa-times-circle remove'))
@@ -493,73 +483,60 @@
                         }
 
                         function saveChanges() {
-                            var form = $('#Config_JobQueues_Subjects_Update_Dialog_Form').empty();
-
-                            list.find('li[data-subjectstatus!="removed"]').each(function () {
-                                var subjectId = $(this).attr('data-subjectid');
-
-                                form.append($('<input>').attr({
-                                    'name': 'Subjects',
-                                    'type': 'hidden'
-                                }).val(subjectId));
-
-                            }).get();
-
-                            form.submit();
-
-                            dialog.dialog("disable");
+                            dialog.find('form').trigger('submit');
                             dialog.dialog("option", "buttons", null);
                         }
 
                         $(function () {
-                            $('#Config_JobQueues_Subjects_Update').click(showDialog);
+                            $('#Config_JobQueues_Subjects_Update').on('click', showDialog);
                         });
 
                     })();
-                </script>
-            </div>
-        }
-    </td>
-</tr>
-<tr>
-    <th>Automatically Add Jobs:</th>
-    <td>
-        <div>
-            @if (Model.Token.JobQueue.JobSubTypes.Count > 0)
-            {
-                <ul>
-                    @foreach (var jobType in Model.Token.JobQueue.JobSubTypes.GroupBy(jst => jst.JobType).OrderBy(jtg => jtg.Key.Description))
+                        </script>
+                    </div>
+                }
+            </td>
+        </tr>
+        <tr>
+            <th>Automatically Add Jobs:</th>
+            <td>
+                <div>
+                    @if (Model.Token.JobQueue.JobSubTypes.Count > 0)
                     {
-                        <li>
-                            @jobType.Key.Description
-                            <ul>
-                                @if (jobType.Count() == Model.JobTypes.FirstOrDefault(jt => jt.Id == jobType.Key.Id).JobSubTypes.Count)
-                                {
-                                    <li><span class="smallMessage">[All Sub Types]</span></li>
-                                }
-                                else
-                                {
-                                    foreach (var jobSubType in jobType)
-                                    {
-                                        <li>@jobSubType.Description</li>
-                                    }
-                                }
-                            </ul>
-                        </li>
+                        <ul>
+                            @foreach (var jobType in Model.Token.JobQueue.JobSubTypes.GroupBy(jst => jst.JobType).OrderBy(jtg => jtg.Key.Description))
+                            {
+                                <li>
+                                    @jobType.Key.Description
+                                    <ul>
+                                        @if (jobType.Count() == Model.JobTypes.FirstOrDefault(jt => jt.Id == jobType.Key.Id).JobSubTypes.Count)
+                                        {
+                                            <li><span class="smallMessage">[All Sub Types]</span></li>
+                                        }
+                                        else
+                                        {
+                                            foreach (var jobSubType in jobType)
+                                            {
+                                                <li>@jobSubType.Description</li>
+                                            }
+                                        }
+                                    </ul>
+                                </li>
+                            }
+                        </ul>
                     }
-                </ul>
-            }
-            else
-            {
-                <text>&lt;None&gt;</text>
-            }
-        </div>
-        @if (canConfig)
-        {
-            <a id="Config_JobQueues_JobSubTypes_Update" href="#" class="button small">Update</a>
+                    else
+                    {
+                        <text>&lt;None&gt;</text>
+                    }
+                </div>
+                @if (canConfig)
+                {
+                    <a id="Config_JobQueues_JobSubTypes_Update" href="#" class="button small">Update</a>
                     <div id="Config_JobQueues_JobSubTypes_Update_Dialog" class="dialog" title="Job Queue Automatic Types">
                         @using (Html.BeginForm(MVC.API.JobQueue.UpdateJobSubTypes(Model.Token.JobQueue.Id, null, true)))
                         {
+                            @Html.AntiForgeryToken()
                             var selectedTypes = Model.Token.JobQueue.JobSubTypes.Select(jst => jst.JobType).Distinct().ToList();
                             foreach (var jt in Model.JobTypes)
                             {
@@ -637,23 +614,27 @@
 
                         })();
                     </script>
-        }
-        <div class="info-box">
-            <p class="fa-p">
-                <i class="fa fa-info-circle"></i>When jobs of these types are created, they will automatically be added into this queue.
-            </p>
-        </div>
-    </td>
-</tr>
-</table>
+                }
+                <div class="info-box">
+                    <p class="fa-p">
+                        <i class="fa fa-info-circle"></i>When jobs of these types are created, they will automatically be added into this queue.
+                    </p>
+                </div>
+            </td>
+        </tr>
+    </table>
 </div>
 @if (canDelete || canShowJobs)
 {
     <div class="actionBar">
         @if (canDelete)
         {
-            @Html.ActionLinkButton("Delete", MVC.API.JobQueue.Delete(Model.Token.JobQueue.Id, true), "Config_JobQueues_Actions_Delete_Button")
-            <div id="Config_JobQueues_Actions_Delete_Dialog" title="Delete this Job Queue?">
+            <button id="Config_JobQueues_Actions_Delete_Button" class="button" type="button">Delete</button>
+            <div id="Config_JobQueues_Actions_Delete_Dialog" class="dialog" title="Delete this Job Queue?">
+                @using (Html.BeginForm(MVC.API.JobQueue.Delete(Model.Token.JobQueue.Id, true)))
+                {
+                    @Html.AntiForgeryToken()
+                }
                 <p>
                     <i class="fa fa-exclamation-triangle fa-lg warning"></i>
                     This item will be permanently deleted and cannot be recovered.<br />
@@ -663,29 +644,29 @@
             </div>
             <script type="text/javascript">
                 $(function () {
-                    var button = $('#Config_JobQueues_Actions_Delete_Button');
-                    var buttonDialog = $('#Config_JobQueues_Actions_Delete_Dialog');
-                    var buttonLink = button.attr('href');
-                    button.attr('href', '#');
-                    button.click(function () {
-                        buttonDialog.dialog('open');
-                        return false;
-                    });
-                    buttonDialog.dialog({
-                        resizable: false,
-                        modal: true,
-                        autoOpen: false,
-                        buttons: {
-                            "Delete": function () {
-                                var $this = $(this);
-                                $this.dialog("disable");
-                                $this.dialog("option", "buttons", null);
-                                window.location.href = buttonLink;
-                            },
-                            Cancel: function () {
-                                $(this).dialog("close");
-                            }
+                    const $button = $('#Config_JobQueues_Actions_Delete_Button');
+                    let $buttonDialog = null;
+                    $button.on('click', function () {
+                        if (!$buttonDialog) {
+                            $buttonDialog = $('#Config_JobQueues_Actions_Delete_Dialog').dialog({
+                                resizable: false,
+                                modal: true,
+                                autoOpen: false,
+                                buttons: {
+                                    "Delete": function () {
+                                        var $this = $(this);
+                                        $this.dialog("option", "buttons", null);
+                                        $this.find('form').trigger('submit');
+                                    },
+                                    Cancel: function () {
+                                        $(this).dialog("close");
+                                    }
+                                }
+                            });
                         }
+
+                        $buttonDialog.dialog('open');
+                        return false;
                     });
                 });
             </script>

Disco.Web/Areas/Config/Views/Organisation/Index.cshtml

@@ -159,6 +159,7 @@
     <div id="dialogUpdateOrganisationLogo" title="Update Organisation Logo" class="dialog">
         @using (Html.BeginForm(MVC.API.System.OrganisationLogo(true, null, null), FormMethod.Post, new { enctype = "multipart/form-data" }))
         {
+            @Html.AntiForgeryToken()
             <h3>Update Organisation Logo</h3>
             <div style="margin-top: 10px; padding-bottom: 5px;">
                 <input id="updateOrganisationLogoResetLogo" type="radio" name="ResetLogo" value="true"