security: use more antiforgery tokens

Disco.BI/BI/Extensions/DocumentTemplateExtensions.cs

@@ -66,54 +66,54 @@ namespace Disco.BI.Extensions
             return CreateExpressions(templateFileName, database);
         }
 
-        public static Dictionary<string, Expression> PdfExpressionsFromCache(this DocumentTemplate dt, DiscoDataContext Database)
+        public static Dictionary<string, Expression> PdfExpressionsFromCache(this DocumentTemplate dt, DiscoDataContext database)
         {
-            return ExpressionCache.GetOrCreateExpressions(dt, () => CreateExpressions(dt, Database));
+            return ExpressionCache.GetOrCreateExpressions(dt, () => CreateExpressions(dt, database));
         }
 
-        public static List<DocumentField> PdfFieldsFromCache(this DocumentTemplate dt, DiscoDataContext Database)
+        public static List<DocumentField> PdfFieldsFromCache(this DocumentTemplate dt, DiscoDataContext database)
         {
-            return ExpressionCache.GetOrCreateFields(dt, () => CreateExpressions(dt, Database));
+            return ExpressionCache.GetOrCreateFields(dt, () => CreateExpressions(dt, database));
         }
 
-        public static List<Expression> ExtractPdfExpressions(this DocumentTemplate dt, DiscoDataContext Database)
+        public static List<Expression> ExtractPdfExpressions(this DocumentTemplate dt, DiscoDataContext database)
         {
-            return dt.PdfExpressionsFromCache(Database).Values.OrderBy(e => e.Ordinal).ToList();
+            return dt.PdfExpressionsFromCache(database).Values.OrderBy(e => e.Ordinal).ToList();
         }
 
-        public static Stream GeneratePdf(this DocumentTemplate dt, DiscoDataContext Database, IAttachmentTarget Target, User CreatorUser, DateTime TimeStamp, DocumentState State, bool FlattenFields = false)
+        public static Stream GeneratePdf(this DocumentTemplate dt, DiscoDataContext database, IAttachmentTarget target, User creatorUser, DateTime timeStamp, DocumentState state, bool flattenFields = false)
         {
             bool generateExpression = !string.IsNullOrEmpty(dt.OnGenerateExpression);
             string generateExpressionResult = null;
 
             if (generateExpression)
-                generateExpressionResult = dt.EvaluateOnGenerateExpression(Target, Database, CreatorUser, TimeStamp, State);
+                generateExpressionResult = dt.EvaluateOnGenerateExpression(target, database, creatorUser, timeStamp, state);
 
-            var pdfStream = Interop.Pdf.PdfGenerator.GenerateFromTemplate(dt, Database, Target, CreatorUser, TimeStamp, State, FlattenFields);
+            var pdfStream = Interop.Pdf.PdfGenerator.GenerateFromTemplate(dt, database, target, creatorUser, timeStamp, state, flattenFields);
 
             if (generateExpression)
-                DocumentsLog.LogDocumentGenerated(dt, Target, CreatorUser, generateExpressionResult);
+                DocumentsLog.LogDocumentGenerated(dt, target, creatorUser, generateExpressionResult);
             else
-                DocumentsLog.LogDocumentGenerated(dt, Target, CreatorUser);
+                DocumentsLog.LogDocumentGenerated(dt, target, creatorUser);
 
             return pdfStream;
         }
-        public static Stream GeneratePdfPackage(this DocumentTemplatePackage package, DiscoDataContext Database, IAttachmentTarget Target, User CreatorUser, DateTime TimeStamp, DocumentState State)
+        public static Stream GeneratePdfPackage(this DocumentTemplatePackage package, DiscoDataContext database, IAttachmentTarget target, User creatorUser, DateTime timeStamp, DocumentState state)
         {
-            return Interop.Pdf.PdfGenerator.GenerateFromPackage(package, Database, Target, CreatorUser, TimeStamp, State);
+            return Interop.Pdf.PdfGenerator.GenerateFromPackage(package, database, target, creatorUser, timeStamp, state);
         }
-        public static Stream GeneratePdfPackageBulk(this DocumentTemplatePackage package, DiscoDataContext Database, User CreatorUser, DateTime Timestamp, bool InsertBlankPages, List<string> DataObjectsIds)
+        public static Stream GeneratePdfPackageBulk(this DocumentTemplatePackage package, DiscoDataContext database, User creatorUser, DateTime timestamp, bool? insertBlankPages, List<string> dataObjectsIds)
         {
-            return Interop.Pdf.PdfGenerator.GenerateBulkFromPackage(package, Database, CreatorUser, Timestamp, InsertBlankPages, DataObjectsIds);
+            return Interop.Pdf.PdfGenerator.GenerateBulkFromPackage(package, database, creatorUser, timestamp, insertBlankPages, dataObjectsIds);
         }
-        public static Stream GeneratePdfPackageBulk(this DocumentTemplatePackage package, DiscoDataContext Database, User CreatorUser, DateTime Timestamp, bool InsertBlankPages, List<IAttachmentTarget> DataObjects)
+        public static Stream GeneratePdfPackageBulk(this DocumentTemplatePackage package, DiscoDataContext database, User creatorUser, DateTime timestamp, bool? insertBlankPages, List<IAttachmentTarget> dataObjects)
         {
-            return Interop.Pdf.PdfGenerator.GenerateBulkFromPackage(package, Database, CreatorUser, Timestamp, InsertBlankPages, DataObjects);
+            return Interop.Pdf.PdfGenerator.GenerateBulkFromPackage(package, database, creatorUser, timestamp, insertBlankPages, dataObjects);
         }
 
-        public static List<bool> PdfPageHasAttachmentId(this DocumentTemplate dt, DiscoDataContext Database)
+        public static List<bool> PdfPageHasAttachmentId(this DocumentTemplate dt, DiscoDataContext database)
         {
-            string templateFilename = dt.RepositoryFilename(Database);
+            string templateFilename = dt.RepositoryFilename(database);
             if (!File.Exists(templateFilename))
                 throw new FileNotFoundException("PDF template not found", templateFilename);
 

Disco.BI/BI/Interop/Pdf/PdfGenerator.cs

@@ -21,16 +21,16 @@ namespace Disco.BI.Interop.Pdf
 {
     public static class PdfGenerator
     {
-        public static Stream GenerateBulkFromPackage(DocumentTemplatePackage package, DiscoDataContext Database, User CreatorUser, DateTime Timestamp, bool InsertBlankPages, List<IAttachmentTarget> DataObjects)
+        public static Stream GenerateBulkFromPackage(DocumentTemplatePackage package, DiscoDataContext database, User creatorUser, DateTime timestamp, bool? insertBlankPages, List<IAttachmentTarget> dataObjects)
         {
-            if (DataObjects.Count > 0)
+            if (dataObjects.Count > 0)
             {
-                List<Stream> generatedPdfs = new List<Stream>(DataObjects.Count);
+                List<Stream> generatedPdfs = new List<Stream>(dataObjects.Count);
                 using (var state = DocumentState.DefaultState())
                 {
-                    foreach (var d in DataObjects)
+                    foreach (var d in dataObjects)
                     {
-                        generatedPdfs.Add(package.GeneratePdfPackage(Database, d, CreatorUser, Timestamp, state));
+                        generatedPdfs.Add(package.GeneratePdfPackage(database, d, creatorUser, timestamp, state));
                         state.SequenceNumber++;
                         state.FlushScopeCache();
                     }
@@ -41,7 +41,7 @@ namespace Disco.BI.Interop.Pdf
                 }
                 else
                 {
-                    Stream bulkPdf = Utilities.JoinPdfs(package.InsertBlankPages || InsertBlankPages, generatedPdfs);
+                    Stream bulkPdf = Utilities.JoinPdfs(insertBlankPages.GetValueOrDefault(package.InsertBlankPages), generatedPdfs);
                     foreach (Stream singlePdf in generatedPdfs)
                         singlePdf.Dispose();
                     return bulkPdf;
@@ -50,25 +50,25 @@ namespace Disco.BI.Interop.Pdf
             return null;
         }
 
-        public static Stream GenerateBulkFromPackage(DocumentTemplatePackage package, DiscoDataContext Database, User CreatorUser, DateTime Timestamp, bool InsertBlankPages, List<string> DataObjectsIds)
+        public static Stream GenerateBulkFromPackage(DocumentTemplatePackage package, DiscoDataContext database, User creatorUser, DateTime timestamp, bool? insertBlankPages, List<string> dataObjectsIds)
         {
             List<IAttachmentTarget> DataObjects;
 
             switch (package.Scope)
             {
                 case AttachmentTypes.Device:
-                    DataObjects = Database.Devices.Where(d => DataObjectsIds.Contains(d.SerialNumber)).ToList<IAttachmentTarget>();
+                    DataObjects = database.Devices.Where(d => dataObjectsIds.Contains(d.SerialNumber)).ToList<IAttachmentTarget>();
                     break;
                 case AttachmentTypes.Job:
-                    int[] intDataObjectsIds = DataObjectsIds.Select(i => int.Parse(i)).ToArray();
-                    DataObjects = Database.Jobs.Where(j => intDataObjectsIds.Contains(j.Id)).ToList<IAttachmentTarget>();
+                    int[] intDataObjectsIds = dataObjectsIds.Select(i => int.Parse(i)).ToArray();
+                    DataObjects = database.Jobs.Where(j => intDataObjectsIds.Contains(j.Id)).ToList<IAttachmentTarget>();
                     break;
                 case AttachmentTypes.User:
-                    DataObjects = new List<IAttachmentTarget>(DataObjectsIds.Count);
-                    for (int idIndex = 0; idIndex < DataObjectsIds.Count; idIndex++)
+                    DataObjects = new List<IAttachmentTarget>(dataObjectsIds.Count);
+                    for (int idIndex = 0; idIndex < dataObjectsIds.Count; idIndex++)
                     {
-                        string dataObjectId = DataObjectsIds[idIndex];
-                        var user = UserService.GetUser(ActiveDirectory.ParseDomainAccountId(dataObjectId), Database, true);
+                        string dataObjectId = dataObjectsIds[idIndex];
+                        var user = UserService.GetUser(ActiveDirectory.ParseDomainAccountId(dataObjectId), database, true);
                         if (user == null)
                             throw new Exception($"Unknown Username specified: {dataObjectId}");
                         DataObjects.Add(user);
@@ -78,12 +78,12 @@ namespace Disco.BI.Interop.Pdf
                     throw new InvalidOperationException("Invalid DocumentType Scope");
             }
 
-            return GenerateBulkFromPackage(package, Database, CreatorUser, Timestamp, InsertBlankPages, DataObjects);
+            return GenerateBulkFromPackage(package, database, creatorUser, timestamp, insertBlankPages, DataObjects);
         }
 
-        public static Stream GenerateFromPackage(DocumentTemplatePackage package, DiscoDataContext Database, IAttachmentTarget Data, User CreatorUser, DateTime Timestamp, DocumentState State)
+        public static Stream GenerateFromPackage(DocumentTemplatePackage package, DiscoDataContext database, IAttachmentTarget data, User creatorUser, DateTime timestamp, DocumentState state)
         {
-            var templates = package.GetDocumentTemplates(Database);
+            var templates = package.GetDocumentTemplates(database);
 
             if (templates.Count == 0)
                 return null;
@@ -92,21 +92,21 @@ namespace Disco.BI.Interop.Pdf
             string generateExpressionResult = null;
 
             if (generateExpression)
-                generateExpressionResult = package.EvaluateOnGenerateExpression(Data, Database, CreatorUser, Timestamp, State);
+                generateExpressionResult = package.EvaluateOnGenerateExpression(data, database, creatorUser, timestamp, state);
 
             List<Stream> generatedPdfs = new List<Stream>(templates.Count);
             foreach (var template in templates)
             {
-                generatedPdfs.Add(template.GeneratePdf(Database, Data, CreatorUser, Timestamp, State, true));
+                generatedPdfs.Add(template.GeneratePdf(database, data, creatorUser, timestamp, state, true));
 
-                State.SequenceNumber++;
-                State.FlushScopeCache();
+                state.SequenceNumber++;
+                state.FlushScopeCache();
             }
 
             if (generateExpression)
-                DocumentsLog.LogDocumentPackageGenerated(package, Data, CreatorUser, generateExpressionResult);
+                DocumentsLog.LogDocumentPackageGenerated(package, data, creatorUser, generateExpressionResult);
             else
-                DocumentsLog.LogDocumentPackageGenerated(package, Data, CreatorUser);
+                DocumentsLog.LogDocumentPackageGenerated(package, data, creatorUser);
 
             if (generatedPdfs.Count == 1)
             {
@@ -120,20 +120,20 @@ namespace Disco.BI.Interop.Pdf
                 return bulkPdf;
             }
         }
-        public static Stream GenerateBulkFromTemplate(DocumentTemplate dt, DiscoDataContext Database, User CreatorUser, DateTime Timestamp, bool InsertBlankPages, List<IAttachmentTarget> DataObjects, IScheduledTaskStatus taskStatus)
+        public static Stream GenerateBulkFromTemplate(DocumentTemplate dt, DiscoDataContext database, User creatorUser, DateTime timestamp, bool insertBlankPages, List<IAttachmentTarget> dataObjects, IScheduledTaskStatus taskStatus)
         {
-            if (DataObjects.Count > 0)
+            if (dataObjects.Count > 0)
             {
-                List<Stream> generatedPdfs = new List<Stream>(DataObjects.Count);
-                var progressPerDoc = 80d / DataObjects.Count;
+                List<Stream> generatedPdfs = new List<Stream>(dataObjects.Count);
+                var progressPerDoc = 80d / dataObjects.Count;
                 var progressDoc = 10d;
                 using (var state = DocumentState.DefaultState())
                 {
                     taskStatus.UpdateStatus(10, "Rendering", "Starting");
-                    foreach (var d in DataObjects)
+                    foreach (var d in dataObjects)
                     {
                         taskStatus.UpdateStatus(progressDoc += progressPerDoc, $"Rendering {d.AttachmentReferenceId}");
-                        generatedPdfs.Add(dt.GeneratePdf(Database, d, CreatorUser, Timestamp, state, true));
+                        generatedPdfs.Add(dt.GeneratePdf(database, d, creatorUser, timestamp, state, true));
                         state.SequenceNumber++;
                         state.FlushScopeCache();
                     }
@@ -145,7 +145,7 @@ namespace Disco.BI.Interop.Pdf
                 else
                 {
                     taskStatus.UpdateStatus(90, "Merging", "Merging documents");
-                    Stream bulkPdf = Utilities.JoinPdfs(InsertBlankPages, generatedPdfs);
+                    Stream bulkPdf = Utilities.JoinPdfs(insertBlankPages, generatedPdfs);
                     foreach (Stream singlePdf in generatedPdfs)
                         singlePdf.Dispose();
                     return bulkPdf;
@@ -154,28 +154,28 @@ namespace Disco.BI.Interop.Pdf
             return null;
         }
 
-        public static Stream GenerateBulkFromTemplate(DocumentTemplate dt, DiscoDataContext Database, User CreatorUser, DateTime Timestamp, bool InsertBlankPages, List<string> DataObjectsIds, IScheduledTaskStatus taskStatus)
+        public static Stream GenerateBulkFromTemplate(DocumentTemplate dt, DiscoDataContext database, User creatorUser, DateTime timestamp, bool insertBlankPages, List<string> dataObjectsIds, IScheduledTaskStatus taskStatus)
         {
             Dictionary<string, IAttachmentTarget> dataObjectLookup;
-            List<string> dataObjectIds = DataObjectsIds;
+            List<string> dataObjectIds = dataObjectsIds;
 
             taskStatus.UpdateStatus(0, "Resolving targets", "Resolving render targets");
 
             switch (dt.Scope)
             {
                 case DocumentTemplate.DocumentTemplateScopes.Device:
-                    dataObjectLookup = Database.Devices.Where(d => DataObjectsIds.Contains(d.SerialNumber)).AsEnumerable().Cast<IAttachmentTarget>().ToDictionary(i => i.AttachmentReferenceId, StringComparer.OrdinalIgnoreCase);
+                    dataObjectLookup = database.Devices.Where(d => dataObjectsIds.Contains(d.SerialNumber)).AsEnumerable().Cast<IAttachmentTarget>().ToDictionary(i => i.AttachmentReferenceId, StringComparer.OrdinalIgnoreCase);
                     break;
                 case DocumentTemplate.DocumentTemplateScopes.Job:
-                    var intDataObjectsIds = DataObjectsIds.Select(i => int.Parse(i)).ToList();
-                    dataObjectLookup = Database.Jobs.Where(j => intDataObjectsIds.Contains(j.Id)).AsEnumerable().Cast<IAttachmentTarget>().ToDictionary(i => i.AttachmentReferenceId, StringComparer.OrdinalIgnoreCase);
+                    var intDataObjectsIds = dataObjectsIds.Select(i => int.Parse(i)).ToList();
+                    dataObjectLookup = database.Jobs.Where(j => intDataObjectsIds.Contains(j.Id)).AsEnumerable().Cast<IAttachmentTarget>().ToDictionary(i => i.AttachmentReferenceId, StringComparer.OrdinalIgnoreCase);
                     break;
                 case DocumentTemplate.DocumentTemplateScopes.User:
-                    dataObjectLookup = new Dictionary<string, IAttachmentTarget>(DataObjectsIds.Count, StringComparer.OrdinalIgnoreCase);
-                    dataObjectIds = new List<string>(DataObjectsIds.Count);
-                    foreach (var userId in DataObjectsIds)
+                    dataObjectLookup = new Dictionary<string, IAttachmentTarget>(dataObjectsIds.Count, StringComparer.OrdinalIgnoreCase);
+                    dataObjectIds = new List<string>(dataObjectsIds.Count);
+                    foreach (var userId in dataObjectsIds)
                     {
-                        var user = UserService.GetUser(ActiveDirectory.ParseDomainAccountId(userId), Database, true);
+                        var user = UserService.GetUser(ActiveDirectory.ParseDomainAccountId(userId), database, true);
                         if (user == null)
                         {
                             dataObjectIds.Add(userId);
@@ -190,7 +190,7 @@ namespace Disco.BI.Interop.Pdf
             }
 
             // recreate list to honor the sort-order provided in DataObjectsIds
-            var dataObjects = new List<IAttachmentTarget>(DataObjectsIds.Count);
+            var dataObjects = new List<IAttachmentTarget>(dataObjectsIds.Count);
             var missingIds = new List<string>();
             foreach (var id in dataObjectIds)
             {
@@ -204,10 +204,10 @@ namespace Disco.BI.Interop.Pdf
                 throw new Exception($"Unknown id specified: {string.Join("; ", missingIds)}");
             }
 
-            return GenerateBulkFromTemplate(dt, Database, CreatorUser, Timestamp, InsertBlankPages, dataObjects, taskStatus);
+            return GenerateBulkFromTemplate(dt, database, creatorUser, timestamp, insertBlankPages, dataObjects, taskStatus);
         }
 
-        public static Stream GenerateFromTemplate(DocumentTemplate dt, DiscoDataContext Database, IAttachmentTarget Data, User CreatorUser, DateTime TimeStamp, DocumentState State, bool FlattenFields = false)
+        public static Stream GenerateFromTemplate(DocumentTemplate dt, DiscoDataContext Database, IAttachmentTarget Data, User CreatorUser, DateTime TimeStamp, DocumentState State, bool flattenFields = false)
         {
             // Validate Data
             switch (dt.Scope)
@@ -232,7 +232,7 @@ namespace Disco.BI.Interop.Pdf
 
             // Override FlattenFields if Document Template instructs.
             if (dt.FlattenForm)
-                FlattenFields = true;
+                flattenFields = true;
 
             var expressionCache = dt.PdfExpressionsFromCache(Database);
 
@@ -242,7 +242,7 @@ namespace Disco.BI.Interop.Pdf
             MemoryStream pdfGeneratedStream = new MemoryStream();
             PdfStamper pdfStamper = new PdfStamper(pdfReader, pdfGeneratedStream);
 
-            pdfStamper.FormFlattening = FlattenFields;
+            pdfStamper.FormFlattening = flattenFields;
             pdfStamper.Writer.CloseStream = false;
 
             IDictionary expressionVariables = Expression.StandardVariables(dt, Database, CreatorUser, TimeStamp, State, Data);
@@ -253,7 +253,7 @@ namespace Disco.BI.Interop.Pdf
                 {
                     AcroFields.Item fields = pdfStamper.AcroFields.Fields[pdfFieldKey];
                     string fieldValue = dt.CreateUniqueIdentifier(Database, Data, CreatorUser, TimeStamp, 0).ToJson();
-                    if (FlattenFields)
+                    if (flattenFields)
                         pdfStamper.AcroFields.SetField(pdfFieldKey, string.Empty);
                     else
                         pdfStamper.AcroFields.SetField(pdfFieldKey, fieldValue);

Disco.Models/UI/Config/AuthorizationRole/ConfigAuthorizationRoleCreateModel.cs

@@ -2,6 +2,6 @@
 {
     public interface ConfigAuthorizationRoleCreateModel : BaseUIModel
     {
-        Repository.AuthorizationRole AuthorizationRole { get; set; }
+        string Name { get; set; }
     }
 }

Disco.Models/UI/Config/DeviceBatch/ConfigDeviceBatchCreateModel.cs

@@ -1,7 +1,10 @@
-namespace Disco.Models.UI.Config.DeviceBatch
+using System;
+
+namespace Disco.Models.UI.Config.DeviceBatch
 {
     public interface ConfigDeviceBatchCreateModel : BaseUIModel
     {
-        Repository.DeviceBatch DeviceBatch { get; set; }
+        string Name { get; set; }
+        DateTime PurchaseDate { get; set; }
     }
 }

Disco.Models/UI/Config/DeviceFlag/ConfigDeviceFlagCreateModel.cs

@@ -2,6 +2,7 @@
 {
     public interface ConfigDeviceFlagCreateModel : BaseUIModel
     {
-        Repository.DeviceFlag DeviceFlag { get; set; }
+        string Name { get; set; }
+        string Description { get; set; }
     }
 }

Disco.Models/UI/Config/DeviceProfile/ConfigDeviceProfileCreateModel.cs

@@ -2,6 +2,8 @@
 {
     public interface ConfigDeviceProfileCreateModel : BaseUIModel
     {
-        Repository.DeviceProfile DeviceProfile { get; set; }
+        string Name { get; set; }
+        string ShortName { get; set; }
+        string Description { get; set; }
     }
 }

Disco.Models/UI/Config/DocumentTemplate/ConfigDocumentTemplateCreateModel.cs

@@ -4,7 +4,9 @@ namespace Disco.Models.UI.Config.DocumentTemplate
 {
     public interface ConfigDocumentTemplateCreateModel : BaseUIModel
     {
-        Repository.DocumentTemplate DocumentTemplate { get; set; }
+        string Id { get; set; }
+        string Description { get; set; }
+        string Scope { get; set; }
 
         List<string> Types { get; set; }
         List<string> SubTypes { get; set; }

Disco.Models/UI/Config/DocumentTemplate/ConfigDocumentTemplateCreatePackageModel.cs

@@ -1,11 +1,13 @@
-using Disco.Models.Services.Documents;
+using Disco.Models.Repository;
 using System.Collections.Generic;
 
 namespace Disco.Models.UI.Config.DocumentTemplate
 {
     public interface ConfigDocumentTemplateCreatePackageModel : BaseUIModel
     {
-        DocumentTemplatePackage Package { get; set; }
+        string Id { get; set; }
+        string Description { get; set; }
+        AttachmentTypes Scope { get; set; }
 
         List<string> Scopes { get; }
     }

Disco.Models/UI/Config/DocumentTemplate/ConfigDocumentTemplateShowModel.cs

@@ -1,4 +1,5 @@
 using Disco.Models.Services.Documents;
+using System;
 using System.Collections.Generic;
 
 namespace Disco.Models.UI.Config.DocumentTemplate
@@ -9,7 +10,7 @@ namespace Disco.Models.UI.Config.DocumentTemplate
         int StoredInstanceCount { get; set; }
         List<bool> TemplatePagesHaveAttachmentId { get; set; }
         int TemplatePageCount { get; }
-        string BulkGenerateDownloadId { get; }
+        Guid? BulkGenerateDownloadId { get; }
         string BulkGenerateDownloadFilename { get; }
 
         List<Repository.UserFlag> UserFlags { get; set; }

Disco.Models/UI/Config/JobQueue/ConfigJobQueueCreateModel.cs

@@ -2,6 +2,7 @@
 {
     public interface ConfigJobQueueCreateModel : BaseUIModel
     {
-        Repository.JobQueue JobQueue { get; set; }
+        string Name { get; set; }
+        string Description { get; set; }
     }
 }

Disco.Models/UI/Config/UserFlag/ConfigUserFlagCreateModel.cs

@@ -2,6 +2,7 @@
 {
     public interface ConfigUserFlagCreateModel : BaseUIModel
     {
-        Repository.UserFlag UserFlag { get; set; }
+        string Name { get; set; }
+        string Description { get; set; }
     }
 }

Disco.Services/Devices/DeviceFlags/DeviceFlagService.cs

@@ -45,25 +45,23 @@ namespace Disco.Services.Devices.DeviceFlags
         public static DeviceFlag GetDeviceFlag(int deviceFlagId) { return _cache.GetDeviceFlag(deviceFlagId); }
 
         #region Device Flag Maintenance
-        public static DeviceFlag CreateDeviceFlag(DiscoDataContext database, DeviceFlag deviceFlag)
+        public static DeviceFlag CreateDeviceFlag(DiscoDataContext database, string name, string description)
         {
             // Verify
-            if (string.IsNullOrWhiteSpace(deviceFlag.Name))
-                throw new ArgumentException("The Device Flag Name is required", nameof(deviceFlag));
+            if (string.IsNullOrWhiteSpace(name))
+                throw new ArgumentException("The Device Flag Name is required", nameof(name));
 
             // Name Unique
-            if (_cache.GetDeviceFlags().Any(f => f.Name == deviceFlag.Name))
-                throw new ArgumentException("Another Device Flag already exists with that name", nameof(deviceFlag));
+            if (_cache.GetDeviceFlags().Any(f => f.Name.Equals(name, StringComparison.Ordinal)))
+                throw new ArgumentException("Another Device Flag already exists with that name", nameof(name));
 
             // Clone to break reference
             var flag = new DeviceFlag()
             {
-                Name = deviceFlag.Name,
-                Description = deviceFlag.Description,
-                Icon = deviceFlag.Icon,
-                IconColour = deviceFlag.IconColour,
-                DevicesLinkedGroup = deviceFlag.DevicesLinkedGroup,
-                DeviceUsersLinkedGroup = deviceFlag.DeviceUsersLinkedGroup,
+                Name = name,
+                Description = description,
+                Icon = RandomUnusedIcon(),
+                IconColour = RandomUnusedThemeColour(),
             };
 
             database.DeviceFlags.Add(flag);

Disco.Services/Documents/DocumentBulkGenerateTask.cs

@@ -25,7 +25,7 @@ namespace Disco.Services.Documents
                 Directory.Delete(cachePath, true);
         }
 
-        public static Stream GetCached(DiscoDataContext database, string id)
+        public static Stream GetCached(DiscoDataContext database, Guid id)
         {
             var cachePath = GetCachePath(database);
             var path = Path.Combine(cachePath, $"{id}.pdf");

Disco.Services/Documents/DocumentTemplatePackages.cs

@@ -1,6 +1,7 @@
 using Disco.Data.Repository;
 using Disco.Models.Repository;
 using Disco.Models.Services.Documents;
+using Disco.Models.UI.Config.DocumentTemplate;
 using System;
 using System.Collections.Concurrent;
 using System.Collections.Generic;
@@ -121,19 +122,26 @@ namespace Disco.Services.Documents
             return packages;
         }
 
-        public static DocumentTemplatePackage CreatePackage(DocumentTemplatePackage Package)
+        public static DocumentTemplatePackage CreatePackage(string id, string description, AttachmentTypes scope)
         {
-            if (string.IsNullOrWhiteSpace(Package.Id))
-                throw new ArgumentNullException(nameof(Package), "The Package Id is required");
-            if (cache.ContainsKey(Package.Id)) // Name Unique
-                throw new ArgumentException("Another Package already exists with that Id", nameof(Package));
-            if (string.IsNullOrWhiteSpace(Package.Description))
-                throw new ArgumentNullException(nameof(Package), "The Package Description is required");
+            if (string.IsNullOrWhiteSpace(id))
+                throw new ArgumentNullException(nameof(id), "The Package Id is required");
+            if (cache.ContainsKey(id)) // Name Unique
+                throw new ArgumentException("Another Package already exists with that Id", nameof(id));
+            if (string.IsNullOrWhiteSpace(description))
+                throw new ArgumentNullException(nameof(description), "The Package Description is required");
 
-            if (cache.TryAdd(Package.Id, Package))
+            var package = new DocumentTemplatePackage()
+            {
+                Id = id,
+                Description = description,
+                Scope = scope,
+            };
+
+            if (cache.TryAdd(id, package))
             {
                 PersistCache();
-                return Package;
+                return package;
             }
             else
                 throw new Exception("Unable to add the Package to the Cache, check the Package Id and try again");

Disco.Services/Jobs/JobQueues/JobQueueService.cs

@@ -28,41 +28,24 @@ namespace Disco.Services.Jobs.JobQueues
         public static JobQueueToken GetQueue(int JobQueueId) { return _cache.GetQueue(JobQueueId); }
 
         #region Job Queues Maintenance
-        public static JobQueueToken CreateJobQueue(DiscoDataContext Database, JobQueue JobQueue)
+        public static JobQueueToken CreateJobQueue(DiscoDataContext Database, string name, string description)
         {
             // Verify
-            if (string.IsNullOrWhiteSpace(JobQueue.Name))
+            if (string.IsNullOrWhiteSpace(name))
                 throw new ArgumentException("The Job Queue Name is required");
 
             // Name Unique
-            if (_cache.GetQueues().Any(q => q.JobQueue.Name == JobQueue.Name))
+            if (_cache.GetQueues().Any(q => q.JobQueue.Name.Equals(name, StringComparison.Ordinal)))
                 throw new ArgumentException("Another Job Queue already exists with that name", "JobQueue");
 
-            // Sanitize Subject Ids
-            if (string.IsNullOrWhiteSpace(JobQueue.SubjectIds))
-            {
-                JobQueue.SubjectIds = null;
-            }
-            else
-            {
-                var subjectIds = JobQueue.SubjectIds.Split(',');
-                foreach (var subjectId in subjectIds)
-                {
-                    UserService.GetUser(subjectId, Database);
-                }
-                JobQueue.SubjectIds = string.Join(",", Database.Users.Where(u => subjectIds.Contains(u.UserId)).Select(u => u.UserId));
-            }
-
             // Clone to break reference
             var queue = new JobQueue()
             {
-                Name = JobQueue.Name,
-                Description = JobQueue.Description,
-                Icon = JobQueue.Icon,
-                IconColour = JobQueue.IconColour,
-                DefaultSLAExpiry = JobQueue.DefaultSLAExpiry,
-                Priority = JobQueue.Priority,
-                SubjectIds = JobQueue.SubjectIds
+                Name = name,
+                Description = description,
+                Icon = RandomUnusedIcon(),
+                IconColour = RandomUnusedThemeColour(),
+                Priority = JobQueuePriority.Normal,
             };
 
             Database.JobQueues.Add(queue);
@@ -85,15 +68,6 @@ namespace Disco.Services.Jobs.JobQueues
             {
                 JobQueue.SubjectIds = null;
             }
-            else
-            {
-                var subjectIds = JobQueue.SubjectIds.Split(',');
-                foreach (var subjectId in subjectIds)
-                {
-                    UserService.GetUser(subjectId, Database);
-                }
-                JobQueue.SubjectIds = string.Join(",", Database.Users.Where(u => subjectIds.Contains(u.UserId)).Select(u => u.UserId));
-            }
 
             Database.SaveChanges();
 

Disco.Services/Users/UserFlags/UserFlagService.cs

@@ -45,25 +45,23 @@ namespace Disco.Services.Users.UserFlags
         public static UserFlag GetUserFlag(int UserFlagId) { return _cache.GetUserFlag(UserFlagId); }
 
         #region User Flag Maintenance
-        public static UserFlag CreateUserFlag(DiscoDataContext Database, UserFlag UserFlag)
+        public static UserFlag CreateUserFlag(DiscoDataContext Database, string name, string description)
         {
             // Verify
-            if (string.IsNullOrWhiteSpace(UserFlag.Name))
-                throw new ArgumentException("The User Flag Name is required");
+            if (string.IsNullOrWhiteSpace(name))
+                throw new ArgumentException("The User Flag Name is required", nameof(name));
 
             // Name Unique
-            if (_cache.GetUserFlags().Any(f => f.Name == UserFlag.Name))
-                throw new ArgumentException("Another User Flag already exists with that name", "UserFlag");
+            if (_cache.GetUserFlags().Any(f => f.Name.Equals(name, StringComparison.Ordinal)))
+                throw new ArgumentException("Another User Flag already exists with that name", nameof(name));
 
             // Clone to break reference
             var flag = new UserFlag()
             {
-                Name = UserFlag.Name,
-                Description = UserFlag.Description,
-                Icon = UserFlag.Icon,
-                IconColour = UserFlag.IconColour,
-                UsersLinkedGroup = UserFlag.UsersLinkedGroup,
-                UserDevicesLinkedGroup = UserFlag.UserDevicesLinkedGroup
+                Name = name,
+                Description = description,
+                Icon = RandomUnusedIcon(),
+                IconColour = RandomUnusedThemeColour(),
             };
 
             Database.UserFlags.Add(flag);

Disco.Services/Users/UserService.cs

@@ -138,26 +138,28 @@ namespace Disco.Services.Users
             return Cache.InvalidateRecord(UserId);
         }
 
-        public static int CreateAuthorizationRole(DiscoDataContext Database, AuthorizationRole Role)
+        public static int CreateAuthorizationRole(DiscoDataContext Database, string name)
         {
-            if (Role == null)
+            if (string.IsNullOrWhiteSpace(name))
                 throw new ArgumentNullException("Role");
 
-            if (string.IsNullOrWhiteSpace(Role.ClaimsJson))
-                Role.ClaimsJson = JsonConvert.SerializeObject(new RoleClaims());
-
-            Database.AuthorizationRoles.Add(Role);
+            var role = new AuthorizationRole()
+            {
+                Name = name,
+                ClaimsJson = JsonConvert.SerializeObject(new RoleClaims()),
+            };
+            Database.AuthorizationRoles.Add(role);
             Database.SaveChanges();
 
-            AuthorizationLog.LogRoleCreated(Role, CurrentUserId);
+            AuthorizationLog.LogRoleCreated(role, CurrentUserId);
 
             // Add to Cache
-            RoleCache.AddRole(Role);
+            RoleCache.AddRole(role);
 
             // Flush User Cache
             Cache.FlushCache();
 
-            return Role.Id;
+            return role.Id;
         }
         public static void DeleteAuthorizationRole(DiscoDataContext Database, AuthorizationRole Role)
         {

Disco.Web/Areas/API/Controllers/AuthorizationRoleController.cs

@@ -17,7 +17,7 @@ namespace Disco.Web.Areas.API.Controllers
         #region Properties
 
         const string pName = "name";
-
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(int id, string key, string value = null, bool redirect = false)
         {
             try
@@ -40,19 +40,19 @@ namespace Disco.Web.Areas.API.Controllers
                 }
                 else
                 {
-                    return Json("Invalid Authorization Role Id", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Invalid Authorization Role Id");
                 }
                 if (redirect)
                     return RedirectToAction(MVC.Config.AuthorizationRole.Index(authorizationRole.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
@@ -96,27 +96,27 @@ namespace Disco.Web.Areas.API.Controllers
                 AuthorizationLog.LogRoleConfiguredClaimsAdded(AuthorizationRole, CurrentUser.UserId, addedClaims);
         }
 
-        private void UpdateSubjects(AuthorizationRole AuthorizationRole, string[] Subjects)
+        private void UpdateSubjects(AuthorizationRole AuthorizationRole, string[] subjects)
         {
             string subjectIds = null;
             string[] removedSubjects = null;
             string[] addedSubjects = null;
 
             // Validate Subjects
-            if (Subjects != null && Subjects.Length > 0)
+            if (subjects != null && subjects.Length > 0)
             {
-                var subjects = Subjects
+                var subjectRecords = subjects
                     .Where(s => !string.IsNullOrWhiteSpace(s))
                     .Select(s => s.Trim())
                     .Select(s => Tuple.Create(s, ActiveDirectory.RetrieveADObject(s, Quick: true)))
                     .Where(s => s.Item2 is ADUserAccount || s.Item2 is ADGroup)
                     .ToList();
-                var invalidSubjects = subjects.Where(s => s.Item2 == null).ToList();
+                var invalidSubjects = subjectRecords.Where(s => s.Item2 == null).ToList();
 
                 if (invalidSubjects.Count > 0)
                     throw new ArgumentException($"Subjects not found: {string.Join(", ", invalidSubjects)}", "Subjects");
 
-                var proposedSubjects = subjects.Select(s => s.Item2.Id).OrderBy(s => s).ToArray();
+                var proposedSubjects = subjectRecords.Select(s => s.Item2.Id).OrderBy(s => s).ToArray();
                 var currentSubjects = AuthorizationRole.SubjectIds == null ? new string[0] : AuthorizationRole.SubjectIds.Split(',');
                 removedSubjects = currentSubjects.Except(proposedSubjects).ToArray();
                 addedSubjects = proposedSubjects.Except(currentSubjects).ToArray();
@@ -139,12 +139,14 @@ namespace Disco.Web.Areas.API.Controllers
             }
         }
 
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateName(int id, string RoleName = null, bool redirect = false)
         {
             return Update(id, pName, RoleName, redirect);
         }
 
-        public virtual ActionResult UpdateClaims(int id, string[] ClaimKeys = null, bool redirect = false)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult UpdateClaims(int id, string[] claimKeys = null, bool redirect = false)
         {
             try
             {
@@ -154,26 +156,27 @@ namespace Disco.Web.Areas.API.Controllers
                 var authorizationRole = Database.AuthorizationRoles.Find(id);
                 if (authorizationRole != null)
                 {
-                    UpdateClaims(authorizationRole, ClaimKeys);
+                    UpdateClaims(authorizationRole, claimKeys);
                 }
                 else
                 {
-                    return Json("Invalid Authorization Role Id", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Invalid Authorization Role Id");
                 }
                 if (redirect)
                     return RedirectToAction(MVC.Config.AuthorizationRole.Index(authorizationRole.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateSubjects(int id, string[] Subjects = null, bool redirect = false)
         {
             try
@@ -188,26 +191,26 @@ namespace Disco.Web.Areas.API.Controllers
                 }
                 else
                 {
-                    return Json("Invalid Authorization Role Id", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Invalid Authorization Role Id");
                 }
                 if (redirect)
                     return RedirectToAction(MVC.Config.AuthorizationRole.Index(authorizationRole.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         #endregion
 
         #region Actions
-
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Delete(int id, bool? redirect = false)
         {
             try
@@ -220,7 +223,7 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect.HasValue && redirect.Value)
                         return RedirectToAction(MVC.Config.AuthorizationRole.Index(null));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 throw new Exception("Invalid Authorization Role Id");
             }
@@ -229,33 +232,33 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
-        [HttpPost]
-        public virtual ActionResult UpdateAdministratorSubjects(string[] Subjects, bool redirect = false)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult UpdateAdministratorSubjects(string[] subjects, bool redirect = false)
         {
             string[] proposedSubjects;
             string[] removedSubjects = null;
             string[] addedSubjects = null;
 
             // Validate Subjects
-            if (Subjects == null || Subjects.Length == 0)
+            if (subjects == null || subjects.Length == 0)
                 throw new ArgumentNullException("Subjects", "At least one Id must be supplied");
 
-            var subjects = Subjects
+            var subjectValues = subjects
                 .Where(s => !string.IsNullOrWhiteSpace(s))
                 .Select(s => s.Trim())
                 .Select(s => Tuple.Create(s, ActiveDirectory.RetrieveADObject(s, Quick: true)))
                 .Where(s => s.Item2 is ADUserAccount || s.Item2 is ADGroup)
                 .ToList();
-            var invalidSubjects = subjects.Where(s => s.Item2 == null).ToList();
+            var invalidSubjects = subjectValues.Where(s => s.Item2 == null).ToList();
 
             if (invalidSubjects.Count > 0)
                 throw new ArgumentException($"Subjects not found: {string.Join(", ", invalidSubjects)}", "Subjects");
 
-            proposedSubjects = subjects.Select(s => s.Item2.Id).OrderBy(s => s).ToArray();
+            proposedSubjects = subjectValues.Select(s => s.Item2.Id).OrderBy(s => s).ToArray();
             var currentSubjects = UserService.AdministratorSubjectIds;
             removedSubjects = currentSubjects.Except(proposedSubjects).ToArray();
             addedSubjects = proposedSubjects.Except(currentSubjects).ToArray();
@@ -270,7 +273,7 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.AuthorizationRole.Index());
             else
-                return Json("OK");
+                return Ok();
         }
 
         #endregion

Disco.Web/Areas/API/Controllers/BootstrapperController.cs

@@ -1,53 +0,0 @@
-using Disco.Services.Authorization;
-using Disco.Services.Web;
-using System;
-using System.Web.Mvc;
-
-namespace Disco.Web.Areas.API.Controllers
-{
-    [DiscoAuthorize(Claims.Config.Enrolment.Configure)]
-    public partial class BootstrapperController : AuthorizedDatabaseController
-    {
-        public virtual ActionResult MacSshUsername(string MacSshUsername)
-        {
-            try
-            {
-                if (!string.IsNullOrWhiteSpace(MacSshUsername))
-                {
-                    Database.DiscoConfiguration.Bootstrapper.MacSshUsername = MacSshUsername;
-                    Database.SaveChanges();
-                    return Json("OK", JsonRequestBehavior.AllowGet);
-                }
-                else
-                {
-                    throw new Exception("The Username cannot be null or empty");
-                }
-            }
-            catch (Exception ex)
-            {
-                return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
-            }
-        }
-        public virtual ActionResult MacSshPassword(string MacSshPassword)
-        {
-            try
-            {
-                if (!string.IsNullOrWhiteSpace(MacSshPassword))
-                {
-                    Database.DiscoConfiguration.Bootstrapper.MacSshPassword = MacSshPassword;
-                    Database.SaveChanges();
-                    return Json("OK", JsonRequestBehavior.AllowGet);
-                }
-                else
-                {
-                    throw new Exception("The Password cannot be null or empty");
-                }
-            }
-            catch (Exception ex)
-            {
-                return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
-            }
-        }
-
-    }
-}

Disco.Web/Areas/API/Controllers/DeviceBatchController.cs

@@ -9,6 +9,7 @@ using Disco.Services.Web;
 using Disco.Web.Extensions;
 using System;
 using System.Collections.Generic;
+using System.Data.Entity;
 using System.Drawing;
 using System.Linq;
 using System.Web.Mvc;
@@ -35,6 +36,7 @@ namespace Disco.Web.Areas.API.Controllers
         const string pAssignedUsersLinkedGroup = "assigneduserslinkedgroup";
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(int id, string key, string value = null, bool redirect = false)
         {
             Authorization.Require(Claims.Config.DeviceBatch.Configure);
@@ -104,109 +106,124 @@ namespace Disco.Web.Areas.API.Controllers
                 }
                 else
                 {
-                    return Json("Invalid Device Batch Id", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Invalid Device Batch Id");
                 }
                 if (redirect)
                     return RedirectToAction(MVC.Config.DeviceBatch.Index(deviceBatch.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         #region Update Shortcut Methods
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateName(int id, string BatchName = null, bool redirect = false)
         {
             return Update(id, pName, BatchName, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdatePurchaseDate(int id, string PurchaseDate = null, bool redirect = false)
         {
             return Update(id, pPurchaseDate, PurchaseDate, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateSupplier(int id, string Supplier = null, bool redirect = false)
         {
             return Update(id, pSupplier, Supplier, redirect);
         }
 
-        [DiscoAuthorize(Claims.Config.DeviceBatch.Configure), ValidateInput(false)]
-        public virtual ActionResult UpdatePurchaseDetails(int id, string PurchaseDetails = null, bool redirect = false)
+        [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken, ValidateInput(false)]
+        public virtual ActionResult UpdatePurchaseDetails(int id, string purchaseDetails = null, bool redirect = false)
         {
-            return Update(id, pPurchaseDetails, PurchaseDetails, redirect);
+            return Update(id, pPurchaseDetails, purchaseDetails, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateUnitCost(int id, string UnitCost = null, bool redirect = false)
         {
             return Update(id, pUnitCost, UnitCost, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateUnitQuantity(int id, string UnitQuantity = null, bool redirect = false)
         {
             return Update(id, pUnitQuantity, UnitQuantity, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDefaultDeviceModelId(int id, string DefaultDeviceModelId = null, bool redirect = false)
         {
             return Update(id, pDefaultDeviceModelId, DefaultDeviceModelId, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateWarrantyValidUntil(int id, string WarrantyValidUntil = null, bool redirect = false)
         {
             return Update(id, pWarrantyValidUntil, WarrantyValidUntil, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure), ValidateInput(false)]
-        public virtual ActionResult UpdateWarrantyDetails(int id, string WarrantyDetails = null, bool redirect = false)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult UpdateWarrantyDetails(int id, string warrantyDetails = null, bool redirect = false)
         {
-            return Update(id, pWarrantyDetails, WarrantyDetails, redirect);
+            return Update(id, pWarrantyDetails, warrantyDetails, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuredDate(int id, string InsuredDate = null, bool redirect = false)
         {
             return Update(id, pInsuredDate, InsuredDate, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceSupplier(int id, string InsuranceSupplier = null, bool redirect = false)
         {
             return Update(id, pInsuranceSupplier, InsuranceSupplier, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuredUntil(int id, string InsuredUntil = null, bool redirect = false)
         {
             return Update(id, pInsuredUntil, InsuredUntil, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure), ValidateInput(false)]
-        public virtual ActionResult UpdateInsuranceDetails(int id, string InsuranceDetails = null, bool redirect = false)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult UpdateInsuranceDetails(int id, string insuranceDetails = null, bool redirect = false)
         {
-            return Update(id, pInsuranceDetails, InsuranceDetails, redirect);
+            return Update(id, pInsuranceDetails, insuranceDetails, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure), ValidateInput(false)]
-        public virtual ActionResult UpdateComments(int id, string Comments = null, bool redirect = false)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult UpdateComments(int id, string comments = null, bool redirect = false)
         {
-            return Update(id, pComments, Comments, redirect);
+            return Update(id, pComments, comments, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDevicesLinkedGroup(int id, string GroupId = null, bool redirect = false)
         {
             try
@@ -228,17 +245,18 @@ namespace Disco.Web.Areas.API.Controllers
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
                     }
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateAssignedUsersLinkedGroup(int id, string GroupId = null, bool redirect = false)
         {
             try
@@ -260,42 +278,42 @@ namespace Disco.Web.Areas.API.Controllers
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
                     }
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         #endregion
 
         #region Update Properties
-        private void UpdateName(DeviceBatch deviceBatch, string Name)
+        private void UpdateName(DeviceBatch deviceBatch, string name)
         {
-            if (string.IsNullOrWhiteSpace(Name))
+            if (string.IsNullOrWhiteSpace(name))
                 throw new ArgumentNullException("Name", "Device Batch Name is required");
             else
             {
                 // Check for Duplicates
-                var d = Database.DeviceBatches.Where(db => db.Id != deviceBatch.Id && db.Name == Name).Count();
+                var d = Database.DeviceBatches.Where(db => db.Id != deviceBatch.Id && db.Name == name).Count();
                 if (d > 0)
                 {
                     throw new Exception("A Device Batch with that name already exists");
                 }
-                deviceBatch.Name = Name;
+                deviceBatch.Name = name;
             }
             Database.SaveChanges();
         }
-        private void UpdatePurchaseDate(DeviceBatch deviceBatch, string PurchaseDate)
+        private void UpdatePurchaseDate(DeviceBatch deviceBatch, string purchaseDate)
         {
-            if (string.IsNullOrEmpty(PurchaseDate))
+            if (string.IsNullOrEmpty(purchaseDate))
                 throw new ArgumentNullException("PurchaseDate", "A Device Batch Purchase Date is required");
             else
             {
-                if (DateTime.TryParse(PurchaseDate, out var ecd))
+                if (DateTime.TryParse(purchaseDate, out var ecd))
                 {
                     deviceBatch.PurchaseDate = ecd.Date;
                 }
@@ -306,48 +324,48 @@ namespace Disco.Web.Areas.API.Controllers
             }
             Database.SaveChanges();
         }
-        private void UpdateSupplier(DeviceBatch deviceBatch, string Supplier)
+        private void UpdateSupplier(DeviceBatch deviceBatch, string supplier)
         {
-            if (string.IsNullOrWhiteSpace(Supplier))
+            if (string.IsNullOrWhiteSpace(supplier))
                 deviceBatch.Supplier = null;
             else
-                deviceBatch.Supplier = Supplier;
+                deviceBatch.Supplier = supplier;
             Database.SaveChanges();
         }
-        private void UpdatePurchaseDetails(DeviceBatch deviceBatch, string PurchaseDetails)
+        private void UpdatePurchaseDetails(DeviceBatch deviceBatch, string purchaseDetails)
         {
-            if (string.IsNullOrWhiteSpace(PurchaseDetails))
+            if (string.IsNullOrWhiteSpace(purchaseDetails))
                 deviceBatch.PurchaseDetails = null;
             else
-                deviceBatch.PurchaseDetails = PurchaseDetails;
+                deviceBatch.PurchaseDetails = purchaseDetails;
             Database.SaveChanges();
         }
-        private void UpdateUnitCost(DeviceBatch deviceBatch, string UnitCost)
+        private void UpdateUnitCost(DeviceBatch deviceBatch, string unitCost)
         {
-            if (string.IsNullOrWhiteSpace(UnitCost))
+            if (string.IsNullOrWhiteSpace(unitCost))
                 deviceBatch.UnitCost = null;
             else
             {
-                if (decimal.TryParse(UnitCost, out var unitCost))
-                {
-                    deviceBatch.UnitCost = unitCost;
-                }
+                unitCost = unitCost.Trim();
+                if (unitCost.StartsWith("$"))
+                    unitCost = unitCost.Substring(1).Trim(); // Remove $ sign if present
+
+                if (decimal.TryParse(unitCost, out var unitCostValue))
+                    deviceBatch.UnitCost = unitCostValue;
                 else
-                {
                     throw new Exception("Invalid Currency Format");
-                }
             }
             Database.SaveChanges();
         }
-        private void UpdateUnitQuantity(DeviceBatch deviceBatch, string UnitQuantity)
+        private void UpdateUnitQuantity(DeviceBatch deviceBatch, string unitQuantity)
         {
-            if (string.IsNullOrWhiteSpace(UnitQuantity))
+            if (string.IsNullOrWhiteSpace(unitQuantity))
                 deviceBatch.UnitQuantity = null;
             else
             {
-                if (int.TryParse(UnitQuantity, out var unitQuantity))
+                if (int.TryParse(unitQuantity, out var unitQuantityValue))
                 {
-                    deviceBatch.UnitQuantity = unitQuantity;
+                    deviceBatch.UnitQuantity = unitQuantityValue;
                 }
                 else
                 {
@@ -356,11 +374,11 @@ namespace Disco.Web.Areas.API.Controllers
             }
             Database.SaveChanges();
         }
-        private void UpdateDefaultDeviceModelId(DeviceBatch deviceBatch, string DefaultDeviceModelId)
+        private void UpdateDefaultDeviceModelId(DeviceBatch deviceBatch, string defaultDeviceModelId)
         {
-            if (!string.IsNullOrEmpty(DefaultDeviceModelId))
+            if (!string.IsNullOrEmpty(defaultDeviceModelId))
             {
-                if (int.TryParse(DefaultDeviceModelId, out var bId))
+                if (int.TryParse(defaultDeviceModelId, out var bId))
                 {
                     var dm = Database.DeviceModels.Find(bId);
                     if (dm != null)
@@ -384,13 +402,13 @@ namespace Disco.Web.Areas.API.Controllers
             }
             throw new Exception("Invalid Device Model Id");
         }
-        private void UpdateWarrantyValidUntil(DeviceBatch deviceBatch, string WarrantyValidUntil)
+        private void UpdateWarrantyValidUntil(DeviceBatch deviceBatch, string warrantyValidUntil)
         {
-            if (string.IsNullOrEmpty(WarrantyValidUntil))
+            if (string.IsNullOrEmpty(warrantyValidUntil))
                 deviceBatch.WarrantyValidUntil = null;
             else
             {
-                if (DateTime.TryParse(WarrantyValidUntil, out var ecd))
+                if (DateTime.TryParse(warrantyValidUntil, out var ecd))
                 {
                     deviceBatch.WarrantyValidUntil = ecd.Date;
                 }
@@ -401,21 +419,21 @@ namespace Disco.Web.Areas.API.Controllers
             }
             Database.SaveChanges();
         }
-        private void UpdateWarrantyDetails(DeviceBatch deviceBatch, string WarrantyDetails)
+        private void UpdateWarrantyDetails(DeviceBatch deviceBatch, string warrantyDetails)
         {
-            if (string.IsNullOrWhiteSpace(WarrantyDetails))
+            if (string.IsNullOrWhiteSpace(warrantyDetails))
                 deviceBatch.WarrantyDetails = null;
             else
-                deviceBatch.WarrantyDetails = WarrantyDetails;
+                deviceBatch.WarrantyDetails = warrantyDetails;
             Database.SaveChanges();
         }
-        private void UpdateInsuredDate(DeviceBatch deviceBatch, string InsuredDate)
+        private void UpdateInsuredDate(DeviceBatch deviceBatch, string insuredDate)
         {
-            if (string.IsNullOrEmpty(InsuredDate))
+            if (string.IsNullOrEmpty(insuredDate))
                 deviceBatch.InsuredDate = null;
             else
             {
-                if (DateTime.TryParse(InsuredDate, out var ecd))
+                if (DateTime.TryParse(insuredDate, out var ecd))
                 {
                     deviceBatch.InsuredDate = ecd.Date;
                 }
@@ -426,21 +444,21 @@ namespace Disco.Web.Areas.API.Controllers
             }
             Database.SaveChanges();
         }
-        private void UpdateInsuranceSupplier(DeviceBatch deviceBatch, string InsuranceSupplier)
+        private void UpdateInsuranceSupplier(DeviceBatch deviceBatch, string insuranceSupplier)
         {
-            if (string.IsNullOrWhiteSpace(InsuranceSupplier))
+            if (string.IsNullOrWhiteSpace(insuranceSupplier))
                 deviceBatch.InsuranceSupplier = null;
             else
-                deviceBatch.InsuranceSupplier = InsuranceSupplier;
+                deviceBatch.InsuranceSupplier = insuranceSupplier;
             Database.SaveChanges();
         }
-        private void UpdateInsuredUntil(DeviceBatch deviceBatch, string InsuredUntil)
+        private void UpdateInsuredUntil(DeviceBatch deviceBatch, string insuredUntil)
         {
-            if (string.IsNullOrEmpty(InsuredUntil))
+            if (string.IsNullOrEmpty(insuredUntil))
                 deviceBatch.InsuredUntil = null;
             else
             {
-                if (DateTime.TryParse(InsuredUntil, out var ecd))
+                if (DateTime.TryParse(insuredUntil, out var ecd))
                 {
                     deviceBatch.InsuredUntil = ecd.Date;
                 }
@@ -451,26 +469,26 @@ namespace Disco.Web.Areas.API.Controllers
             }
             Database.SaveChanges();
         }
-        private void UpdateInsuranceDetails(DeviceBatch deviceBatch, string InsuranceDetails)
+        private void UpdateInsuranceDetails(DeviceBatch deviceBatch, string insuranceDetails)
         {
-            if (string.IsNullOrWhiteSpace(InsuranceDetails))
+            if (string.IsNullOrWhiteSpace(insuranceDetails))
                 deviceBatch.InsuranceDetails = null;
             else
-                deviceBatch.InsuranceDetails = InsuranceDetails;
+                deviceBatch.InsuranceDetails = insuranceDetails;
             Database.SaveChanges();
         }
-        private void UpdateComments(DeviceBatch deviceBatch, string Comments)
+        private void UpdateComments(DeviceBatch deviceBatch, string comments)
         {
-            if (string.IsNullOrWhiteSpace(Comments))
+            if (string.IsNullOrWhiteSpace(comments))
                 deviceBatch.Comments = null;
             else
-                deviceBatch.Comments = Comments;
+                deviceBatch.Comments = comments;
             Database.SaveChanges();
         }
 
-        private ScheduledTaskStatus UpdateDevicesLinkedGroup(DeviceBatch DeviceBatch, string DevicesLinkedGroup)
+        private ScheduledTaskStatus UpdateDevicesLinkedGroup(DeviceBatch DeviceBatch, string devicesLinkedGroup)
         {
-            var configJson = ADManagedGroup.ValidConfigurationToJson(DeviceBatchDevicesManagedGroup.GetKey(DeviceBatch), DevicesLinkedGroup, null);
+            var configJson = ADManagedGroup.ValidConfigurationToJson(DeviceBatchDevicesManagedGroup.GetKey(DeviceBatch), devicesLinkedGroup, null);
 
             if (DeviceBatch.DevicesLinkedGroup != configJson)
             {
@@ -485,9 +503,9 @@ namespace Disco.Web.Areas.API.Controllers
             return null;
         }
 
-        private ScheduledTaskStatus UpdateAssignedUsersLinkedGroup(DeviceBatch DeviceBatch, string AssignedUsersLinkedGroup)
+        private ScheduledTaskStatus UpdateAssignedUsersLinkedGroup(DeviceBatch DeviceBatch, string assignedUsersLinkedGroup)
         {
-            var configJson = ADManagedGroup.ValidConfigurationToJson(DeviceBatchAssignedUsersManagedGroup.GetKey(DeviceBatch), AssignedUsersLinkedGroup, null);
+            var configJson = ADManagedGroup.ValidConfigurationToJson(DeviceBatchAssignedUsersManagedGroup.GetKey(DeviceBatch), assignedUsersLinkedGroup, null);
 
             if (DeviceBatch.AssignedUsersLinkedGroup != configJson)
             {
@@ -506,6 +524,7 @@ namespace Disco.Web.Areas.API.Controllers
         #region Actions
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Delete)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Delete(int id, bool? redirect = false)
         {
             try
@@ -518,7 +537,7 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect.HasValue && redirect.Value)
                         return RedirectToAction(MVC.Config.DeviceBatch.Index(null));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 throw new Exception("Invalid Device Batch Number");
             }
@@ -527,7 +546,7 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
@@ -536,6 +555,7 @@ namespace Disco.Web.Areas.API.Controllers
         #region Index
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Show)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Index(int? id)
         {
             if (id.HasValue)
@@ -556,6 +576,7 @@ namespace Disco.Web.Areas.API.Controllers
         #region Timeline
 
         [DiscoAuthorizeAll(Claims.Config.DeviceBatch.Show, Claims.Config.DeviceBatch.ShowTimeline)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Timeline()
         {
 
@@ -601,7 +622,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
         #endregion
 
-        #region Attachements
+        #region Attachments
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Show)]
         [OutputCache(Location = System.Web.UI.OutputCacheLocation.Client, Duration = 172800)]
@@ -660,6 +681,9 @@ namespace Disco.Web.Areas.API.Controllers
                         if (string.IsNullOrEmpty(contentType) || contentType.Equals("unknown/unknown", StringComparison.OrdinalIgnoreCase))
                             contentType = MimeTypes.ResolveMimeType(file.FileName);
 
+                        if (string.IsNullOrWhiteSpace(comments))
+                            comments = null;
+
                         var attachment = new DeviceBatchAttachment()
                         {
                             DeviceBatchId = batch.Id,
@@ -687,7 +711,7 @@ namespace Disco.Web.Areas.API.Controllers
         [DiscoAuthorize(Claims.Config.DeviceBatch.Show)]
         public virtual ActionResult Attachment(int id)
         {
-            var attachment = Database.DeviceBatchAttachments.Include("TechUser").Where(m => m.Id == id).FirstOrDefault();
+            var attachment = Database.DeviceBatchAttachments.Include(a => a.TechUser).Where(m => m.Id == id).FirstOrDefault();
             if (attachment != null)
             {
 
@@ -699,13 +723,13 @@ namespace Disco.Web.Areas.API.Controllers
 
                 return Json(m, JsonRequestBehavior.AllowGet);
             }
-            return Json(new Models.Attachment.AttachmentModel() { Result = "Invalid Attachment Number" }, JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Attachment Number");
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Show)]
         public virtual ActionResult Attachments(int id)
         {
-            var batch = Database.DeviceBatches.Include("DeviceBatchAttachments.TechUser").Where(m => m.Id == id).FirstOrDefault();
+            var batch = Database.DeviceBatches.Include(b => b.DeviceBatchAttachments.Select(a => a.TechUser)).Where(m => m.Id == id).FirstOrDefault();
             if (batch != null)
             {
                 var m = new Models.Attachment.AttachmentsModel()
@@ -716,20 +740,21 @@ namespace Disco.Web.Areas.API.Controllers
 
                 return Json(m, JsonRequestBehavior.AllowGet);
             }
-            return Json(new Models.Attachment.AttachmentsModel() { Result = "Invalid Device Batch Id" }, JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Device Batch Id");
         }
 
         [DiscoAuthorize(Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult AttachmentRemove(int id)
         {
-            var attachment = Database.DeviceBatchAttachments.Include("TechUser").Where(m => m.Id == id).FirstOrDefault();
+            var attachment = Database.DeviceBatchAttachments.Include(a => a.TechUser).Where(m => m.Id == id).FirstOrDefault();
             if (attachment != null)
             {
                 attachment.OnDelete(Database);
                 Database.SaveChanges();
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
             }
-            return Json("Invalid Attachment Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Attachment Number");
         }
 
         #endregion

Disco.Web/Areas/API/Controllers/DeviceCertificateController.cs

@@ -9,6 +9,7 @@ namespace Disco.Web.Areas.API.Controllers
     {
 
         [DiscoAuthorize(Claims.Config.DeviceCertificate.DownloadCertificates)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Download(int id)
         {
             var wc = Database.DeviceCertificates.Find(id);

Disco.Web/Areas/API/Controllers/DeviceController.cs

@@ -26,7 +26,6 @@ namespace Disco.Web.Areas.API.Controllers
 {
     public partial class DeviceController : AuthorizedDatabaseController
     {
-
         const string pDeviceProfileId = "deviceprofileid";
         const string pDeviceBatchId = "devicebatchid";
         const string pAssetNumber = "assetnumber";
@@ -37,6 +36,7 @@ namespace Disco.Web.Areas.API.Controllers
         const string pDetailBattery = "detailbattery";
         const string pDetailKeyboard = "detailkeyboard";
 
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(string id, string key, string value = null, bool redirect = false)
         {
             Database.Configuration.LazyLoadingEnabled = true;
@@ -99,20 +99,21 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect)
                     return RedirectToAction(MVC.Device.Show(device.SerialNumber));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         #region Update Shortcut Methods
 
-        [DiscoAuthorize(Claims.Device.Properties.DeviceProfile), HttpPost, ValidateAntiForgeryToken]
+        [DiscoAuthorize(Claims.Device.Properties.DeviceProfile)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDeviceProfileId(string id, string DeviceProfileId = null, bool enforceOrganisationalUnit = false, bool redirect = false)
         {
             var updateResult = Update(id, pDeviceProfileId, DeviceProfileId, redirect);
@@ -163,24 +164,28 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.Device.Properties.DeviceBatch)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDeviceBatchId(string id, string DeviceBatchId = null, bool redirect = false)
         {
             return Update(id, pDeviceBatchId, DeviceBatchId, redirect);
         }
 
         [DiscoAuthorize(Claims.Device.Properties.AssetNumber)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateAssetNumber(string id, string AssetNumber = null, bool redirect = false)
         {
             return Update(id, pAssetNumber, AssetNumber, redirect);
         }
 
         [DiscoAuthorize(Claims.Device.Properties.Location)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateLocation(string id, string Location = null, bool redirect = false)
         {
             return Update(id, pLocation, Location, redirect);
         }
 
         [DiscoAuthorize(Claims.Device.Actions.AssignUser)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateAssignedUserId(string id, string AssignedUserId = null, bool redirect = false)
         {
             if (!string.IsNullOrWhiteSpace(AssignedUserId))
@@ -190,24 +195,28 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.Device.Actions.AllowUnauthenticatedEnrol)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateAllowUnauthenticatedEnrol(string id, string AllowUnauthenticatedEnrol = null, bool redirect = false)
         {
             return Update(id, pAllowUnauthenticatedEnrol, AllowUnauthenticatedEnrol, redirect);
         }
 
         [DiscoAuthorize(Claims.Device.Properties.Details)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDetailACAdapter(string id, string DetailACAdapter = null, bool redirect = false)
         {
             return Update(id, pDetailACAdapter, DetailACAdapter, redirect);
         }
 
         [DiscoAuthorize(Claims.Device.Properties.Details)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDetailBattery(string id, string DetailBattery = null, bool redirect = false)
         {
             return Update(id, pDetailBattery, DetailBattery, redirect);
         }
 
         [DiscoAuthorize(Claims.Device.Properties.Details)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDetailKeyboard(string id, string DetailKeyboard = null, bool redirect = false)
         {
             return Update(id, pDetailKeyboard, DetailKeyboard, redirect);
@@ -344,31 +353,36 @@ namespace Disco.Web.Areas.API.Controllers
         #region Device Actions
 
         [DiscoAuthorize(Claims.Device.Actions.Decommission)]
-        public virtual ActionResult Decommission(string id, int Reason, bool redirect)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult Decommission(string id, int? Reason = null, bool redirect = false)
         {
+            if (Reason == null)
+                throw new ArgumentNullException(nameof(Reason), "Decommission Reason is required");
+
             var d = Database.Devices.Find(id);
             Database.Configuration.LazyLoadingEnabled = true;
             if (d != null)
             {
                 if (d.CanDecommission())
                 {
-                    d.OnDecommission((DecommissionReasons)Reason, Database);
+                    d.OnDecommission((DecommissionReasons)Reason.Value, Database);
 
                     Database.SaveChanges();
                     if (redirect)
                         return RedirectToAction(MVC.Device.Show(id));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 else
                 {
-                    return Json("Device's state doesn't allow this action", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Device's state doesn't allow this action");
                 }
             }
-            return Json("Invalid Device Serial Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Device Serial Number");
         }
 
         [DiscoAuthorize(Claims.Device.Actions.Recommission)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Recommission(string id, bool redirect)
         {
             var d = Database.Devices.Find(id);
@@ -383,17 +397,18 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect)
                         return RedirectToAction(MVC.Device.Show(id));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 else
                 {
-                    return Json("Device's state doesn't allow this action", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Device's state doesn't allow this action");
                 }
             }
-            return Json("Invalid Device Serial Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Device Serial Number");
         }
 
         [DiscoAuthorize(Claims.Device.Actions.Delete)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Delete(string id, bool redirect)
         {
             var j = Database.Devices.Find(id);
@@ -408,43 +423,20 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect)
                         return RedirectToAction(MVC.Device.Index());
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 else
                 {
-                    return Json("Job's state doesn't allow this action", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Job's state doesn't allow this action");
                 }
             }
-            return Json("Invalid Device Serial Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Device Serial Number");
         }
 
         #endregion
 
-        [DiscoAuthorize(Claims.Device.Actions.GenerateDocuments)]
-        public virtual ActionResult GeneratePdf(string id, string DocumentTemplateId)
-        {
-            if (string.IsNullOrEmpty(id))
-                throw new ArgumentNullException(nameof(id));
-            if (string.IsNullOrEmpty(DocumentTemplateId))
-                throw new ArgumentNullException(nameof(DocumentTemplateId));
-
-            // Obsolete: Use API\DocumentTemplate\Generate instead
-            return RedirectToAction(MVC.API.DocumentTemplate.Generate(DocumentTemplateId, id));
-        }
-
-        [DiscoAuthorize(Claims.Device.Actions.GenerateDocuments)]
-        public virtual ActionResult GeneratePdfPackage(string id, string DocumentTemplatePackageId)
-        {
-            if (string.IsNullOrEmpty(id))
-                throw new ArgumentNullException(nameof(id));
-            if (string.IsNullOrEmpty(DocumentTemplatePackageId))
-                throw new ArgumentNullException(nameof(DocumentTemplatePackageId));
-
-            // Obsolete: Use API\DocumentTemplatePackage\Generate instead
-            return RedirectToAction(MVC.API.DocumentTemplatePackage.Generate(DocumentTemplatePackageId, id));
-        }
-
         [DiscoAuthorize(Claims.Device.Show)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult LastNetworkLogonDate(string id)
         {
             if (string.IsNullOrWhiteSpace(id))
@@ -585,7 +577,8 @@ namespace Disco.Web.Areas.API.Controllers
             return HttpNotFound("Invalid Attachment Number");
         }
 
-        [DiscoAuthorize(Claims.Device.Actions.AddAttachments), ValidateAntiForgeryToken]
+        [DiscoAuthorize(Claims.Device.Actions.AddAttachments)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult AttachmentUpload(string id, string comments)
         {
             var d = Database.Devices.Find(id);
@@ -644,7 +637,7 @@ namespace Disco.Web.Areas.API.Controllers
 
                 return Json(m, JsonRequestBehavior.AllowGet);
             }
-            return Json(new Models.Attachment.AttachmentModel() { Result = "Invalid Attachment Number" }, JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Attachment Number");
         }
 
         [DiscoAuthorize(Claims.Device.ShowAttachments)]
@@ -661,10 +654,11 @@ namespace Disco.Web.Areas.API.Controllers
 
                 return Json(m, JsonRequestBehavior.AllowGet);
             }
-            return Json(new Models.Attachment.AttachmentsModel() { Result = "Invalid Device Serial Number" }, JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Device Serial Number");
         }
 
         [DiscoAuthorizeAny(Claims.Job.Actions.RemoveAnyAttachments, Claims.Job.Actions.RemoveOwnAttachments)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult AttachmentRemove(int id)
         {
             var da = Database.DeviceAttachments.Include("TechUser").Where(m => m.Id == id).FirstOrDefault();
@@ -677,9 +671,9 @@ namespace Disco.Web.Areas.API.Controllers
 
                 da.OnDelete(Database);
                 Database.SaveChanges();
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
             }
-            return Json("Invalid Attachment Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Attachment Number");
         }
 
         [DiscoAuthorize(Claims.Device.Actions.AddAttachments)]
@@ -706,11 +700,7 @@ namespace Disco.Web.Areas.API.Controllers
             }
             catch (InvalidOperationException ex)
             {
-                return Json(new
-                {
-                    Success = false,
-                    ErrorMessage = ex.Message,
-                });
+                return BadRequest(ex.Message);
             }
         }
 
@@ -736,6 +726,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.Device.Actions.Import)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult ImportBegin(HttpPostedFileBase ImportFile, bool HasHeader)
         {
             if (ImportFile == null || ImportFile.ContentLength == 0)
@@ -752,15 +743,14 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.Device.Actions.Import)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult ImportParse(string Id, List<DeviceImportFieldTypes> Headers)
         {
             if (string.IsNullOrWhiteSpace(Id))
-                throw new ArgumentNullException("Id");
+                throw new ArgumentNullException(nameof(Id));
 
-            var context = Import_RetrieveContext(Id);
-
-            if (context == null)
-                throw new ArgumentException("The Import Session Id is invalid or the session timed out (60 minutes), try importing again", "Id");
+            var context = Import_RetrieveContext(Id)
+                ?? throw new ArgumentException("The Import Session Id is invalid or the session timed out (60 minutes), try importing again", nameof(Id));
 
             context.UpdateColumnTypes(Headers);
 
@@ -777,15 +767,14 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.Device.Actions.Import)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult ImportApply(string Id)
         {
             if (string.IsNullOrWhiteSpace(Id))
-                throw new ArgumentNullException("Id");
+                throw new ArgumentNullException(nameof(Id));
 
-            var context = Import_RetrieveContext(Id);
-
-            if (context == null)
-                throw new ArgumentException("The Import Session Id is invalid or the session timed out (60 minutes), try importing again", "Id");
+            var context = Import_RetrieveContext(Id)
+                ?? throw new ArgumentException("The Import Session Id is invalid or the session timed out (60 minutes), try importing again", nameof(Id));
 
             var status = DeviceImportApplyTask.ScheduleNow(context);
             status.SetFinishedUrl(Url.Action(MVC.Device.Import(context.SessionId)));
@@ -895,6 +884,7 @@ namespace Disco.Web.Areas.API.Controllers
         #endregion
 
         [DiscoAuthorize(Claims.DiscoAdminAccount)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult MigrateDeviceMacAddressesFromLog()
         {
             var taskStatus = Disco.Services.Devices.Enrolment.LogMacAddressImportingTask.ScheduleImmediately();

Disco.Web/Areas/API/Controllers/DeviceFlagAssignmentController.cs

@@ -40,14 +40,14 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     return Redirect($"{Url.Action(MVC.Device.Show(assignment.DeviceSerialNumber))}#DeviceDetailTab-Flags");
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 

Disco.Web/Areas/API/Controllers/DeviceFlagController.cs

@@ -24,6 +24,7 @@ namespace Disco.Web.Areas.API.Controllers
         const string pOnUnassignmentExpression = "onunassignmentexpression";
 
         [DiscoAuthorize(Claims.Config.DeviceFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(int id, string key, string value = null, bool? redirect = null)
         {
             Authorization.Require(Claims.Config.DeviceFlag.Configure);
@@ -68,43 +69,48 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     return RedirectToAction(MVC.Config.DeviceFlag.Index(flag.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         #region Update Shortcut Methods
         [DiscoAuthorize(Claims.Config.DeviceFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateName(int id, string FlagName = null, bool? redirect = null)
         {
             return Update(id, pName, FlagName, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDescription(int id, string Description = null, bool? redirect = null)
         {
             return Update(id, pDescription, Description, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateIcon(int id, string Icon = null, bool? redirect = null)
         {
             return Update(id, pIcon, Icon, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateIconColour(int id, string IconColour = null, bool? redirect = null)
         {
             return Update(id, pIconColour, IconColour, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateIconAndColour(int id, string Icon = null, string IconColour = null, bool redirect = false)
         {
             try
@@ -124,27 +130,30 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect)
                     return RedirectToAction(MVC.Config.DeviceFlag.Index(DeviceFlag.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         [DiscoAuthorize(Claims.Config.DeviceFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateOnAssignmentExpression(int id, string OnAssignmentExpression = null, bool redirect = false)
         {
             return Update(id, pOnAssignmentExpression, OnAssignmentExpression, redirect);
         }
         [DiscoAuthorize(Claims.Config.DeviceFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateOnUnassignmentExpression(int id, string OnUnassignmentExpression = null, bool redirect = false)
         {
             return Update(id, pOnUnassignmentExpression, OnUnassignmentExpression, redirect);
         }
         [DiscoAuthorize(Claims.Config.DeviceFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDevicesLinkedGroup(int id, string GroupId = null, DateTime? FilterBeginDate = null, bool redirect = false)
         {
             try
@@ -167,17 +176,18 @@ namespace Disco.Web.Areas.API.Controllers
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
                     }
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         [DiscoAuthorize(Claims.Config.DeviceFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateAssignedUserLinkedGroup(int id, string GroupId = null, DateTime? FilterBeginDate = null, bool redirect = false)
         {
             try
@@ -200,14 +210,14 @@ namespace Disco.Web.Areas.API.Controllers
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
                     }
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         #endregion
@@ -341,6 +351,7 @@ namespace Disco.Web.Areas.API.Controllers
 
         #region Actions
         [DiscoAuthorizeAll(Claims.Config.DeviceFlag.Configure, Claims.Config.DeviceFlag.Delete)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Delete(int id, bool? redirect = false)
         {
             try
@@ -354,7 +365,7 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect.HasValue && redirect.Value)
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(status.SessionId));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 throw new ArgumentException("Invalid Device Flag Id", nameof(id));
             }
@@ -363,11 +374,12 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         [DiscoAuthorizeAll(Claims.Config.DeviceFlag.Configure, Claims.Device.Actions.AddFlags, Claims.Device.Actions.RemoveFlags, Claims.Device.ShowFlagAssignments)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult BulkAssignDevices(int id, bool Override, string DeviceSerialNumbers = null, string Comments = null)
         {
             if (id < 0)

Disco.Web/Areas/API/Controllers/DeviceModelController.cs

@@ -7,6 +7,7 @@ using Disco.Services.Plugins.Features.WarrantyProvider;
 using Disco.Services.Web;
 using System;
 using System.Collections.Generic;
+using System.Data.Entity;
 using System.Linq;
 using System.Web;
 using System.Web.Mvc;
@@ -24,6 +25,7 @@ namespace Disco.Web.Areas.API.Controllers
         const string pDefaultRepairProvider = "defaultrepairprovider";
 
         [DiscoAuthorize(Claims.Config.DeviceModel.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(int id, string key, string value = null, bool redirect = false)
         {
             Authorization.Require(Claims.Config.DeviceModel.Configure);
@@ -63,19 +65,19 @@ namespace Disco.Web.Areas.API.Controllers
                 }
                 else
                 {
-                    return Json("Invalid Device Model Number", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Invalid Device Model Number");
                 }
                 if (redirect)
                     return RedirectToAction(MVC.Config.DeviceModel.Index(deviceModel.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
@@ -120,12 +122,12 @@ namespace Disco.Web.Areas.API.Controllers
         #endregion
 
         #region Update Properties
-        private void UpdateDescription(DeviceModel deviceModel, string Description)
+        private void UpdateDescription(DeviceModel deviceModel, string description)
         {
-            if (string.IsNullOrWhiteSpace(Description))
+            if (string.IsNullOrWhiteSpace(description))
                 deviceModel.Description = null;
             else
-                deviceModel.Description = Description;
+                deviceModel.Description = description;
             Database.SaveChanges();
         }
         private void UpdateManufacturer(DeviceModel deviceModel, string manufacturer)
@@ -150,15 +152,15 @@ namespace Disco.Web.Areas.API.Controllers
                 deviceModel.Model = model;
             Database.SaveChanges();
         }
-        private void UpdateDefaultPurchaseDate(DeviceModel deviceModel, string DefaultPurchaseDate)
+        private void UpdateDefaultPurchaseDate(DeviceModel deviceModel, string defaultPurchaseDate)
         {
-            if (string.IsNullOrEmpty(DefaultPurchaseDate))
+            if (string.IsNullOrEmpty(defaultPurchaseDate))
             {
                 deviceModel.DefaultPurchaseDate = null;
             }
             else
             {
-                if (DateTime.TryParse(DefaultPurchaseDate, out var d))
+                if (DateTime.TryParse(defaultPurchaseDate, out var d))
                 {
                     deviceModel.DefaultPurchaseDate = d;
                 }
@@ -169,30 +171,30 @@ namespace Disco.Web.Areas.API.Controllers
             }
             Database.SaveChanges();
         }
-        private void UpdateDefaultWarrantyProvider(DeviceModel deviceModel, string DefaultWarrantyProvider)
+        private void UpdateDefaultWarrantyProvider(DeviceModel deviceModel, string defaultWarrantyProvider)
         {
-            if (string.IsNullOrEmpty(DefaultWarrantyProvider))
+            if (string.IsNullOrEmpty(defaultWarrantyProvider))
             {
                 deviceModel.DefaultWarrantyProvider = null;
             }
             else
             {
                 // Validate
-                var WarrantyProvider = Plugins.GetPluginFeature(DefaultWarrantyProvider, typeof(WarrantyProviderFeature));
+                var WarrantyProvider = Plugins.GetPluginFeature(defaultWarrantyProvider, typeof(WarrantyProviderFeature));
                 deviceModel.DefaultWarrantyProvider = WarrantyProvider.Id;
             }
             Database.SaveChanges();
         }
-        private void UpdateDefaultRepairProvider(DeviceModel deviceModel, string DefaultRepairProvider)
+        private void UpdateDefaultRepairProvider(DeviceModel deviceModel, string defaultRepairProvider)
         {
-            if (string.IsNullOrEmpty(DefaultRepairProvider))
+            if (string.IsNullOrEmpty(defaultRepairProvider))
             {
                 deviceModel.DefaultRepairProvider = null;
             }
             else
             {
                 // Validate
-                var RepairProvider = Plugins.GetPluginFeature(DefaultRepairProvider, typeof(RepairProviderFeature));
+                var RepairProvider = Plugins.GetPluginFeature(defaultRepairProvider, typeof(RepairProviderFeature));
                 deviceModel.DefaultRepairProvider = RepairProvider.Id;
             }
             Database.SaveChanges();
@@ -213,12 +215,7 @@ namespace Disco.Web.Areas.API.Controllers
                     var deviceModelImage = m.Image();
                     if (deviceModelImage != null)
                         return File(deviceModelImage, "image/png");
-                    //if ( m.Image != null)
-                    //{
-                    //    return File(m.Image, "image/png");
-                    //}
-                    //else
-                    //{
+
                     // DataStore Failed - Use Generic Images
                     if (m.ModelType != null)
                     {
@@ -228,13 +225,13 @@ namespace Disco.Web.Areas.API.Controllers
                             return File(modelTypePath, "image/png");
                         }
                     }
-                    //}
                 }
             }
             return File(Links.ClientSource.Style.Images.DeviceTypes.Unknown_png, "image/png");
         }
 
-        [DiscoAuthorize(Claims.Config.DeviceModel.Configure), HttpPost]
+        [DiscoAuthorize(Claims.Config.DeviceModel.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Image(int id, bool redirect, HttpPostedFileBase Image)
         {
             if (Image != null && Image.ContentLength > 0)
@@ -248,31 +245,32 @@ namespace Disco.Web.Areas.API.Controllers
                         if (redirect)
                             return RedirectToAction(MVC.Config.DeviceModel.Index(dm.Id));
                         else
-                            return Json("OK", JsonRequestBehavior.AllowGet);
+                            return Ok();
                     }
                     else
                     {
                         if (redirect)
                             return RedirectToAction(MVC.Config.DeviceModel.Index(dm.Id));
                         else
-                            return Json("Invalid Image Format", JsonRequestBehavior.AllowGet);
+                            return BadRequest("Invalid Image Format");
                     }
                 }
                 if (redirect)
                     return RedirectToAction(MVC.Config.DeviceModel.Index());
                 else
-                    return Json("Invalid Device Model Number", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Invalid Device Model Number");
             }
             if (redirect)
                 return RedirectToAction(MVC.Config.DeviceModel.Index());
             else
-                return Json("No Image Supplied", JsonRequestBehavior.AllowGet);
+                return BadRequest("No Image Supplied");
         }
         #endregion
 
         #region Actions
 
         [DiscoAuthorize(Claims.Config.DeviceModel.Delete)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Delete(int id, bool? redirect = false)
         {
             try
@@ -285,7 +283,7 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect.HasValue && redirect.Value)
                         return RedirectToAction(MVC.Config.DeviceModel.Index(null));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 throw new Exception("Invalid Device Model Number");
             }
@@ -294,7 +292,7 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
@@ -303,39 +301,38 @@ namespace Disco.Web.Areas.API.Controllers
         #region Device Model Components
 
         [DiscoAuthorize(Claims.Config.DeviceModel.Show)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Component(int id)
         {
-            var dc = Database.DeviceComponents.Include("JobSubTypes").Where(i => i.Id == id).FirstOrDefault();
-            if (dc != null)
-            {
-                return Json(new Models.DeviceModel.ComponentModel { Result = "OK", Component = Models.DeviceModel._ComponentModel.FromDeviceComponent(dc) }, JsonRequestBehavior.AllowGet);
-            }
-            return Json(new Models.DeviceModel.ComponentModel { Result = "Invalid Device Component Id" }, JsonRequestBehavior.AllowGet);
+            var dc = Database.DeviceComponents.Include(c => c.JobSubTypes).Where(i => i.Id == id).FirstOrDefault();
+            if (dc == null)
+                return BadRequest("Invalid Device Component Id");
+
+            return Json(Models.DeviceModel.ComponentModel.FromDeviceComponent(dc));
         }
 
         [DiscoAuthorize(Claims.Config.DeviceModel.ConfigureComponents)]
-        public virtual ActionResult ComponentAdd(int? id, string Description, string Cost)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult ComponentAdd(int? id, string description, string cost)
         {
             DeviceModel dm = null;
             if (id.HasValue)
             {
                 dm = Database.DeviceModels.Find(id.Value);
                 if (dm == null)
-                {
-                    return Json(new Models.DeviceModel.ComponentModel { Result = "Invalid Device Model Id" }, JsonRequestBehavior.AllowGet);
-                }
+                    return BadRequest("Invalid Device Model Id");
             }
 
-            if (string.IsNullOrEmpty(Description))
-                Description = "?";
-            if (!string.IsNullOrEmpty(Cost) && Cost.Contains("$"))
-                Cost = Cost.Substring(Cost.IndexOf("$") + 1);
-            decimal.TryParse(Cost, out var cost);
+            if (string.IsNullOrEmpty(description))
+                description = "?";
+            if (!string.IsNullOrEmpty(cost) && cost.Contains("$"))
+                cost = cost.Substring(cost.IndexOf("$") + 1);
+            decimal.TryParse(cost, out var costValue);
 
             var dc = new DeviceComponent()
             {
-                Description = Description,
-                Cost = cost
+                Description = description,
+                Cost = costValue
             };
             if (dm != null)
             {
@@ -346,77 +343,77 @@ namespace Disco.Web.Areas.API.Controllers
             Database.DeviceComponents.Add(dc);
             Database.SaveChanges();
 
-            return Json(new Models.DeviceModel.ComponentModel { Result = "OK", Component = Models.DeviceModel._ComponentModel.FromDeviceComponent(dc) }, JsonRequestBehavior.AllowGet);
+            return Json(Models.DeviceModel.ComponentModel.FromDeviceComponent(dc));
         }
 
         [DiscoAuthorize(Claims.Config.DeviceModel.ConfigureComponents)]
-        public virtual ActionResult ComponentUpdateJobSubTypes(int id, List<string> JobSubTypes)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult ComponentUpdateJobSubTypes(int id, List<string> jobSubTypes)
         {
-            var dc = Database.DeviceComponents.Include("JobSubTypes").Where(i => i.Id == id).FirstOrDefault();
-            if (dc != null)
-            {
-                dc.JobSubTypes.Clear();
+            var dc = Database.DeviceComponents.Include(c => c.JobSubTypes).Where(i => i.Id == id).FirstOrDefault();
+            if (dc == null)
+                return BadRequest("Invalid Device Component Id");
 
-                if (JobSubTypes != null)
+            dc.JobSubTypes.Clear();
+
+            if (jobSubTypes != null)
+            {
+                var jsts = Database.JobSubTypes.Where(jst => jobSubTypes.Contains(jst.JobTypeId + "_" + jst.Id));
+                foreach (var jst in jsts)
                 {
-                    var jsts = Database.JobSubTypes.Where(jst => JobSubTypes.Contains(jst.JobTypeId + "_" + jst.Id));
-                    foreach (var jst in jsts)
-                    {
-                        dc.JobSubTypes.Add(jst);
-                    }
+                    dc.JobSubTypes.Add(jst);
                 }
-
-                Database.SaveChanges();
-
-                return Json(new Models.DeviceModel.ComponentModel { Result = "OK", Component = Models.DeviceModel._ComponentModel.FromDeviceComponent(dc) }, JsonRequestBehavior.AllowGet);
             }
-            return Json(new Models.DeviceModel.ComponentModel { Result = "Invalid Device Component Id" }, JsonRequestBehavior.AllowGet);
+
+            Database.SaveChanges();
+
+            return Json(Models.DeviceModel.ComponentModel.FromDeviceComponent(dc));
         }
 
         [DiscoAuthorize(Claims.Config.DeviceModel.ConfigureComponents)]
-        public virtual ActionResult ComponentUpdate(int id, string Description, string Cost)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult ComponentUpdate(int id, string description, string cost)
         {
-            var dc = Database.DeviceComponents.Include("JobSubTypes").Where(i => i.Id == id).FirstOrDefault();
-            if (dc != null)
-            {
+            var dc = Database.DeviceComponents.Include(c => c.JobSubTypes).Where(i => i.Id == id).FirstOrDefault();
+            if (dc == null)
+                return BadRequest("Invalid Device Component Id");
 
-                if (string.IsNullOrEmpty(Description))
-                    Description = "?";
-                if (!string.IsNullOrEmpty(Cost) && Cost.Contains("$"))
-                    Cost = Cost.Substring(Cost.IndexOf("$") + 1);
-                decimal.TryParse(Cost, out var cost);
+            if (string.IsNullOrEmpty(description))
+                description = "?";
+            if (!string.IsNullOrEmpty(cost) && cost.Contains("$"))
+                cost = cost.Substring(cost.IndexOf("$") + 1);
+            decimal.TryParse(cost, out var costValue);
 
-                dc.Description = Description;
-                dc.Cost = cost;
+            dc.Description = description;
+            dc.Cost = costValue;
 
-                Database.SaveChanges();
+            Database.SaveChanges();
 
-                return Json(new Models.DeviceModel.ComponentModel { Result = "OK", Component = Models.DeviceModel._ComponentModel.FromDeviceComponent(dc) }, JsonRequestBehavior.AllowGet);
-            }
-            return Json(new Models.DeviceModel.ComponentModel { Result = "Invalid Device Component Id" }, JsonRequestBehavior.AllowGet);
+            return Json(Models.DeviceModel.ComponentModel.FromDeviceComponent(dc));
         }
 
         [DiscoAuthorize(Claims.Config.DeviceModel.ConfigureComponents)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult ComponentRemove(int id)
         {
-            var dc = Database.DeviceComponents.Include("JobSubTypes").Where(c => c.Id == id).FirstOrDefault();
-            if (dc != null)
-            {
-                dc.JobSubTypes.Clear();
-                Database.DeviceComponents.Remove(dc);
-                Database.SaveChanges();
-                return Json("OK", JsonRequestBehavior.AllowGet);
-            }
-            return Json("Invalid Device Component Id", JsonRequestBehavior.AllowGet);
+            var dc = Database.DeviceComponents.Include(c => c.JobSubTypes).Where(c => c.Id == id).FirstOrDefault();
+            if (dc == null)
+                return BadRequest("Invalid Device Component Id");
+
+            dc.JobSubTypes.Clear();
+            Database.DeviceComponents.Remove(dc);
+            Database.SaveChanges();
+            return Ok();
         }
         #endregion
 
         #region Index
-        [DiscoAuthorize(Claims.Config.DeviceModel.Show)]
+        [DiscoAuthorizeAny(Claims.Config.DeviceModel.Show, Claims.Config.Enrolment.ShowStatus)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Index()
         {
-            var deviceModels = Database.DeviceModels.ToArray().Select(dm => Models.DeviceModel._DeviceModel.FromDeviceModel(dm)).ToArray();
-            return Json(deviceModels, JsonRequestBehavior.AllowGet);
+            var deviceModels = Database.DeviceModels.AsEnumerable().Select(dm => Models.DeviceModel._DeviceModel.FromDeviceModel(dm)).ToList();
+            return Json(deviceModels);
         }
         #endregion
 

Disco.Web/Areas/API/Controllers/DeviceProfileController.cs

@@ -40,6 +40,7 @@ namespace Disco.Web.Areas.API.Controllers
         const string pAssignedUsersLinkedGroup = "assigneduserslinkedgroup";
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(int id, string key, string value = null, bool? redirect = null)
         {
             Authorization.Require(Claims.Config.DeviceProfile.Configure);
@@ -114,62 +115,70 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     return RedirectToAction(MVC.Config.DeviceProfile.Index(deviceProfile.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         #region Update Shortcut Methods
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDescription(int id, string Description = null, bool? redirect = null)
         {
             return Update(id, pDescription, Description, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateName(int id, string ProfileName = null, bool? redirect = null)
         {
             return Update(id, pName, ProfileName, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateShortName(int id, string ShortName = null, bool? redirect = null)
         {
             return Update(id, pShortName, ShortName, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDistributionType(int id, string DistributionType = null, bool? redirect = null)
         {
             return Update(id, pDistributionType, DistributionType, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
-        public virtual ActionResult UpdateCertificateProviders(int id, string CertificateProviders = null, bool? redirect = null)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult UpdateCertificateProviders(int id, string certificateProviders = null, bool? redirect = null)
         {
-            return Update(id, pCertificateProviders, CertificateProviders, redirect);
+            return Update(id, pCertificateProviders, certificateProviders, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
-        public virtual ActionResult UpdateCertificateAuthorityProviders(int id, string CertificateAuthorityProviders = null, bool? redirect = null)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult UpdateCertificateAuthorityProviders(int id, string certificateAuthorityProviders = null, bool? redirect = null)
         {
-            return Update(id, pCertificateAuthorityProviders, CertificateAuthorityProviders, redirect);
+            return Update(id, pCertificateAuthorityProviders, certificateAuthorityProviders, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
-        public virtual ActionResult UpdateWirelessProfileProviders(int id, string WirelessProfileProviders = null, bool? redirect = null)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult UpdateWirelessProfileProviders(int id, string wirelessProfileProviders = null, bool? redirect = null)
         {
-            return Update(id, pWirelessProfileProviders, WirelessProfileProviders, redirect);
+            return Update(id, pWirelessProfileProviders, wirelessProfileProviders, redirect);
         }
 
-        [DiscoAuthorize(Claims.Config.DeviceProfile.Configure), HttpPost, ValidateAntiForgeryToken]
+        [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateOrganisationalUnit(int id, string OrganisationalUnit = null, bool enforce = false, bool? redirect = null)
         {
             var updateResult = Update(id, pOrganisationalUnit, OrganisationalUnit, redirect);
@@ -187,13 +196,14 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDefaultOrganisationAddress(int id, string DefaultOrganisationAddress = null, bool? redirect = null)
         {
             return Update(id, pDefaultOrganisationAddress, DefaultOrganisationAddress, redirect);
         }
 
         [DiscoAuthorizeAll(Claims.Config.DeviceProfile.Configure, Claims.Config.DeviceProfile.ConfigureComputerNameTemplate)]
-        [ValidateAntiForgeryToken]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateComputerNameTemplate(int id, string ComputerNameTemplate = null, bool? redirect = null)
         {
             var deviceProfile = Database.DeviceProfiles.Find(id);
@@ -219,11 +229,11 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect.GetValueOrDefault(false))
                 return RedirectToAction(MVC.Config.DeviceProfile.Index(deviceProfile.Id));
             else
-                return Json("OK");
+                return Ok();
         }
 
         [DiscoAuthorizeAll(Claims.Config.DeviceProfile.Configure, Claims.Config.DeviceProfile.ConfigureComputerNameTemplate)]
-        [ValidateAntiForgeryToken]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult TestComputerNameTemplate(int id, string ComputerNameTemplate = null, string UserSpecifiedDeviceSerialNumber = null)
         {
             Database.Configuration.LazyLoadingEnabled = true;
@@ -317,36 +327,42 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateEnforceComputerNameConvention(int id, string EnforceComputerNameConvention = null, bool? redirect = null)
         {
             return Update(id, pEnforceComputerNameConvention, EnforceComputerNameConvention, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateEnforceOrganisationalUnit(int id, string EnforceOrganisationalUnit = null, bool? redirect = null)
         {
             return Update(id, pEnforceOrganisationalUnit, EnforceOrganisationalUnit, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateProvisionADAccount(int id, string ProvisionADAccount = null, bool? redirect = null)
         {
             return Update(id, pProvisionADAccount, ProvisionADAccount, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateAssignedUserLocalAdmin(int id, string AssignedUserLocalAdmin = null, bool? redirect = null)
         {
             return Update(id, pAssignedUserLocalAdmin, AssignedUserLocalAdmin, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateAllowUntrustedReimageJobEnrolment(int id, string AllowUntrustedReimageJobEnrolment = null, bool? redirect = null)
         {
             return Update(id, pAllowUntrustedReimageJobEnrolment, AllowUntrustedReimageJobEnrolment, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDevicesLinkedGroup(int id, string GroupId = null, bool redirect = false)
         {
             try
@@ -368,17 +384,18 @@ namespace Disco.Web.Areas.API.Controllers
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
                     }
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateAssignedUsersLinkedGroup(int id, string GroupId = null, bool redirect = false)
         {
             try
@@ -400,49 +417,49 @@ namespace Disco.Web.Areas.API.Controllers
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
                     }
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         #endregion
 
         #region Update Properties
-        private void UpdateDescription(DeviceProfile deviceProfile, string Description)
+        private void UpdateDescription(DeviceProfile deviceProfile, string description)
         {
-            if (string.IsNullOrWhiteSpace(Description))
+            if (string.IsNullOrWhiteSpace(description))
                 deviceProfile.Description = null;
             else
-                deviceProfile.Description = Description;
+                deviceProfile.Description = description;
             Database.SaveChanges();
         }
 
-        private void UpdateName(DeviceProfile deviceProfile, string Name)
+        private void UpdateName(DeviceProfile deviceProfile, string name)
         {
-            if (string.IsNullOrWhiteSpace(Name))
+            if (string.IsNullOrWhiteSpace(name))
                 throw new Exception("Profile name cannot be empty");
             else
-                deviceProfile.Name = Name;
+                deviceProfile.Name = name;
             Database.SaveChanges();
         }
 
-        private void UpdateShortName(DeviceProfile deviceProfile, string ShortName)
+        private void UpdateShortName(DeviceProfile deviceProfile, string shortName)
         {
-            if (string.IsNullOrWhiteSpace(ShortName))
+            if (string.IsNullOrWhiteSpace(shortName))
                 throw new Exception("Profile short name cannot be empty");
             else
-                deviceProfile.ShortName = ShortName;
+                deviceProfile.ShortName = shortName;
             Database.SaveChanges();
         }
 
-        private void UpdateDistributionType(DeviceProfile deviceProfile, string DistributionType)
+        private void UpdateDistributionType(DeviceProfile deviceProfile, string distributionType)
         {
-            if (int.TryParse(DistributionType, out var iDt))
+            if (int.TryParse(distributionType, out var iDt))
             {
                 deviceProfile.DistributionType = (DeviceProfile.DistributionTypes)iDt;
                 Database.SaveChanges();
@@ -451,9 +468,9 @@ namespace Disco.Web.Areas.API.Controllers
             throw new Exception("Invalid Distribution Type Number");
         }
 
-        private void UpdateCertificateProviders(DeviceProfile deviceProfile, string CertificateProviderIds)
+        private void UpdateCertificateProviders(DeviceProfile deviceProfile, string certificateProviderIds)
         {
-            if (string.IsNullOrWhiteSpace(CertificateProviderIds))
+            if (string.IsNullOrWhiteSpace(certificateProviderIds))
             {
                 deviceProfile.CertificateProviders = null;
             }
@@ -461,7 +478,7 @@ namespace Disco.Web.Areas.API.Controllers
             {
                 // Validate
                 var validatedProviders = new List<PluginFeatureManifest>();
-                foreach (var certificateProviderId in CertificateProviderIds.Split(new char[] { ',' }, StringSplitOptions.RemoveEmptyEntries))
+                foreach (var certificateProviderId in certificateProviderIds.Split(new char[] { ',' }, StringSplitOptions.RemoveEmptyEntries))
                 {
                     var featureManifest = Plugins.GetPluginFeature(certificateProviderId, typeof(CertificateProviderFeature));
                     if (featureManifest == null)
@@ -487,9 +504,9 @@ namespace Disco.Web.Areas.API.Controllers
             Database.SaveChanges();
         }
 
-        private void UpdateCertificateAuthorityProviders(DeviceProfile deviceProfile, string CertificateAuthorityProviderIds)
+        private void UpdateCertificateAuthorityProviders(DeviceProfile deviceProfile, string certificateAuthorityProviderIds)
         {
-            if (string.IsNullOrWhiteSpace(CertificateAuthorityProviderIds))
+            if (string.IsNullOrWhiteSpace(certificateAuthorityProviderIds))
             {
                 deviceProfile.CertificateAuthorityProviders = null;
             }
@@ -497,7 +514,7 @@ namespace Disco.Web.Areas.API.Controllers
             {
                 // Validate
                 var validatedProviders = new List<PluginFeatureManifest>();
-                foreach (var certificateAuthorityProviderId in CertificateAuthorityProviderIds.Split(new char[] { ',' }, StringSplitOptions.RemoveEmptyEntries))
+                foreach (var certificateAuthorityProviderId in certificateAuthorityProviderIds.Split(new char[] { ',' }, StringSplitOptions.RemoveEmptyEntries))
                 {
                     var featureManifest = Plugins.GetPluginFeature(certificateAuthorityProviderId, typeof(CertificateAuthorityProviderFeature));
                     if (featureManifest == null)
@@ -523,9 +540,9 @@ namespace Disco.Web.Areas.API.Controllers
             Database.SaveChanges();
         }
 
-        private void UpdateWirelessProfileProviders(DeviceProfile deviceProfile, string WirelessProfileProviderIds)
+        private void UpdateWirelessProfileProviders(DeviceProfile deviceProfile, string wirelessProfileProviderIds)
         {
-            if (string.IsNullOrWhiteSpace(WirelessProfileProviderIds))
+            if (string.IsNullOrWhiteSpace(wirelessProfileProviderIds))
             {
                 deviceProfile.WirelessProfileProviders = null;
             }
@@ -533,7 +550,7 @@ namespace Disco.Web.Areas.API.Controllers
             {
                 // Validate
                 var validatedProviders = new List<PluginFeatureManifest>();
-                foreach (var wirelessProfileProviderId in WirelessProfileProviderIds.Split(new char[] { ',' }, StringSplitOptions.RemoveEmptyEntries))
+                foreach (var wirelessProfileProviderId in wirelessProfileProviderIds.Split(new char[] { ',' }, StringSplitOptions.RemoveEmptyEntries))
                 {
                     var featureManifest = Plugins.GetPluginFeature(wirelessProfileProviderId, typeof(WirelessProfileProviderFeature));
                     if (featureManifest == null)
@@ -559,28 +576,28 @@ namespace Disco.Web.Areas.API.Controllers
             Database.SaveChanges();
         }
 
-        private void UpdateOrganisationalUnit(DeviceProfile deviceProfile, string OrganisationalUnit)
+        private void UpdateOrganisationalUnit(DeviceProfile deviceProfile, string organisationalUnit)
         {
-            if (string.IsNullOrWhiteSpace(OrganisationalUnit))
-                OrganisationalUnit = ActiveDirectory.Context.PrimaryDomain.DefaultComputerContainer;
+            if (string.IsNullOrWhiteSpace(organisationalUnit))
+                organisationalUnit = ActiveDirectory.Context.PrimaryDomain.DefaultComputerContainer;
 
-            if (OrganisationalUnit != deviceProfile.OrganisationalUnit)
+            if (organisationalUnit != deviceProfile.OrganisationalUnit)
             {
-                deviceProfile.OrganisationalUnit = OrganisationalUnit;
+                deviceProfile.OrganisationalUnit = organisationalUnit;
                 Database.SaveChanges();
             }
         }
 
-        private void UpdateDefaultOrganisationAddress(DeviceProfile deviceProfile, string DefaultOrganisationAddress)
+        private void UpdateDefaultOrganisationAddress(DeviceProfile deviceProfile, string defaultOrganisationAddress)
         {
-            if (string.IsNullOrEmpty(DefaultOrganisationAddress))
+            if (string.IsNullOrEmpty(defaultOrganisationAddress))
             {
                 deviceProfile.DefaultOrganisationAddress = null;
             }
             else
             {
                 // Validate
-                if (int.TryParse(DefaultOrganisationAddress, out var daoId))
+                if (int.TryParse(defaultOrganisationAddress, out var daoId))
                 {
                     var oa = Database.DiscoConfiguration.OrganisationAddresses.GetAddress(daoId);
                     if (oa != null)
@@ -602,9 +619,9 @@ namespace Disco.Web.Areas.API.Controllers
             Database.SaveChanges();
         }
 
-        private void UpdateEnforceComputerNameConvention(DeviceProfile deviceProfile, string EnforceComputerNameConvention)
+        private void UpdateEnforceComputerNameConvention(DeviceProfile deviceProfile, string enforceComputerNameConvention)
         {
-            if (bool.TryParse(EnforceComputerNameConvention, out var bValue))
+            if (bool.TryParse(enforceComputerNameConvention, out var bValue))
             {
                 deviceProfile.EnforceComputerNameConvention = bValue;
 
@@ -614,9 +631,9 @@ namespace Disco.Web.Areas.API.Controllers
             throw new Exception("Invalid Boolean Value");
         }
 
-        private void UpdateEnforceOrganisationalUnit(DeviceProfile deviceProfile, string EnforceOrganisationalUnit)
+        private void UpdateEnforceOrganisationalUnit(DeviceProfile deviceProfile, string enforceOrganisationalUnit)
         {
-            if (bool.TryParse(EnforceOrganisationalUnit, out var bValue))
+            if (bool.TryParse(enforceOrganisationalUnit, out var bValue))
             {
                 deviceProfile.EnforceOrganisationalUnit = bValue;
 
@@ -626,9 +643,9 @@ namespace Disco.Web.Areas.API.Controllers
             throw new Exception("Invalid Boolean Value");
         }
 
-        private void UpdateProvisionADAccount(DeviceProfile deviceProfile, string ProvisionADAccount)
+        private void UpdateProvisionADAccount(DeviceProfile deviceProfile, string provisionADAccount)
         {
-            if (bool.TryParse(ProvisionADAccount, out var bValue))
+            if (bool.TryParse(provisionADAccount, out var bValue))
             {
                 deviceProfile.ProvisionADAccount = bValue;
 
@@ -638,9 +655,9 @@ namespace Disco.Web.Areas.API.Controllers
             throw new Exception("Invalid Boolean Value");
         }
 
-        private void UpdateAssignedUserLocalAdmin(DeviceProfile deviceProfile, string AssignedUserLocalAdmin)
+        private void UpdateAssignedUserLocalAdmin(DeviceProfile deviceProfile, string assignedUserLocalAdmin)
         {
-            if (bool.TryParse(AssignedUserLocalAdmin, out var bValue))
+            if (bool.TryParse(assignedUserLocalAdmin, out var bValue))
             {
                 deviceProfile.AssignedUserLocalAdmin = bValue;
 
@@ -650,9 +667,9 @@ namespace Disco.Web.Areas.API.Controllers
             throw new Exception("Invalid Boolean Value");
         }
 
-        private void UpdateAllowUntrustedReimageJobEnrolment(DeviceProfile deviceProfile, string AllowUntrustedReimageJobEnrolment)
+        private void UpdateAllowUntrustedReimageJobEnrolment(DeviceProfile deviceProfile, string allowUntrustedReimageJobEnrolment)
         {
-            if (bool.TryParse(AllowUntrustedReimageJobEnrolment, out var bValue))
+            if (bool.TryParse(allowUntrustedReimageJobEnrolment, out var bValue))
             {
                 deviceProfile.AllowUntrustedReimageJobEnrolment = bValue;
 
@@ -662,16 +679,16 @@ namespace Disco.Web.Areas.API.Controllers
             throw new Exception("Invalid Boolean Value");
         }
 
-        private ScheduledTaskStatus UpdateDevicesLinkedGroup(DeviceProfile DeviceProfile, string DevicesLinkedGroup)
+        private ScheduledTaskStatus UpdateDevicesLinkedGroup(DeviceProfile deviceProfile, string devicesLinkedGroup)
         {
-            var configJson = ADManagedGroup.ValidConfigurationToJson(DeviceProfileDevicesManagedGroup.GetKey(DeviceProfile), DevicesLinkedGroup, null);
+            var configJson = ADManagedGroup.ValidConfigurationToJson(DeviceProfileDevicesManagedGroup.GetKey(deviceProfile), devicesLinkedGroup, null);
 
-            if (DeviceProfile.DevicesLinkedGroup != configJson)
+            if (deviceProfile.DevicesLinkedGroup != configJson)
             {
-                DeviceProfile.DevicesLinkedGroup = configJson;
+                deviceProfile.DevicesLinkedGroup = configJson;
                 Database.SaveChanges();
 
-                var managedGroup = DeviceProfileDevicesManagedGroup.Initialize(DeviceProfile);
+                var managedGroup = DeviceProfileDevicesManagedGroup.Initialize(deviceProfile);
                 if (managedGroup != null) // Sync Group
                     return ADManagedGroupsSyncTask.ScheduleSync(managedGroup);
             }
@@ -679,16 +696,16 @@ namespace Disco.Web.Areas.API.Controllers
             return null;
         }
 
-        private ScheduledTaskStatus UpdateAssignedUsersLinkedGroup(DeviceProfile DeviceProfile, string AssignedUsersLinkedGroup)
+        private ScheduledTaskStatus UpdateAssignedUsersLinkedGroup(DeviceProfile deviceProfile, string assignedUsersLinkedGroup)
         {
-            var configJson = ADManagedGroup.ValidConfigurationToJson(DeviceProfileAssignedUsersManagedGroup.GetKey(DeviceProfile), AssignedUsersLinkedGroup, null);
+            var configJson = ADManagedGroup.ValidConfigurationToJson(DeviceProfileAssignedUsersManagedGroup.GetKey(deviceProfile), assignedUsersLinkedGroup, null);
 
-            if (DeviceProfile.AssignedUsersLinkedGroup != configJson)
+            if (deviceProfile.AssignedUsersLinkedGroup != configJson)
             {
-                DeviceProfile.AssignedUsersLinkedGroup = configJson;
+                deviceProfile.AssignedUsersLinkedGroup = configJson;
                 Database.SaveChanges();
 
-                var managedGroup = DeviceProfileAssignedUsersManagedGroup.Initialize(DeviceProfile);
+                var managedGroup = DeviceProfileAssignedUsersManagedGroup.Initialize(deviceProfile);
                 if (managedGroup != null) // Sync Group
                     return ADManagedGroupsSyncTask.ScheduleSync(managedGroup);
             }
@@ -700,6 +717,7 @@ namespace Disco.Web.Areas.API.Controllers
         #region Actions
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.Delete)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Delete(int id, bool? redirect = false)
         {
             try
@@ -712,7 +730,7 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect.HasValue && redirect.Value)
                         return RedirectToAction(MVC.Config.DeviceProfile.Index(null));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 throw new Exception("Invalid Device Profile Number");
             }
@@ -721,7 +739,7 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
@@ -730,6 +748,7 @@ namespace Disco.Web.Areas.API.Controllers
         #region Defaults
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.ConfigureDefaults)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Default(int id, bool? redirect = null)
         {
             try
@@ -742,7 +761,7 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect.HasValue && redirect.Value)
                         return RedirectToAction(MVC.Config.DeviceProfile.Index(id));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 throw new Exception("Invalid Device Profile Number");
             }
@@ -751,11 +770,12 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         [DiscoAuthorize(Claims.Config.DeviceProfile.ConfigureDefaults)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult DefaultAddDeviceOffline(int id, bool? redirect = false)
         {
             try
@@ -778,14 +798,14 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     return RedirectToAction(MVC.Config.DeviceProfile.Index(id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 

Disco.Web/Areas/API/Controllers/DocumentTemplateController.cs

@@ -21,7 +21,7 @@ using System.ComponentModel.DataAnnotations;
 using System.Data.Entity;
 using System.IO;
 using System.Linq;
-using System.Net;
+using System.Text.RegularExpressions;
 using System.Web;
 using System.Web.Mvc;
 using System.Web.UI.WebControls;
@@ -40,6 +40,7 @@ namespace Disco.Web.Areas.API.Controllers
         const string pIsHidden = "ishidden";
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(string id, string key, string value = null, bool redirect = false)
         {
             try
@@ -97,18 +98,19 @@ namespace Disco.Web.Areas.API.Controllers
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(resultTask.SessionId));
                     }
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
-        [DiscoAuthorize(Claims.Config.DocumentTemplate.Upload), HttpGet]
+        [DiscoAuthorize(Claims.Config.DocumentTemplate.Upload)]
+        [HttpGet]
         public virtual ActionResult Template(string id)
         {
             if (string.IsNullOrEmpty(id))
@@ -128,7 +130,8 @@ namespace Disco.Web.Areas.API.Controllers
             }
         }
 
-        [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.Upload, Claims.Config.DocumentTemplate.Configure), HttpPost]
+        [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.Upload, Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Template(string id, bool redirect, HttpPostedFileBase Template)
         {
             try
@@ -144,18 +147,19 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect)
                     return RedirectToAction(MVC.Config.DocumentTemplate.Index(documentTemplate.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
-        [DiscoAuthorize(Claims.Config.DocumentTemplate.Show), HttpGet]
+        [DiscoAuthorize(Claims.Config.DocumentTemplate.Show)]
+        [HttpGet]
         public virtual ActionResult TemplatePreview(string id)
         {
             if (string.IsNullOrEmpty(id))
@@ -180,41 +184,49 @@ namespace Disco.Web.Areas.API.Controllers
 
         #region Update Shortcut Methods
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDescription(string id, string Description = null, bool redirect = false)
         {
             return Update(id, pDescription, Description, redirect);
         }
         [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.Configure, Claims.Config.DocumentTemplate.ConfigureFilterExpression)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateFilterExpression(string id, string FilterExpression = null, bool redirect = false)
         {
             return Update(id, pFilterExpression, FilterExpression, redirect);
         }
         [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.Configure, Claims.Config.DocumentTemplate.ConfigureFilterExpression)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateOnGenerateExpression(string id, string OnGenerateExpression = null, bool redirect = false)
         {
             return Update(id, pOnGenerateExpression, OnGenerateExpression, redirect);
         }
         [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.Configure, Claims.Config.DocumentTemplate.ConfigureFilterExpression)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateOnImportAttachmentExpression(string id, string OnImportAttachmentExpression = null, bool redirect = false)
         {
             return Update(id, pOnImportAttachmentExpression, OnImportAttachmentExpression, redirect);
         }
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateFlattenForm(string id, string FlattenForm = null, bool redirect = false)
         {
             return Update(id, pFlattenForm, FlattenForm, redirect);
         }
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateIsHidden(string id, string IsHidden = null, bool redirect = false)
         {
             return Update(id, pIsHidden, IsHidden, redirect);
         }
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateScope(string id, string Scope = null, bool redirect = false)
         {
             return Update(id, pScope, Scope, redirect);
         }
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateJobSubTypes(string id, List<string> JobSubTypes = null, bool redirect = false)
         {
             try
@@ -228,19 +240,20 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect)
                     return RedirectToAction(MVC.Config.DocumentTemplate.Index(documentTemplate.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
 
         }
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDevicesLinkedGroup(string id, string GroupId = null, DateTime? FilterBeginDate = null, bool redirect = false)
         {
             try
@@ -262,18 +275,19 @@ namespace Disco.Web.Areas.API.Controllers
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
                     }
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateUsersLinkedGroup(string id, string GroupId = null, DateTime? FilterBeginDate = null, bool redirect = false)
         {
             try
@@ -295,14 +309,14 @@ namespace Disco.Web.Areas.API.Controllers
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
                     }
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         #endregion
@@ -493,7 +507,7 @@ namespace Disco.Web.Areas.API.Controllers
         #region Actions
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.UndetectedPages), OutputCache(NoStore = true, Duration = 0)]
-        public virtual ActionResult ImporterThumbnail(string SessionId, int PageNumber)
+        public virtual ActionResult ImporterThumbnail(Guid SessionId, int PageNumber)
         {
             var dataStoreSessionPagesCacheLocation = DataStore.CreateLocation(Database, "Cache\\DocumentDropBox_SessionPages");
             var filename = Path.Combine(dataStoreSessionPagesCacheLocation, $"{SessionId}-{PageNumber}");
@@ -504,6 +518,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.UndetectedPages)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult ImporterUndetectedFiles()
         {
             var undetectedLocation = DataStore.CreateLocation(Database, "DocumentDropBox_Unassigned");
@@ -577,47 +592,51 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.UndetectedPages)]
+        [HttpGet]
         public virtual ActionResult ImporterUndetectedFile(string id, bool? Source, bool? Thumbnail)
         {
-            if (!string.IsNullOrEmpty(id))
+            if (!Regex.IsMatch(id, @"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}_\d+$"))
+                return BadRequest("Invalid page identifier");
+
+            var undetectedLocation = DataStore.CreateLocation(Database, "DocumentDropBox_Unassigned");
+            if (Source.HasValue && Source.Value)
             {
-                var undetectedLocation = DataStore.CreateLocation(Database, "DocumentDropBox_Unassigned");
-                if (Source.HasValue && Source.Value)
+                var filename = Path.Combine(undetectedLocation, $"{id}.pdf");
+                if (System.IO.File.Exists(filename))
+                    return File(filename, DocumentTemplate.PdfMimeType);
+                else
+                    return HttpNotFound();
+            }
+            else
+            {
+                if (Thumbnail.HasValue && Thumbnail.Value)
                 {
-                    var filename = Path.Combine(undetectedLocation, string.Concat(id, ".pdf"));
+                    var filename = Path.Combine(undetectedLocation, $"{id}_thumbnail.png");
                     if (System.IO.File.Exists(filename))
-                        return File(filename, DocumentTemplate.PdfMimeType);
+                        return File(filename, "image/png");
                     else
-                        return HttpNotFound();
+                        return File(Links.ClientSource.Style.Images.Status.fileBroken256_png, "image/png");
                 }
                 else
                 {
-                    if (Thumbnail.HasValue && Thumbnail.Value)
-                    {
-                        var filename = Path.Combine(undetectedLocation, string.Concat(id, "_thumbnail.png"));
-                        if (System.IO.File.Exists(filename))
-                            return File(filename, "image/png");
-                        else
-                            return File(Links.ClientSource.Style.Images.Status.fileBroken256_png, "image/png");
-                    }
+                    var filename = Path.Combine(undetectedLocation, $"{id}.jpg");
+                    if (System.IO.File.Exists(filename))
+                        return File(filename, "image/jpeg");
                     else
-                    {
-                        var filename = Path.Combine(undetectedLocation, string.Concat(id, ".jpg"));
-                        if (System.IO.File.Exists(filename))
-                            return File(filename, "image/jpeg");
-                        else
-                            return File(Links.ClientSource.Style.Images.Status.fileBroken256_png, "image/png");
-                    }
+                        return File(Links.ClientSource.Style.Images.Status.fileBroken256_png, "image/png");
                 }
             }
-            return HttpNotFound();
         }
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.UndetectedPages)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult ImporterUndetectedAssign(string id, string DocumentTemplateId, string DataId)
         {
+            if (!Regex.IsMatch(id, @"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}_\d+$"))
+                return BadRequest("Invalid page identifier");
+
             var undetectedLocation = DataStore.CreateLocation(Database, "DocumentDropBox_Unassigned");
-            var filename = Path.Combine(undetectedLocation, string.Concat(id, ".pdf"));
+            var filename = Path.Combine(undetectedLocation, $"{id}.pdf");
             var identifier = DocumentUniqueIdentifier.Create(Database, DocumentTemplateId, DataId, UserService.CurrentUser.UserId, DateTime.Now, 0);
 
             if (Disco.Services.Documents.AttachmentImport.Importer.ImportPdfAttachment(identifier, Database, filename) != null)
@@ -626,48 +645,53 @@ namespace Disco.Web.Areas.API.Controllers
                 System.IO.File.Delete(filename);
 
                 // Delete Thumbnail/Preview
-                var thumbnailFilename = Path.Combine(undetectedLocation, string.Concat(id, "_thumbnail.png"));
+                var thumbnailFilename = Path.Combine(undetectedLocation, $"{id}_thumbnail.png");
                 if (System.IO.File.Exists(thumbnailFilename))
                     System.IO.File.Delete(thumbnailFilename);
-                var previewFilename = Path.Combine(undetectedLocation, string.Concat(id, ".jpg"));
+                var previewFilename = Path.Combine(undetectedLocation, $"{id}.jpg");
                 if (System.IO.File.Exists(previewFilename))
                     System.IO.File.Delete(previewFilename);
 
-                return Json("OK");
+                return Ok();
             }
             else
             {
-                return Json("Unable to Import File with the supplied parameters");
+                return BadRequest("Unable to Import File with the supplied parameters");
             }
         }
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.UndetectedPages)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult ImporterUndetectedDelete(string id)
         {
+            if (!Regex.IsMatch(id, @"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}_\d+$"))
+                return BadRequest("Invalid page identifier");
+
             var undetectedLocation = DataStore.CreateLocation(Database, "DocumentDropBox_Unassigned");
-            var filename = Path.Combine(undetectedLocation, string.Concat(id, ".pdf"));
+            var filename = Path.Combine(undetectedLocation, $"{id}.pdf");
             if (System.IO.File.Exists(filename))
             {
                 // Delete File
                 System.IO.File.Delete(filename);
 
                 // Delete Thumbnail/Preview
-                var thumbnailFilename = Path.Combine(undetectedLocation, string.Concat(id, "_thumbnail.png"));
+                var thumbnailFilename = Path.Combine(undetectedLocation, $"{id}_thumbnail.png");
                 if (System.IO.File.Exists(thumbnailFilename))
                     System.IO.File.Delete(thumbnailFilename);
-                var previewFilename = Path.Combine(undetectedLocation, string.Concat(id, ".jpg"));
+                var previewFilename = Path.Combine(undetectedLocation, $"{id}.jpg");
                 if (System.IO.File.Exists(previewFilename))
                     System.IO.File.Delete(previewFilename);
 
-                return Json("OK");
+                return Ok();
             }
             else
             {
-                return Json("File Not Found");
+                return BadRequest("File Not Found");
             }
         }
 
         [DiscoAuthorizeAll(Claims.Config.DeviceModel.Show, Claims.Config.DocumentTemplate.BulkGenerate)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult BulkGenerateDeviceModel(string id, int deviceGroupId)
         {
             var template = Database.DocumentTemplates.FirstOrDefault(t => t.Id == id);
@@ -701,6 +725,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorizeAll(Claims.Config.DeviceProfile.Show, Claims.Config.DocumentTemplate.BulkGenerate)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult BulkGenerateDeviceProfile(string id, int deviceGroupId)
         {
             var template = Database.DocumentTemplates.FirstOrDefault(t => t.Id == id);
@@ -734,6 +759,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorizeAll(Claims.Config.DeviceBatch.Show, Claims.Config.DocumentTemplate.BulkGenerate)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult BulkGenerateDeviceBatch(string id, int deviceGroupId)
         {
             var template = Database.DocumentTemplates.FirstOrDefault(t => t.Id == id);
@@ -767,11 +793,12 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.BulkGenerate)]
-        public virtual ActionResult BulkGenerate(string id, string DataIds = null, bool InsertBlankPage = false)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult BulkGenerate(string id, string dataIds = null, bool insertBlankPage = false)
         {
             if (string.IsNullOrEmpty(id))
                 throw new ArgumentNullException("id");
-            if (string.IsNullOrEmpty(DataIds))
+            if (string.IsNullOrEmpty(dataIds))
                 throw new ArgumentNullException("DataIds");
             var documentTemplate = Database.DocumentTemplates.Find(id);
             if (documentTemplate == null)
@@ -792,35 +819,34 @@ namespace Disco.Web.Areas.API.Controllers
                     throw new InvalidOperationException("Unknown DocumentType Scope");
             }
 
-            var dataIds = DataIds.Split(new string[] { Environment.NewLine, ",", ";" }, StringSplitOptions.RemoveEmptyEntries).Select(d => d.Trim()).Where(d => !string.IsNullOrEmpty(d)).ToList();
+            var ids = dataIds.Split(new string[] { Environment.NewLine, ",", ";" }, StringSplitOptions.RemoveEmptyEntries).Select(d => d.Trim()).Where(d => !string.IsNullOrEmpty(d)).ToList();
             var timeStamp = DateTime.Now;
 
-            var taskStatus = DocumentBulkGenerateTask.ScheduleNow(BI.Interop.Pdf.PdfGenerator.GenerateBulkFromTemplate, documentTemplate, UserService.CurrentUser, timeStamp, InsertBlankPage, dataIds);
+            var taskStatus = DocumentBulkGenerateTask.ScheduleNow(BI.Interop.Pdf.PdfGenerator.GenerateBulkFromTemplate, documentTemplate, UserService.CurrentUser, timeStamp, insertBlankPage, ids);
 
             var fileName = $"{documentTemplate.Id}_Bulk_{timeStamp:yyyyMMdd-HHmmss}.pdf";
-            taskStatus.SetFinishedUrl(Url.Action(MVC.Config.DocumentTemplate.Index(documentTemplate.Id, taskStatus.SessionId, fileName)));
+            taskStatus.SetFinishedUrl(Url.Action(MVC.Config.DocumentTemplate.Index(documentTemplate.Id, Guid.Parse(taskStatus.SessionId), fileName)));
 
             if (!taskStatus.WaitUntilFinished(TimeSpan.FromSeconds(1)))
                 return RedirectToAction(MVC.Config.Logging.TaskStatus(taskStatus.SessionId));
 
-            var stream = DocumentBulkGenerateTask.GetCached(Database, taskStatus.SessionId);
+            var stream = DocumentBulkGenerateTask.GetCached(Database, Guid.Parse(taskStatus.SessionId));
             return File(stream, "application/pdf", fileName);
         }
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.BulkGenerate)]
-        public virtual ActionResult BulkGenerateDownload(string id, string fileName)
+        public virtual ActionResult BulkGenerateDownload(Guid id, string fileName)
         {
             var stream = DocumentBulkGenerateTask.GetCached(Database, id);
             return File(stream, "application/pdf", fileName);
         }
 
-
         [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.BulkGenerate, Claims.User.Actions.GenerateDocuments)]
         [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult BulkGenerateAddUsers(string userIds)
         {
             if (string.IsNullOrWhiteSpace(userIds))
-                return new HttpStatusCodeResult(HttpStatusCode.BadRequest);
+                return BadRequest();
 
             var dataIds = userIds.Split(new string[] { Environment.NewLine, ",", ";" }, StringSplitOptions.RemoveEmptyEntries).Select(d => d.Trim()).Where(d => !string.IsNullOrEmpty(d)).ToList();
             var results = new List<BulkGenerateUserModel>(dataIds.Count);
@@ -893,7 +919,7 @@ namespace Disco.Web.Areas.API.Controllers
         public virtual ActionResult BulkGenerateAddGroupMembers(string groupId)
         {
             if (string.IsNullOrWhiteSpace(groupId))
-                return new HttpStatusCodeResult(HttpStatusCode.BadRequest);
+                return BadRequest();
 
             var results = new List<BulkGenerateUserModel>();
             var accountId = ActiveDirectory.ParseDomainAccountId(groupId);
@@ -954,7 +980,7 @@ namespace Disco.Web.Areas.API.Controllers
         public virtual ActionResult BulkGenerateAddUserFlag(int flagId)
         {
             if (flagId <= 0)
-                return new HttpStatusCodeResult(HttpStatusCode.BadRequest);
+                return BadRequest();
 
             var results = new List<BulkGenerateUserModel>();
 
@@ -1008,7 +1034,7 @@ namespace Disco.Web.Areas.API.Controllers
         public virtual ActionResult BulkGenerateAddDeviceProfile(int deviceProfileId)
         {
             if (deviceProfileId <= 0)
-                return new HttpStatusCodeResult(HttpStatusCode.BadRequest);
+                return BadRequest();
 
             var results = new List<BulkGenerateUserModel>();
 
@@ -1062,7 +1088,7 @@ namespace Disco.Web.Areas.API.Controllers
         public virtual ActionResult BulkGenerateAddDeviceBatch(int deviceBatchId)
         {
             if (deviceBatchId <= 0)
-                return new HttpStatusCodeResult(HttpStatusCode.BadRequest);
+                return BadRequest();
 
             var results = new List<BulkGenerateUserModel>();
 
@@ -1116,7 +1142,7 @@ namespace Disco.Web.Areas.API.Controllers
         public virtual ActionResult BulkGenerateAddDocumentAttachment(string documentTemplateId, DateTime? threshold)
         {
             if (string.IsNullOrWhiteSpace(documentTemplateId))
-                return new HttpStatusCodeResult(HttpStatusCode.BadRequest);
+                return BadRequest();
 
             var results = new List<BulkGenerateUserModel>();
 
@@ -1229,7 +1255,7 @@ namespace Disco.Web.Areas.API.Controllers
         public virtual ActionResult BulkGenerateGetUserDetailValues(string key)
         {
             if (string.IsNullOrWhiteSpace(key))
-                return new HttpStatusCodeResult(HttpStatusCode.BadRequest);
+                return BadRequest();
 
             var results = Database.UserDetails.Where(d => d.Scope == "Details" && d.Key == key).Select(d => d.Value).Distinct().ToList();
 
@@ -1241,7 +1267,7 @@ namespace Disco.Web.Areas.API.Controllers
         public virtual ActionResult BulkGenerateAddUserDetail(string key, string value)
         {
             if (string.IsNullOrWhiteSpace(key))
-                return new HttpStatusCodeResult(HttpStatusCode.BadRequest);
+                return BadRequest();
 
             var results = new List<BulkGenerateUserModel>();
 
@@ -1279,9 +1305,10 @@ namespace Disco.Web.Areas.API.Controllers
             return Json(results);
         }
 
-        public virtual ActionResult Generate(string id, string TargetId)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult Generate(string id, string targetId)
         {
-            Disco.Services.DocumentTemplateExtensions.GetTemplateAndTarget(Database, Authorization, id, TargetId, out var template, out var target, out _);
+            Disco.Services.DocumentTemplateExtensions.GetTemplateAndTarget(Database, Authorization, id, targetId, out var template, out var target, out _);
 
             // generate document
             var timestamp = DateTime.Now;
@@ -1296,6 +1323,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Delete)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Delete(string id, bool? redirect = false)
         {
             try
@@ -1308,7 +1336,7 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect.HasValue && redirect.Value)
                         return RedirectToAction(MVC.Config.DocumentTemplate.Index(null));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 throw new Exception("Invalid Document Template Id");
             }
@@ -1317,12 +1345,12 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
-        [HttpPost, ValidateAntiForgeryToken]
         [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.Configure, Claims.Config.UserFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult RemoveOnImportUserFlagRule([Required] string id, Guid? ruleId = null)
         {
             try
@@ -1334,16 +1362,16 @@ namespace Disco.Web.Areas.API.Controllers
 
                 template.RemoveOnImportUserFlagRule(Database, ruleId.Value);
 
-                return new HttpStatusCodeResult(HttpStatusCode.OK);
+                return Ok();
             }
             catch (Exception ex)
             {
-                return new HttpStatusCodeResult(HttpStatusCode.BadRequest, ex.Message);
+                return BadRequest(ex.Message);
             }
         }
 
-        [HttpPost, ValidateAntiForgeryToken]
         [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.Configure, Claims.Config.UserFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult AddOnImportUserFlagRule([Required] string id, bool? addFlag = null, int? userFlagId = null, string comments = null)
         {
             try
@@ -1379,14 +1407,14 @@ namespace Disco.Web.Areas.API.Controllers
             }
             catch (Exception ex)
             {
-                return new HttpStatusCodeResult(HttpStatusCode.BadRequest, ex.Message);
+                return BadRequest(ex.Message);
             }
         }
 
         #endregion
 
         #region Handlers
-        [HttpPost]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult GenerateDocumentHandlerUi(string templateId, string targetId, string handlerId)
         {
             Disco.Services.DocumentTemplateExtensions.GetTemplateAndTarget(Database, Authorization, templateId, targetId, out var template, out var target, out var targetUser);
@@ -1403,15 +1431,13 @@ namespace Disco.Web.Areas.API.Controllers
                 if (handlerPartialView == null)
                     throw new NotSupportedException("Handler does not have a Generation Options UI");
 
-
-
                 var model = handler.GetGenerationOptionsUiModel(template, target, targetUser, CurrentUser);
 
                 return this.PrecompiledPartialView(handlerPartialView, model);
             }
         }
 
-        [HttpPost]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult DocumentHandlers(string templateId, string targetId)
         {
             Disco.Services.DocumentTemplateExtensions.GetTemplateAndTarget(Database, Authorization, templateId, targetId, out var template, out var target, out _);

Disco.Web/Areas/API/Controllers/DocumentTemplatePackageController.cs

@@ -24,6 +24,7 @@ namespace Disco.Web.Areas.API.Controllers
         const string pInsertBlankPages = "insertblankpages";
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(string id, string key, string value = null, bool redirect = false)
         {
             try
@@ -69,24 +70,26 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect)
                     return RedirectToAction(MVC.Config.DocumentTemplate.ShowPackage(package.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         #region Update Shortcut Methods
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDescription(string id, string Description = null, bool redirect = false)
         {
             return Update(id, pDescription, Description, redirect);
         }
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDocumentTemplates(string id, List<string> DocumentTemplates = null, bool redirect = false)
         {
             try
@@ -104,43 +107,49 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect)
                     return RedirectToAction(MVC.Config.DocumentTemplate.ShowPackage(package.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
 
         }
         [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.Configure, Claims.Config.DocumentTemplate.ConfigureFilterExpression)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateFilterExpression(string id, string FilterExpression = null, bool redirect = false)
         {
             return Update(id, pFilterExpression, FilterExpression, redirect);
         }
         [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.Configure, Claims.Config.DocumentTemplate.ConfigureFilterExpression)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateOnGenerateExpression(string id, string OnGenerateExpression = null, bool redirect = false)
         {
             return Update(id, pOnGenerateExpression, OnGenerateExpression, redirect);
         }
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateIsHidden(string id, string IsHidden = null, bool redirect = false)
         {
             return Update(id, pIsHidden, IsHidden, redirect);
         }
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsertBlankPages(string id, string InsertBlankPages = null, bool redirect = false)
         {
             return Update(id, pInsertBlankPages, InsertBlankPages, redirect);
         }
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateScope(string id, string Scope = null, bool redirect = false)
         {
             return Update(id, pScope, Scope, redirect);
         }
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateJobSubTypes(string id, List<string> JobSubTypes = null, bool redirect = false)
         {
             try
@@ -158,32 +167,31 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect)
                     return RedirectToAction(MVC.Config.DocumentTemplate.ShowPackage(package.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
 
         }
         #endregion
 
         #region Update Properties
-        private void UpdateDescription(DocumentTemplatePackage Package, string Description)
+        private void UpdateDescription(DocumentTemplatePackage Package, string description)
         {
-            if (!string.IsNullOrWhiteSpace(Description))
+            if (string.IsNullOrWhiteSpace(description))
+                throw new Exception("Invalid Description");
+
+            description = description.Trim();
+            if (Package.Description != description)
             {
-                var description = Description.Trim();
-                if (Package.Description != description)
-                {
-                    Package.Description = description;
-                    DocumentTemplatePackages.UpdatePackage(Package);
-                }
+                Package.Description = description;
+                DocumentTemplatePackages.UpdatePackage(Package);
             }
-            throw new Exception("Invalid Description");
         }
         private void UpdateDocumentTemplates(DocumentTemplatePackage Package, List<string> DocumentTemplates)
         {
@@ -349,12 +357,13 @@ namespace Disco.Web.Areas.API.Controllers
         #region Actions
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.BulkGenerate)]
-        public virtual ActionResult BulkGenerate(string id, string DataIds = null, bool InsertBlankPage = false)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult BulkGenerate(string id, string dataIds = null)
         {
             if (string.IsNullOrEmpty(id))
                 throw new ArgumentNullException(nameof(id));
-            if (string.IsNullOrEmpty(DataIds))
-                throw new ArgumentNullException(nameof(DataIds));
+            if (string.IsNullOrEmpty(dataIds))
+                throw new ArgumentNullException(nameof(dataIds));
 
             var package = DocumentTemplatePackages.GetPackage(id);
 
@@ -376,19 +385,20 @@ namespace Disco.Web.Areas.API.Controllers
                     throw new InvalidOperationException("Unknown DocumentType Scope");
             }
 
-            var dataIds = DataIds.Split(new string[] { Environment.NewLine, ",", ";" }, StringSplitOptions.RemoveEmptyEntries).Select(d => d.Trim()).Where(d => !string.IsNullOrEmpty(d)).ToList();
+            var ids = dataIds.Split(new string[] { Environment.NewLine, ",", ";" }, StringSplitOptions.RemoveEmptyEntries).Select(d => d.Trim()).Where(d => !string.IsNullOrEmpty(d)).ToList();
             var timeStamp = DateTime.Now;
-            var pdf = package.GeneratePdfPackageBulk(Database, UserService.CurrentUser, timeStamp, InsertBlankPage, dataIds);
+            var pdf = package.GeneratePdfPackageBulk(Database, UserService.CurrentUser, timeStamp, null, ids);
 
             return File(pdf, "application/pdf", $"{package.Id}_Bulk_{timeStamp:yyyyMMdd-HHmmss}.pdf");
         }
 
-        public virtual ActionResult Generate(string id, string TargetId)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult Generate(string id, string targetId)
         {
             if (string.IsNullOrWhiteSpace(id))
                 throw new ArgumentNullException(nameof(id));
-            if (string.IsNullOrWhiteSpace(TargetId))
-                throw new ArgumentNullException(nameof(TargetId));
+            if (string.IsNullOrWhiteSpace(targetId))
+                throw new ArgumentNullException(nameof(targetId));
 
             var package = DocumentTemplatePackages.GetPackage(id);
             if (package == null)
@@ -410,9 +420,9 @@ namespace Disco.Web.Areas.API.Controllers
             }
 
             // resolve target
-            var target = package.ResolveScopeTarget(Database, TargetId);
+            var target = package.ResolveScopeTarget(Database, targetId);
             if (target == null)
-                throw new ArgumentException("Target not found", nameof(TargetId));
+                throw new ArgumentException("Target not found", nameof(targetId));
 
             var timestamp = DateTime.Now;
             var document = default(Stream);
@@ -426,6 +436,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Delete)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Delete(string id, bool? redirect = false)
         {
             try
@@ -445,7 +456,7 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect.HasValue && redirect.Value)
                         return RedirectToAction(MVC.Config.DocumentTemplate.Index(null));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 throw new Exception("Invalid Document Template Package Id");
             }
@@ -454,7 +465,7 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 

Disco.Web/Areas/API/Controllers/EnrolmentController.cs

@@ -8,9 +8,8 @@ namespace Disco.Web.Areas.API.Controllers
 {
     public partial class EnrolmentController : AuthorizedDatabaseController
     {
-        [HttpPost]
-        [ValidateAntiForgeryToken]
         [DiscoAuthorize(Claims.Device.Actions.EnrolDevices)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult ResolveSessionPending(string sessionId, bool approve, int? deviceProfileId, int? deviceBatchId, string reason)
         {
             if (approve && deviceProfileId == null)
@@ -18,11 +17,11 @@ namespace Disco.Web.Areas.API.Controllers
 
             WindowsDeviceEnrolment.ResolvePendingEnrolment(sessionId, approve, CurrentUser.UserId, deviceProfileId, deviceBatchId, reason);
 
-            return new HttpStatusCodeResult(200);
+            return Ok();
         }
 
-        [HttpPost]
         [DiscoAuthorize(Claims.Config.Enrolment.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult PendingTimeoutMinutes(int PendingTimeoutMinutes)
         {
             try
@@ -31,7 +30,7 @@ namespace Disco.Web.Areas.API.Controllers
                 {
                     Database.DiscoConfiguration.Bootstrapper.PendingTimeout = TimeSpan.FromMinutes(PendingTimeoutMinutes);
                     Database.SaveChanges();
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
                 }
                 else
                 {
@@ -40,7 +39,53 @@ namespace Disco.Web.Areas.API.Controllers
             }
             catch (Exception ex)
             {
-                return Json($"Error: {ex.Message}");
+                return BadRequest(ex.Message);
+            }
+        }
+
+        [DiscoAuthorize(Claims.Config.Enrolment.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult MacSshUsername(string MacSshUsername)
+        {
+            try
+            {
+                if (!string.IsNullOrWhiteSpace(MacSshUsername))
+                {
+                    Database.DiscoConfiguration.Bootstrapper.MacSshUsername = MacSshUsername;
+                    Database.SaveChanges();
+                    return Ok();
+                }
+                else
+                {
+                    throw new Exception("The Username cannot be null or empty");
+                }
+            }
+            catch (Exception ex)
+            {
+                return BadRequest(ex.Message);
+            }
+        }
+
+        [DiscoAuthorize(Claims.Config.Enrolment.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult MacSshPassword(string MacSshPassword)
+        {
+            try
+            {
+                if (!string.IsNullOrWhiteSpace(MacSshPassword))
+                {
+                    Database.DiscoConfiguration.Bootstrapper.MacSshPassword = MacSshPassword;
+                    Database.SaveChanges();
+                    return Ok();
+                }
+                else
+                {
+                    throw new Exception("The Password cannot be null or empty");
+                }
+            }
+            catch (Exception ex)
+            {
+                return BadRequest(ex.Message);
             }
         }
     }

Disco.Web/Areas/API/Controllers/ExportController.cs

@@ -33,7 +33,7 @@ namespace Disco.Web.Areas.API.Controllers
             {
                 var errorState = ModelState.First(m => m.Value.Errors.Any());
                 var error = errorState.Value.Errors.First();
-                return new HttpStatusCodeResult(400, $"{errorState.Key}: {error.Exception?.Message ?? error.ErrorMessage}");
+                return BadRequest($"{errorState.Key}: {error.Exception?.Message ?? error.ErrorMessage}");
             }
 
             SavedExports.UpdateSavedExport(Database, model.ToSavedExport());

Disco.Web/Areas/API/Controllers/ExpressionsController.cs

@@ -20,7 +20,7 @@ namespace Disco.Web.Areas.API.Controllers
         public virtual ActionResult TypeDescriptor(string type, bool staticMembersOnly = false)
         {
             if (string.IsNullOrWhiteSpace(type))
-                return new HttpStatusCodeResult(400, "Type is required");
+                return BadRequest("Type is required");
 
             var t = Type.GetType(type, false);
 
@@ -28,15 +28,15 @@ namespace Disco.Web.Areas.API.Controllers
             {
                 var typeNameParts = type.Split(new string[] { ", " }, StringSplitOptions.None);
                 if (typeNameParts.Length < 2)
-                    return Json("Invalid Type Specified");
+                    return BadRequest("Invalid Type Specified");
 
                 if (!ExpressionExtensionProviderFeature.TryGetExtensionAssembly(typeNameParts[1], out var assembly))
-                    return Json("Invalid Type Specified");
+                    return BadRequest("Invalid Type Specified");
 
                 t = assembly.GetType(typeNameParts[0]);
 
                 if (t == null)
-                    return Json("Invalid Type Specified");
+                    return BadRequest("Invalid Type Specified");
             }
 
             return Json(ExpressionTypeDescriptor.Build(t, staticMembersOnly));

Disco.Web/Areas/API/Controllers/JobController.cs

@@ -78,6 +78,7 @@ namespace Disco.Web.Areas.API.Controllers
 
         #endregion
 
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(int id, string key, string value = null, bool? redirect = null)
         {
             try
@@ -287,7 +288,6 @@ namespace Disco.Web.Areas.API.Controllers
                 }
                 if (redirect.HasValue && redirect.Value)
                     return this.RedirectToAction(MVC.Job.Show(job.Id), resultUrlFragment);
-                //return RedirectToAction(MVC.Job.Show(job.Id));
                 else
                 {
                     if (resultData != null)
@@ -296,7 +296,7 @@ namespace Disco.Web.Areas.API.Controllers
                     }
                     else
                     {
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                     }
                 }
             }
@@ -305,22 +305,25 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         #region Update Shortcut Methods
         [DiscoAuthorize(Claims.Job.Properties.ExpectedClosedDate)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateExpectedClosedDate(int id, string ExpectedClosedDate, bool? redirect = null)
         {
             return Update(id, pExpectedClosedDate, ExpectedClosedDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.DeviceHeldLocation)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDeviceHeldLocation(int id, string DeviceHeldLocation, bool? redirect = null)
         {
             return Update(id, pDeviceHeldLocation, DeviceHeldLocation, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.Flags)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateFlags(int id, string Flags, bool? redirect = null)
         {
             return Update(id, pFlags, Flags, redirect);
@@ -328,61 +331,73 @@ namespace Disco.Web.Areas.API.Controllers
 
         #region NonWarranty
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.AccountingChargeRequired)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateNonWarrantyAccountingChargeRequired(int id, string AccountingChargeRequiredDate, bool? redirect = null)
         {
             return Update(id, pNonWarrantyAccountingChargeRequired, AccountingChargeRequiredDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.AccountingChargeAdded)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateNonWarrantyAccountingChargeAdded(int id, string AccountingChargeAddedDate, bool? redirect = null)
         {
             return Update(id, pNonWarrantyAccountingChargeAdded, AccountingChargeAddedDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.AccountingChargePaid)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateNonWarrantyAccountingChargePaid(int id, string AccountingChargePaidDate, bool? redirect = null)
         {
             return Update(id, pNonWarrantyAccountingChargePaid, AccountingChargePaidDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.PurchaseOrderRaised)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateNonWarrantyPurchaseOrderRaised(int id, string PurchaseOrderRaisedDate, bool? redirect = null)
         {
             return Update(id, pNonWarrantyPurchaseOrderRaised, PurchaseOrderRaisedDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.PurchaseOrderReference)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateNonWarrantyPurchaseOrderReference(int id, string PurchaseOrderReference, bool? redirect = null)
         {
             return Update(id, pNonWarrantyPurchaseOrderReference, PurchaseOrderReference, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.PurchaseOrderSent)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateNonWarrantyPurchaseOrderSent(int id, string PurchaseOrderSentDate, bool? redirect = null)
         {
             return Update(id, pNonWarrantyPurchaseOrderSent, PurchaseOrderSentDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InvoiceReceived)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateNonWarrantyInvoiceReceived(int id, string InvoiceReceivedDate, bool? redirect = null)
         {
             return Update(id, pNonWarrantyInvoiceReceived, InvoiceReceivedDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.RepairerName)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateNonWarrantyRepairerName(int id, string RepairerName, bool? redirect = null)
         {
             return Update(id, pNonWarrantyRepairerName, RepairerName, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.RepairerLoggedDate)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateNonWarrantyRepairerLoggedDate(int id, string RepairerLoggedDate, bool? redirect = null)
         {
             return Update(id, pNonWarrantyRepairerLoggedDate, RepairerLoggedDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.RepairerReference)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateNonWarrantyRepairerReference(int id, string RepairerReference, bool? redirect = null)
         {
             return Update(id, pNonWarrantyRepairerReference, RepairerReference, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.RepairerCompletedDate)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateNonWarrantyRepairerCompletedDate(int id, string RepairerCompletedDate, bool? redirect = null)
         {
             return Update(id, pNonWarrantyRepairerCompletedDate, RepairerCompletedDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.IsInsuranceClaim)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateNonWarrantyIsInsuranceClaim(int id, bool IsInsuranceClaim, bool? redirect = null)
         {
             return Update(id, pNonWarrantyIsInsuranceClaim, IsInsuranceClaim.ToString(), redirect);
@@ -392,91 +407,109 @@ namespace Disco.Web.Areas.API.Controllers
         #region Insurance
 
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceLossOrDamageDate(int id, string LossOrDamageDate, bool? redirect = null)
         {
             return Update(id, pInsuranceLossOrDamageDate, LossOrDamageDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceEventLocation(int id, string EventLocation, bool? redirect = null)
         {
             return Update(id, pInsuranceEventLocation, EventLocation, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceDescription(int id, string Description, bool? redirect = null)
         {
             return Update(id, pInsuranceDescription, Description, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceThirdPartyCaused(int id, string ThirdPartyCaused, bool? redirect = null)
         {
             return Update(id, pInsuranceThirdPartyCaused, ThirdPartyCaused, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceThirdPartyCausedName(int id, string ThirdPartyCausedName, bool? redirect = null)
         {
             return Update(id, pInsuranceThirdPartyCausedName, ThirdPartyCausedName, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceThirdPartyCausedWhy(int id, string ThirdPartyCausedWhy, bool? redirect = null)
         {
             return Update(id, pInsuranceThirdPartyCausedWhy, ThirdPartyCausedWhy, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceWitnessesNamesAddresses(int id, string WitnessesNamesAddresses, bool? redirect = null)
         {
             return Update(id, pInsuranceWitnessesNamesAddresses, WitnessesNamesAddresses, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceBurglaryTheftMethodOfEntry(int id, string BurglaryTheftMethodOfEntry, bool? redirect = null)
         {
             return Update(id, pInsuranceBurglaryTheftMethodOfEntry, BurglaryTheftMethodOfEntry, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsurancePropertyLastSeenDate(int id, string PropertyLastSeenDate, bool? redirect = null)
         {
             return Update(id, pInsurancePropertyLastSeenDate, PropertyLastSeenDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsurancePoliceNotified(int id, string PoliceNotified, bool? redirect = null)
         {
             return Update(id, pInsurancePoliceNotified, PoliceNotified, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsurancePoliceNotifiedStation(int id, string PoliceNotifiedStation, bool? redirect = null)
         {
             return Update(id, pInsurancePoliceNotifiedStation, PoliceNotifiedStation, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsurancePoliceNotifiedDate(int id, string PoliceNotifiedDate, bool? redirect = null)
         {
             return Update(id, pInsurancePoliceNotifiedDate, PoliceNotifiedDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsurancePoliceNotifiedCrimeReportNo(int id, string PoliceNotifiedCrimeReportNo, bool? redirect = null)
         {
             return Update(id, pInsurancePoliceNotifiedCrimeReportNo, PoliceNotifiedCrimeReportNo, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceRecoverReduceAction(int id, string RecoverReduceAction, bool? redirect = null)
         {
             return Update(id, pInsuranceRecoverReduceAction, RecoverReduceAction, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceOtherInterestedParties(int id, string OtherInterestedParties, bool? redirect = null)
         {
             return Update(id, pInsuranceOtherInterestedParties, OtherInterestedParties, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceDetails)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceDateOfPurchase(int id, string DateOfPurchase, bool? redirect = null)
         {
             return Update(id, pInsuranceDateOfPurchase, DateOfPurchase, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceClaimFormSent)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceClaimFormSentDate(int id, string ClaimFormSentDate, bool? redirect = null)
         {
             return Update(id, pInsuranceClaimFormSentDate, ClaimFormSentDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.InsuranceClaimFormSent)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInsuranceClaimFormSentUserId(int id, string ClaimFormSentUserId, bool? redirect = null)
         {
             return Update(id, pInsuranceClaimFormSentUserId, ClaimFormSentUserId, redirect);
@@ -486,21 +519,25 @@ namespace Disco.Web.Areas.API.Controllers
 
         #region Warranty
         [DiscoAuthorize(Claims.Job.Properties.WarrantyProperties.ExternalName)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateWarrantyExternalName(int id, string ExternalName, bool? redirect = null)
         {
             return Update(id, pWarrantyExternalName, ExternalName, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.WarrantyProperties.ExternalLoggedDate)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateWarrantyExternalLoggedDate(int id, string ExternalLoggedDate, bool? redirect = null)
         {
             return Update(id, pWarrantyExternalLoggedDate, ExternalLoggedDate, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.WarrantyProperties.ExternalReference)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateWarrantyExternalReference(int id, string ExternalReference, bool? redirect = null)
         {
             return Update(id, pWarrantyExternalReference, ExternalReference, redirect);
         }
         [DiscoAuthorize(Claims.Job.Properties.WarrantyProperties.ExternalCompletedDate)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateWarrantyExternalCompletedDate(int id, string ExternalCompletedDate, bool? redirect = null)
         {
             return Update(id, pWarrantyExternalCompletedDate, ExternalCompletedDate, redirect);
@@ -1424,6 +1461,7 @@ namespace Disco.Web.Areas.API.Controllers
         #region Job Actions
 
         [DiscoAuthorize(Claims.Job.Actions.UpdateSubTypes)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateSubTypes(int id, List<string> SubTypes = null, bool? AddComponents = null, bool? redirect = null)
         {
             try
@@ -1448,18 +1486,19 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     return RedirectToAction(MVC.Job.Show(job.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         [DiscoAuthorize(Claims.Job.Properties.Flags)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateFlag(int id, long? Flag, string Reason, bool? redirect = null)
         {
             try
@@ -1508,7 +1547,7 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect.HasValue && redirect.Value)
                         return RedirectToAction(MVC.Job.Show(job.Id));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 else
                 {
@@ -1520,11 +1559,12 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         [DiscoAuthorize(Claims.Job.Properties.WaitingForUserAction)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult WaitingForUserAction(int id, string Reason, bool? redirect = null)
         {
             try
@@ -1544,18 +1584,19 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     return RedirectToAction(MVC.Job.Show(job.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         [DiscoAuthorize(Claims.Job.Properties.NotWaitingForUserAction)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult NotWaitingForUserAction(int id, string Resolution, bool? redirect = null)
         {
             try
@@ -1575,18 +1616,19 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     return RedirectToAction(MVC.Job.Show(job.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         [DiscoAuthorize(Claims.Job.Properties.DeviceReadyForReturn)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult DeviceReadyForReturn(int id, bool redirect)
         {
             Database.Configuration.LazyLoadingEnabled = true;
@@ -1601,17 +1643,18 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect)
                         return RedirectToAction(MVC.Job.Show(id));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 else
                 {
-                    return Json("Job's state doesn't allow this action", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Job's state doesn't allow this action");
                 }
             }
-            return Json("Invalid Job Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Job Number");
         }
 
         [DiscoAuthorize(Claims.Job.Properties.DeviceHeld)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult DeviceHeld(int id, bool redirect)
         {
             var j = Database.Jobs.Find(id);
@@ -1625,17 +1668,18 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect)
                         return RedirectToAction(MVC.Job.Show(id));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 else
                 {
-                    return Json("Job's state doesn't allow this action", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Job's state doesn't allow this action");
                 }
             }
-            return Json("Invalid Job Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Job Number");
         }
 
         [DiscoAuthorize(Claims.Job.Properties.DeviceReturned)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult DeviceReturned(int id, bool redirect)
         {
             var j = Database.Jobs.Find(id);
@@ -1649,17 +1693,18 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect)
                         return RedirectToAction(MVC.Job.Show(id));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 else
                 {
-                    return Json("Job's state doesn't allow this action", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Job's state doesn't allow this action");
                 }
             }
-            return Json("Invalid Job Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Job Number");
         }
 
         [DiscoAuthorize(Claims.Job.Actions.ForceClose)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult ForceClose(int id, string Reason, bool? redirect = null)
         {
             var j = Database.Jobs.Find(id);
@@ -1674,17 +1719,18 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect.HasValue && redirect.Value)
                         return RedirectToAction(MVC.Job.Show(id));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 else
                 {
-                    return Json("Job's state doesn't allow this action", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Job's state doesn't allow this action");
                 }
             }
-            return Json("Invalid Job Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Job Number");
         }
 
         [DiscoAuthorize(Claims.Job.Actions.Close)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Close(int id, bool redirect)
         {
             var j = Database.Jobs.Find(id);
@@ -1699,17 +1745,18 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect)
                         return RedirectToAction(MVC.Job.Show(id));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 else
                 {
-                    return Json("Job's state doesn't allow this action", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Job's state doesn't allow this action");
                 }
             }
-            return Json("Invalid Job Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Job Number");
         }
 
         [DiscoAuthorize(Claims.Job.Actions.Reopen)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Reopen(int id, bool redirect)
         {
             var j = Database.Jobs
@@ -1725,17 +1772,18 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect)
                         return RedirectToAction(MVC.Job.Show(id));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 else
                 {
-                    return Json("Job's state doesn't allow this action", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Job's state doesn't allow this action");
                 }
             }
-            return Json("Invalid Job Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Job Number");
         }
 
         [DiscoAuthorize(Claims.Job.Actions.Delete)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Delete(int id, bool redirect)
         {
             var j = Database.Jobs.Find(id);
@@ -1750,17 +1798,18 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect)
                         return RedirectToAction(MVC.Job.Index());
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 else
                 {
-                    return Json("Job's state doesn't allow this action", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Job's state doesn't allow this action");
                 }
             }
-            return Json("Invalid Job Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Job Number");
         }
 
         [DiscoAuthorize(Claims.Job.Actions.ConvertHWarToHNWar)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult ConvertHWarToHNWar(int id, bool redirect)
         {
             var j = Database.Jobs.Find(id);
@@ -1775,14 +1824,14 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect)
                         return RedirectToAction(MVC.Job.Show(j.Id));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 else
                 {
-                    return Json("Job's state doesn't allow this action", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Job's state doesn't allow this action");
                 }
             }
-            return Json("Invalid Job Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Job Number");
         }
 
         #endregion
@@ -1872,7 +1921,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
         #endregion
 
-        #region Job Attachements
+        #region Job Attachments
 
         [DiscoAuthorize(Claims.Job.ShowAttachments), OutputCache(Location = System.Web.UI.OutputCacheLocation.Client, Duration = 172800)]
         public virtual ActionResult AttachmentDownload(int id)
@@ -1907,7 +1956,8 @@ namespace Disco.Web.Areas.API.Controllers
             return HttpNotFound("Invalid Attachment Number");
         }
 
-        [DiscoAuthorize(Claims.Job.Actions.AddAttachments), ValidateAntiForgeryToken]
+        [DiscoAuthorize(Claims.Job.Actions.AddAttachments)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult AttachmentUpload(int id, string comments)
         {
             var j = Database.Jobs.Find(id);
@@ -1987,6 +2037,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorizeAny(Claims.Job.Actions.RemoveAnyAttachments, Claims.Job.Actions.RemoveOwnAttachments)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult AttachmentRemove(int id)
         {
             var ja = Database.JobAttachments.Include("TechUser").Where(m => m.Id == id).FirstOrDefault();
@@ -1999,9 +2050,9 @@ namespace Disco.Web.Areas.API.Controllers
 
                 ja.OnDelete(Database);
                 Database.SaveChanges();
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
             }
-            return Json("Invalid Attachment Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Attachment Number");
         }
 
         [DiscoAuthorize(Claims.Job.Actions.AddAttachments)]
@@ -2028,11 +2079,7 @@ namespace Disco.Web.Areas.API.Controllers
             }
             catch (InvalidOperationException ex)
             {
-                return Json(new
-                {
-                    Success = false,
-                    ErrorMessage = ex.Message,
-                });
+                return BadRequest(ex.Message);
             }
         }
 
@@ -2041,55 +2088,58 @@ namespace Disco.Web.Areas.API.Controllers
         #region Job Components
 
         [DiscoAuthorizeAll(Claims.Job.Properties.NonWarrantyProperties.AddComponents, Claims.Job.Properties.NonWarrantyProperties.EditComponents)]
-        public virtual ActionResult ComponentAdd(int id, string Description, string Cost)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult ComponentAdd(int id, string description, string cost)
         {
             var j = Database.Jobs.Find(id);
             if (j != null)
             {
-                if (string.IsNullOrEmpty(Description))
-                    Description = "?";
-                if (!string.IsNullOrEmpty(Cost) && Cost.Contains("$"))
-                    Cost = Cost.Substring(Cost.IndexOf("$") + 1);
-                decimal.TryParse(Cost, out var cost);
+                if (string.IsNullOrEmpty(description))
+                    description = "?";
+                if (!string.IsNullOrEmpty(cost) && cost.Contains("$"))
+                    cost = cost.Substring(cost.IndexOf("$") + 1);
+                decimal.TryParse(cost, out var costValue);
 
                 var jc = new JobComponent()
                 {
                     JobId = j.Id,
-                    Description = Description,
-                    Cost = cost,
+                    Description = description,
+                    Cost = costValue,
                     TechUserId = CurrentUser.UserId
                 };
                 Database.JobComponents.Add(jc);
                 Database.SaveChanges();
 
-                return Json(new Models.Job.ComponentModel { Result = "OK", Component = Models.Job._ComponentModel.FromJobComponent(jc) }, JsonRequestBehavior.AllowGet);
+                return Json(Models.Job.ComponentModel.FromJobComponent(jc));
             }
-            return Json(new Models.Job.ComponentModel { Result = "Invalid Job Number" }, JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Job Number");
         }
 
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.EditComponents)]
-        public virtual ActionResult ComponentUpdate(int id, string Description, string Cost)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult ComponentUpdate(int id, string description, string cost)
         {
             var jc = Database.JobComponents.Find(id);
             if (jc != null)
             {
 
-                if (string.IsNullOrEmpty(Description))
-                    Description = "?";
-                if (!string.IsNullOrEmpty(Cost) && Cost.Contains("$"))
-                    Cost = Cost.Substring(Cost.IndexOf("$") + 1);
-                decimal.TryParse(Cost, out var cost);
+                if (string.IsNullOrEmpty(description))
+                    description = "?";
+                if (!string.IsNullOrEmpty(cost) && cost.Contains("$"))
+                    cost = cost.Substring(cost.IndexOf("$") + 1);
+                decimal.TryParse(cost, out var costValue);
 
-                jc.Description = Description;
-                jc.Cost = cost;
+                jc.Description = description;
+                jc.Cost = costValue;
                 Database.SaveChanges();
 
-                return Json(new Models.Job.ComponentModel { Result = "OK", Component = Models.Job._ComponentModel.FromJobComponent(jc) }, JsonRequestBehavior.AllowGet);
+                return Json(Models.Job.ComponentModel.FromJobComponent(jc));
             }
-            return Json(new Models.Job.ComponentModel { Result = "Invalid Job Component Number" }, JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Job Component Number");
         }
 
         [DiscoAuthorize(Claims.Job.Properties.NonWarrantyProperties.EditComponents)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult ComponentRemove(int id)
         {
             var jc = Database.JobComponents.Find(id);
@@ -2097,9 +2147,9 @@ namespace Disco.Web.Areas.API.Controllers
             {
                 Database.JobComponents.Remove(jc);
                 Database.SaveChanges();
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
             }
-            return Json("Invalid Job Component Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Job Component Number");
         }
 
         #endregion
@@ -2116,30 +2166,6 @@ namespace Disco.Web.Areas.API.Controllers
 
         #endregion
 
-        [DiscoAuthorize(Claims.Job.Actions.GenerateDocuments)]
-        public virtual ActionResult GeneratePdf(int id, string DocumentTemplateId)
-        {
-            if (id <= 0)
-                throw new ArgumentOutOfRangeException(nameof(id));
-            if (string.IsNullOrEmpty(DocumentTemplateId))
-                throw new ArgumentNullException(nameof(DocumentTemplateId));
-
-            // Obsolete: Use API\DocumentTemplate\Generate instead
-            return RedirectToAction(MVC.API.DocumentTemplate.Generate(DocumentTemplateId, id.ToString()));
-        }
-
-        [DiscoAuthorize(Claims.Job.Actions.GenerateDocuments)]
-        public virtual ActionResult GeneratePdfPackage(int id, string DocumentTemplatePackageId)
-        {
-            if (id <= 0)
-                throw new ArgumentOutOfRangeException(nameof(id));
-            if (string.IsNullOrEmpty(DocumentTemplatePackageId))
-                throw new ArgumentNullException(nameof(DocumentTemplatePackageId));
-
-            // Obsolete: Use API\DocumentTemplatePackage\Generate instead
-            return RedirectToAction(MVC.API.DocumentTemplatePackage.Generate(DocumentTemplatePackageId, id.ToString()));
-        }
-
         [DiscoAuthorize(Claims.Job.Properties.DeviceHeldLocation)]
         public virtual ActionResult DeviceHeldLocations()
         {

Disco.Web/Areas/API/Controllers/JobPreferencesController.cs

@@ -12,6 +12,7 @@ namespace Disco.Web.Areas.API.Controllers
     public partial class JobPreferencesController : AuthorizedDatabaseController
     {
         [DiscoAuthorize(Claims.Config.JobPreferences.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateInitialCommentsTemplate(string initialCommentsTemplate, bool redirect = false)
         {
             string expression = null;
@@ -32,10 +33,11 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.JobPreferences.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         [DiscoAuthorize(Claims.Config.JobPreferences.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateLongRunningJobDaysThreshold(int LongRunningJobDaysThreshold, bool redirect = false)
         {
             Database.DiscoConfiguration.JobPreferences.LongRunningJobDaysThreshold = LongRunningJobDaysThreshold;
@@ -44,10 +46,11 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.JobPreferences.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         [DiscoAuthorize(Claims.Config.JobPreferences.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateStaleJobMinutesThreshold(int StaleJobMinutesThreshold, bool redirect = false)
         {
             Database.DiscoConfiguration.JobPreferences.StaleJobMinutesThreshold = StaleJobMinutesThreshold;
@@ -56,10 +59,11 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.JobPreferences.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         [DiscoAuthorize(Claims.Config.JobPreferences.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateLodgmentIncludeAllAttachmentsByDefault(bool includeAllAttachmentsByDefault, bool redirect = false)
         {
             Database.DiscoConfiguration.JobPreferences.LodgmentIncludeAllAttachmentsByDefault = includeAllAttachmentsByDefault;
@@ -68,10 +72,11 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.JobPreferences.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         [DiscoAuthorize(Claims.Config.JobPreferences.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDefaultNoticeboardTheme(string DefaultNoticeboardTheme, bool redirect = false)
         {
             Database.DiscoConfiguration.JobPreferences.DefaultNoticeboardTheme = DefaultNoticeboardTheme;
@@ -82,10 +87,11 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.JobPreferences.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         [DiscoAuthorize(Claims.Config.JobPreferences.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateLocationMode(LocationModes LocationMode, bool redirect = false)
         {
             Database.DiscoConfiguration.JobPreferences.LocationMode = LocationMode;
@@ -94,13 +100,14 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.JobPreferences.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         [DiscoAuthorize(Claims.Config.JobPreferences.Configure)]
-        public virtual ActionResult UpdateLocationList(string[] LocationList, bool redirect = false)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult UpdateLocationList(string[] locationList, bool redirect = false)
         {
-            var list = LocationList
+            var list = locationList
                 .Where(i => !string.IsNullOrWhiteSpace(i))
                 .Select(i => i.Trim())
                 .Distinct(StringComparer.OrdinalIgnoreCase)
@@ -112,10 +119,11 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.JobPreferences.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         [DiscoAuthorize(Claims.Config.JobPreferences.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult ImportLocationList(string LocationList, bool AutomaticList = false, bool Override = false, bool redirect = false)
         {
             IEnumerable<string> list;
@@ -152,10 +160,11 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.JobPreferences.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         [DiscoAuthorize(Claims.Config.JobPreferences.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateOnCreateExpression(string OnCreateExpression, bool redirect = false)
         {
             string expression = null;
@@ -176,10 +185,11 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.JobPreferences.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         [DiscoAuthorize(Claims.Config.JobPreferences.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateOnDeviceReadyForReturnExpression(string OnDeviceReadyForReturnExpression, bool redirect = false)
         {
             string expression = null;
@@ -200,10 +210,11 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.JobPreferences.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         [DiscoAuthorize(Claims.Config.JobPreferences.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateOnCloseExpression(string OnCloseExpression, bool redirect = false)
         {
             string expression = null;
@@ -224,7 +235,7 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.JobPreferences.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
     }
 }

Disco.Web/Areas/API/Controllers/JobQueueController.cs

@@ -20,6 +20,7 @@ namespace Disco.Web.Areas.API.Controllers
         const string pDefaultSLAExpiry = "defaultslaexpiry";
 
         [DiscoAuthorize(Claims.Config.JobQueue.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(int id, string key, string value = null, bool? redirect = null)
         {
             Authorization.Require(Claims.Config.JobQueue.Configure);
@@ -64,55 +65,62 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     return RedirectToAction(MVC.Config.JobQueue.Index(jobQueue.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         #region Update Shortcut Methods
         [DiscoAuthorize(Claims.Config.JobQueue.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateName(int id, string QueueName = null, bool? redirect = null)
         {
             return Update(id, pName, QueueName, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.JobQueue.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDescription(int id, string Description = null, bool? redirect = null)
         {
             return Update(id, pDescription, Description, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.JobQueue.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdatePriority(int id, string Priority = null, bool? redirect = null)
         {
             return Update(id, pPriority, Priority, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.JobQueue.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDefaultSLAExpiry(int id, string DefaultSLAExpiry = null, bool? redirect = null)
         {
             return Update(id, pDefaultSLAExpiry, DefaultSLAExpiry, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.JobQueue.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateIcon(int id, string Icon = null, bool? redirect = null)
         {
             return Update(id, pIcon, Icon, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.JobQueue.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateIconColour(int id, string IconColour = null, bool? redirect = null)
         {
             return Update(id, pIconColour, IconColour, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.JobQueue.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateIconAndColour(int id, string Icon = null, string IconColour = null, bool redirect = false)
         {
             try
@@ -127,23 +135,24 @@ namespace Disco.Web.Areas.API.Controllers
                 }
                 else
                 {
-                    return Json("Invalid Job Queue Id", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Invalid Job Queue Id");
                 }
                 if (redirect)
                     return RedirectToAction(MVC.Config.JobQueue.Index(jobQueue.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         [DiscoAuthorize(Claims.Config.JobQueue.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateSubjects(int id, string[] Subjects = null, bool redirect = false)
         {
             try
@@ -158,23 +167,24 @@ namespace Disco.Web.Areas.API.Controllers
                 }
                 else
                 {
-                    return Json("Invalid Job Queue Id", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Invalid Job Queue Id");
                 }
                 if (redirect)
                     return RedirectToAction(MVC.Config.JobQueue.Index(jobQueue.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         [DiscoAuthorize(Claims.Config.JobQueue.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateJobSubTypes(int id, List<string> JobSubTypes = null, bool redirect = false)
         {
             try
@@ -186,50 +196,50 @@ namespace Disco.Web.Areas.API.Controllers
                 }
                 else
                 {
-                    return Json("Invalid Job Queue Id", JsonRequestBehavior.AllowGet);
+                    return BadRequest("Invalid Job Queue Id");
                 }
 
                 if (redirect)
                     return RedirectToAction(MVC.Config.JobQueue.Index(jobQueue.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         #endregion
 
         #region Update Properties
-        private void UpdateIconAndColour(JobQueue jobQueue, string Icon, string IconColour)
+        private void UpdateIconAndColour(JobQueue jobQueue, string icon, string iconColour)
         {
-            if (string.IsNullOrWhiteSpace(Icon))
-                throw new ArgumentNullException("Icon");
-            if (string.IsNullOrWhiteSpace(IconColour))
-                throw new ArgumentNullException("IconColour");
+            if (string.IsNullOrWhiteSpace(icon))
+                throw new ArgumentNullException(nameof(icon));
+            if (string.IsNullOrWhiteSpace(iconColour))
+                throw new ArgumentNullException(nameof(iconColour));
 
-            jobQueue.Icon = Icon;
-            jobQueue.IconColour = IconColour;
+            jobQueue.Icon = icon;
+            jobQueue.IconColour = iconColour;
             JobQueueService.UpdateJobQueue(Database, jobQueue);
         }
-        private void UpdateIcon(JobQueue jobQueue, string Icon)
+        private void UpdateIcon(JobQueue jobQueue, string icon)
         {
-            if (string.IsNullOrWhiteSpace(Icon))
+            if (string.IsNullOrWhiteSpace(icon))
                 throw new ArgumentNullException("Icon");
 
-            jobQueue.Icon = Icon;
+            jobQueue.Icon = icon;
             JobQueueService.UpdateJobQueue(Database, jobQueue);
         }
-        private void UpdateIconColour(JobQueue jobQueue, string IconColour)
+        private void UpdateIconColour(JobQueue jobQueue, string iconColour)
         {
-            if (string.IsNullOrWhiteSpace(IconColour))
+            if (string.IsNullOrWhiteSpace(iconColour))
                 throw new ArgumentNullException("IconColour");
 
-            jobQueue.IconColour = IconColour;
+            jobQueue.IconColour = iconColour;
             JobQueueService.UpdateJobQueue(Database, jobQueue);
         }
 
@@ -277,25 +287,25 @@ namespace Disco.Web.Areas.API.Controllers
             JobQueueService.UpdateJobQueue(Database, jobQueue);
         }
 
-        private void UpdateSubjects(JobQueue jobQueue, string[] Subjects)
+        private void UpdateSubjects(JobQueue jobQueue, string[] subjects)
         {
             string subjectIds = null;
 
             // Validate Subjects
-            if (Subjects != null && Subjects.Length > 0)
+            if (subjects != null && subjects.Length > 0)
             {
-                var subjects = Subjects
+                var subjectRecords = subjects
                     .Where(s => !string.IsNullOrWhiteSpace(s))
                     .Select(s => s.Trim())
                     .Select(s => Tuple.Create(s, ActiveDirectory.RetrieveADObject(s, Quick: true)))
                     .Where(s => s.Item2 is ADUserAccount || s.Item2 is ADGroup)
                     .ToList();
-                var invalidSubjects = subjects.Where(s => s.Item2 == null).ToList();
+                var invalidSubjects = subjectRecords.Where(s => s.Item2 == null).ToList();
 
                 if (invalidSubjects.Count > 0)
                     throw new ArgumentException($"Subjects not found: {string.Join(", ", invalidSubjects)}", "Subjects");
 
-                var proposedSubjects = subjects.Select(s => s.Item2.Id).OrderBy(s => s).ToArray();
+                var proposedSubjects = subjectRecords.Select(s => s.Item2.Id).OrderBy(s => s).ToArray();
 
                 subjectIds = string.Join(",", proposedSubjects);
 
@@ -340,6 +350,7 @@ namespace Disco.Web.Areas.API.Controllers
 
         #region Actions
         [DiscoAuthorize(Claims.Config.JobQueue.Delete)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Delete(int id, bool? redirect = false)
         {
             try
@@ -353,7 +364,7 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect.HasValue && redirect.Value)
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(status.SessionId));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 throw new Exception("Invalid Job Queue Id");
             }
@@ -362,7 +373,7 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         #endregion

Disco.Web/Areas/API/Controllers/JobQueueJobController.cs

@@ -16,6 +16,7 @@ namespace Disco.Web.Areas.API.Controllers
         const string pSla = "sla";
         const string pPriority = "priority";
 
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(int id, string key, string value = null, bool? redirect = null)
         {
             try
@@ -52,40 +53,45 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     return Redirect($"{Url.Action(MVC.Job.Show(jobQueueJob.JobId))}#jobDetailTab-Queues");
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         #region Update Shortcut Methods
         [DiscoAuthorizeAny(Claims.Job.Properties.JobQueueProperties.EditAnyComments, Claims.Job.Properties.JobQueueProperties.EditOwnComments)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateAddedComment(int id, string AddedComment = null, bool? redirect = null)
         {
             return Update(id, pAddedComment, AddedComment, redirect);
         }
         [DiscoAuthorizeAny(Claims.Job.Properties.JobQueueProperties.EditAnyComments, Claims.Job.Properties.JobQueueProperties.EditOwnComments)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateRemovedComment(int id, string RemovedComment = null, bool? redirect = null)
         {
             return Update(id, pRemovedComment, RemovedComment, redirect);
         }
         [DiscoAuthorizeAny(Claims.Job.Properties.JobQueueProperties.EditAnySLA, Claims.Job.Properties.JobQueueProperties.EditOwnSLA)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateSla(int id, string SLA = null, bool? redirect = null)
         {
             return Update(id, pSla, SLA, redirect);
         }
         [DiscoAuthorizeAny(Claims.Job.Properties.JobQueueProperties.EditAnyPriority, Claims.Job.Properties.JobQueueProperties.EditOwnPriority)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdatePriority(int id, string Priority = null, bool? redirect = null)
         {
             return Update(id, pPriority, Priority, redirect);
         }
         [DiscoAuthorizeAny(Claims.Job.Properties.JobQueueProperties.EditAnySLA, Claims.Job.Properties.JobQueueProperties.EditOwnSLA,
             Claims.Job.Properties.JobQueueProperties.EditAnyPriority, Claims.Job.Properties.JobQueueProperties.EditOwnPriority)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateSlaAndPriority(int id, string Sla = null, string Priority = null, bool? redirect = null)
         {
             try
@@ -106,14 +112,14 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     return Redirect($"{Url.Action(MVC.Job.Show(jobQueueJob.JobId))}#jobDetailTab-Queues");
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         #endregion
@@ -175,6 +181,7 @@ namespace Disco.Web.Areas.API.Controllers
         #region Actions
 
         [DiscoAuthorizeAny(Claims.Job.Actions.AddAnyQueues, Claims.Job.Actions.AddOwnQueues)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult AddJob(int id, int JobId, string Comment, int? SLAExpiresMinutes, JobQueuePriority Priority)
         {
             DateTime? SLAExpires = (SLAExpiresMinutes.HasValue && SLAExpiresMinutes.Value > 0) ? DateTime.Now.AddMinutes(SLAExpiresMinutes.Value) : (DateTime?)null;
@@ -197,6 +204,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorizeAny(Claims.Job.Actions.RemoveAnyQueues, Claims.Job.Actions.RemoveOwnQueues)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult RemoveJob(int id, string Comment, bool? CloseJob = null)
         {
             Database.Configuration.LazyLoadingEnabled = true;

Disco.Web/Areas/API/Controllers/LoggingController.cs

@@ -21,7 +21,8 @@ namespace Disco.Web.Areas.API.Controllers
             return Json(m, JsonRequestBehavior.AllowGet);
         }
 
-        [HttpPost, ValidateAntiForgeryToken, DiscoAuthorize(Claims.Config.Logging.Show)]
+        [DiscoAuthorize(Claims.Config.Logging.Show)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult RetrieveEvents(string Format, DateTime? Start = null, DateTime? End = null, int? ModuleId = null, List<int> EventTypeIds = null, int? Take = null)
         {
             if (string.Equals(Format, "json", StringComparison.OrdinalIgnoreCase))

Disco.Web/Areas/API/Controllers/PluginController.cs

@@ -31,7 +31,8 @@ namespace Disco.Web.Areas.API.Controllers
             }
         }
 
-        [HttpPost, DiscoAuthorize(Claims.Config.Plugin.Install), ValidateAntiForgeryToken]
+        [DiscoAuthorize(Claims.Config.Plugin.Install)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateAll()
         {
             var status = UpdatePluginTask.UpdateAllPlugins();
@@ -39,7 +40,8 @@ namespace Disco.Web.Areas.API.Controllers
             return RedirectToAction(MVC.Config.Logging.TaskStatus(status.SessionId));
         }
 
-        [HttpPost, DiscoAuthorize(Claims.Config.Plugin.Install), ValidateAntiForgeryToken]
+        [DiscoAuthorize(Claims.Config.Plugin.Install)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(string pluginId)
         {
             if (string.IsNullOrEmpty(pluginId))
@@ -50,7 +52,8 @@ namespace Disco.Web.Areas.API.Controllers
             return RedirectToAction(MVC.Config.Logging.TaskStatus(status.SessionId));
         }
 
-        [HttpPost, DiscoAuthorize(Claims.Config.Plugin.Uninstall), ValidateAntiForgeryToken]
+        [DiscoAuthorize(Claims.Config.Plugin.Uninstall)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Uninstall(string id, bool uninstallData)
         {
             if (string.IsNullOrEmpty(id))
@@ -63,7 +66,8 @@ namespace Disco.Web.Areas.API.Controllers
             return RedirectToAction(MVC.Config.Logging.TaskStatus(status.SessionId));
         }
 
-        [HttpPost, DiscoAuthorize(Claims.Config.Plugin.Install), ValidateAntiForgeryToken]
+        [DiscoAuthorize(Claims.Config.Plugin.Install)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Install(string pluginId)
         {
             if (string.IsNullOrEmpty(pluginId))
@@ -92,7 +96,8 @@ namespace Disco.Web.Areas.API.Controllers
             return RedirectToAction(MVC.Config.Logging.TaskStatus(status.SessionId));
         }
 
-        [HttpPost, DiscoAuthorizeAll(Claims.Config.Plugin.Install, Claims.Config.Plugin.InstallLocal), ValidateAntiForgeryToken]
+        [DiscoAuthorizeAll(Claims.Config.Plugin.Install, Claims.Config.Plugin.InstallLocal)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult InstallLocal(HttpPostedFileBase plugin, bool immediateRestart = false)
         {
             if (plugin == null || plugin.ContentLength <= 0 || string.IsNullOrWhiteSpace(plugin.FileName))

Disco.Web/Areas/API/Controllers/SystemController.cs

@@ -19,6 +19,7 @@ namespace Disco.Web.Areas.API.Controllers
     public partial class SystemController : AuthorizedDatabaseController
     {
         [DiscoAuthorize(Claims.Config.System.Show)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateLastNetworkLogonDates()
         {
             var taskStatus = ADNetworkLogonDatesUpdateTask.ScheduleImmediately();
@@ -27,6 +28,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.DiscoAdminAccount)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateAttachmentThumbnails()
         {
             var ts = Disco.Services.Documents.AttachmentImport.ThumbnailUpdateTask.ScheduleImmediately();
@@ -35,6 +37,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.DiscoAdminAccount)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateADDeviceDescriptions()
         {
             var ts = ADDeviceDescriptionUpdateTask.ScheduleImmediately();
@@ -63,6 +66,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorize(Claims.Config.System.Show)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateCheck()
         {
             var ts = UpdateQueryTask.ScheduleNow();
@@ -70,7 +74,8 @@ namespace Disco.Web.Areas.API.Controllers
             return RedirectToAction(MVC.Config.Logging.TaskStatus(ts.SessionId));
         }
 
-        [HttpPost, ValidateAntiForgeryToken, DiscoAuthorize(Claims.Config.System.Show)]
+        [DiscoAuthorize(Claims.Config.System.Show)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult OnlineServicesConnectStart()
         {
             OnlineServicesConnect.QueueStart();
@@ -82,6 +87,7 @@ namespace Disco.Web.Areas.API.Controllers
 
         #region Organisation Name
         [DiscoAuthorize(Claims.Config.Organisation.ConfigureName)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateOrganisationName(string OrganisationName, bool redirect = false)
         {
             if (string.IsNullOrWhiteSpace(OrganisationName))
@@ -96,7 +102,7 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.Organisation.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
         #endregion
 
@@ -117,7 +123,8 @@ namespace Disco.Web.Areas.API.Controllers
                 }
             }
         }
-        [DiscoAuthorize(Claims.Config.Organisation.ConfigureLogo), HttpPost]
+        [DiscoAuthorize(Claims.Config.Organisation.ConfigureLogo)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult OrganisationLogo(bool redirect, HttpPostedFileBase Image, bool? ResetLogo = null)
         {
             if (ResetLogo.HasValue && ResetLogo.Value)
@@ -127,7 +134,7 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect)
                     return RedirectToAction(MVC.Config.Organisation.Index());
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
 
             if (Image != null && Image.ContentLength > 0)
@@ -139,25 +146,26 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect)
                         return RedirectToAction(MVC.Config.Organisation.Index());
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 else
                 {
                     if (redirect)
                         return RedirectToAction(MVC.Config.Organisation.Index());
                     else
-                        return Json("Invalid Content Type", JsonRequestBehavior.AllowGet);
+                        return BadRequest("Invalid Content Type");
                 }
             }
             if (redirect)
                 return RedirectToAction(MVC.Config.Organisation.Index());
             else
-                return Json("No Image Supplied", JsonRequestBehavior.AllowGet);
+                return BadRequest("No Image Supplied");
         }
         #endregion
 
         #region Organisation Addresses
-        [HttpPost, ValidateAntiForgeryToken, DiscoAuthorize(Claims.Config.Organisation.ConfigureAddresses)]
+        [DiscoAuthorize(Claims.Config.Organisation.ConfigureAddresses)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateOrganisationAddress(Disco.Models.BI.Config.OrganisationAddress organisationAddress, bool redirect = false)
         {
             if (organisationAddress == null)
@@ -171,7 +179,7 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect)
                     return RedirectToAction(MVC.Config.Organisation.Index());
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             else
             {
@@ -193,7 +201,8 @@ namespace Disco.Web.Areas.API.Controllers
                     return Json(em.ToString(), JsonRequestBehavior.AllowGet);
             }
         }
-        [HttpPost, ValidateAntiForgeryToken, DiscoAuthorize(Claims.Config.Organisation.ConfigureAddresses)]
+        [DiscoAuthorize(Claims.Config.Organisation.ConfigureAddresses)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult DeleteOrganisationAddress(int id, bool redirect = false)
         {
             // Remove References in Device Profiles
@@ -207,7 +216,7 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.Organisation.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         #endregion
@@ -215,6 +224,7 @@ namespace Disco.Web.Areas.API.Controllers
         #region MultiSiteMode
 
         [DiscoAuthorize(Claims.Config.Organisation.ConfigureMultiSiteMode)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateMultiSiteMode(bool MultiSiteMode, bool redirect = false)
         {
             Database.DiscoConfiguration.MultiSiteMode = MultiSiteMode;
@@ -226,7 +236,7 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.Organisation.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         #endregion
@@ -236,6 +246,7 @@ namespace Disco.Web.Areas.API.Controllers
         #region Active Directory
 
         [DiscoAuthorize(Claims.Config.System.ConfigureActiveDirectory)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateActiveDirectorySearchScope(List<string> Containers, bool redirect = false)
         {
             ActiveDirectory.Context.UpdateSearchContainers(Database, Containers);
@@ -244,10 +255,11 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.SystemConfig.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         [DiscoAuthorize(Claims.Config.System.ConfigureActiveDirectory)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateActiveDirectorySearchAllServers(bool SearchAllServers, bool redirect = false)
         {
             try
@@ -268,18 +280,19 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect)
                     return RedirectToAction(MVC.Config.SystemConfig.Index());
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         [DiscoAuthorize(Claims.Config.System.ConfigureActiveDirectory)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateActiveDirectorySearchWildcardSuffixOnly(bool SearchWildcardSuffixOnly, bool redirect = false)
         {
             ActiveDirectory.Context.UpdateWildcardSearchSuffixOnly(Database, SearchWildcardSuffixOnly);
@@ -289,7 +302,7 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.SystemConfig.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         [DiscoAuthorizeAny(Claims.Config.System.ConfigureActiveDirectory, Claims.Config.DeviceProfile.Configure)]
@@ -341,7 +354,8 @@ namespace Disco.Web.Areas.API.Controllers
                 return Json(Models.Shared.SubjectDescriptorModel.FromActiveDirectoryObject(subject), JsonRequestBehavior.AllowGet);
         }
 
-        [DiscoAuthorizeAny(Claims.Config.UserFlag.Configure)]
+        [DiscoAuthorizeAny(Claims.Config.UserFlag.Configure, Claims.Config.DeviceFlag.Configure, Claims.Config.DeviceProfile.Configure, Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult SyncActiveDirectoryManagedGroup(string id, string redirectUrl = null)
         {
 
@@ -361,6 +375,7 @@ namespace Disco.Web.Areas.API.Controllers
         #region Proxy Settings
 
         [DiscoAuthorize(Claims.Config.System.ConfigureProxy)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateProxySettings(string ProxyAddress, int? ProxyPort, string ProxyUsername, string ProxyPassword, bool redirect = false)
         {
             // Default Proxy Port
@@ -387,14 +402,15 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.SystemConfig.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         #endregion
 
         #region Email Settings
 
-        [DiscoAuthorize(Claims.Config.System.ConfigureEmail), ValidateInput(false), ValidateAntiForgeryToken]
+        [DiscoAuthorize(Claims.Config.System.ConfigureEmail), ValidateInput(false)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateEmailSettings(string SmtpServer, int? SmtpPort, string FromAddress, string ReplyToAddress, bool EnableSsl, string Username, string Password, bool redirect = false)
         {
             // Default Port
@@ -419,10 +435,11 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.SystemConfig.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
-        [DiscoAuthorize(Claims.Config.System.ConfigureEmail), ValidateAntiForgeryToken]
+        [DiscoAuthorize(Claims.Config.System.ConfigureEmail)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult SendTestEmail(string Recipient, bool redirect = false)
         {
             if (string.IsNullOrWhiteSpace(Recipient))
@@ -433,7 +450,7 @@ namespace Disco.Web.Areas.API.Controllers
             if (redirect)
                 return RedirectToAction(MVC.Config.SystemConfig.Index());
             else
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
         }
 
         #endregion

Disco.Web/Areas/API/Controllers/UserController.cs

@@ -139,7 +139,8 @@ namespace Disco.Web.Areas.API.Controllers
             return HttpNotFound("Invalid Attachment Number");
         }
 
-        [DiscoAuthorize(Claims.User.Actions.AddAttachments), ValidateAntiForgeryToken]
+        [DiscoAuthorize(Claims.User.Actions.AddAttachments)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult AttachmentUpload(string id, string domain, string comments)
         {
             id = ActiveDirectory.ParseDomainAccountId(id, domain);
@@ -224,6 +225,7 @@ namespace Disco.Web.Areas.API.Controllers
         }
 
         [DiscoAuthorizeAny(Claims.User.Actions.RemoveAnyAttachments, Claims.User.Actions.RemoveOwnAttachments)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult AttachmentRemove(int id)
         {
             var ua = Database.UserAttachments.Include("TechUser").Where(m => m.Id == id).FirstOrDefault();
@@ -236,9 +238,9 @@ namespace Disco.Web.Areas.API.Controllers
 
                 ua.OnDelete(Database);
                 Database.SaveChanges();
-                return Json("OK", JsonRequestBehavior.AllowGet);
+                return Ok();
             }
-            return Json("Invalid Attachment Number", JsonRequestBehavior.AllowGet);
+            return BadRequest("Invalid Attachment Number");
         }
 
         [DiscoAuthorize(Claims.User.Actions.AddAttachments)]
@@ -267,44 +269,12 @@ namespace Disco.Web.Areas.API.Controllers
             }
             catch (InvalidOperationException ex)
             {
-                return Json(new
-                {
-                    Success = false,
-                    ErrorMessage = ex.Message,
-                });
+                return BadRequest(ex.Message);
             }
         }
 
         #endregion
 
-        [DiscoAuthorize(Claims.User.Actions.GenerateDocuments)]
-        public virtual ActionResult GeneratePdf(string id, string domain, string DocumentTemplateId)
-        {
-            if (string.IsNullOrEmpty(id))
-                throw new ArgumentNullException(nameof(id));
-            if (string.IsNullOrEmpty(DocumentTemplateId))
-                throw new ArgumentNullException(nameof(DocumentTemplateId));
-
-            var userId = ActiveDirectory.ParseDomainAccountId(id, domain);
-
-            // Obsolete: Use API\DocumentTemplate\Generate instead
-            return RedirectToAction(MVC.API.DocumentTemplate.Generate(DocumentTemplateId, userId));
-        }
-
-        [DiscoAuthorize(Claims.User.Actions.GenerateDocuments)]
-        public virtual ActionResult GeneratePdfPackage(string id, string domain, string DocumentTemplatePackageId)
-        {
-            if (string.IsNullOrEmpty(id))
-                throw new ArgumentNullException(nameof(id));
-            if (string.IsNullOrEmpty(DocumentTemplatePackageId))
-                throw new ArgumentNullException(nameof(DocumentTemplatePackageId));
-
-            var userId = ActiveDirectory.ParseDomainAccountId(id, domain);
-
-            // Obsolete: Use API\DocumentTemplatePackage\Generate instead
-            return RedirectToAction(MVC.API.DocumentTemplatePackage.Generate(DocumentTemplatePackageId, userId));
-        }
-
         public virtual ActionResult Photo(string userId)
         {
             if (string.IsNullOrEmpty(userId))

Disco.Web/Areas/API/Controllers/UserFlagAssignmentController.cs

@@ -40,14 +40,14 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     return Redirect($"{Url.Action(MVC.User.Show(userFlagAssignment.UserId))}#UserDetailTab-Flags");
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 

Disco.Web/Areas/API/Controllers/UserFlagController.cs

@@ -24,6 +24,7 @@ namespace Disco.Web.Areas.API.Controllers
         const string pOnUnassignmentExpression = "onunassignmentexpression";
 
         [DiscoAuthorize(Claims.Config.UserFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Update(int id, string key, string value = null, bool? redirect = null)
         {
             Authorization.Require(Claims.Config.UserFlag.Configure);
@@ -68,93 +69,101 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     return RedirectToAction(MVC.Config.UserFlag.Index(flag.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         #region Update Shortcut Methods
         [DiscoAuthorize(Claims.Config.UserFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateName(int id, string FlagName = null, bool? redirect = null)
         {
             return Update(id, pName, FlagName, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.UserFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateDescription(int id, string Description = null, bool? redirect = null)
         {
             return Update(id, pDescription, Description, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.UserFlag.Configure)]
-        public virtual ActionResult UpdateIcon(int id, string Icon = null, bool? redirect = null)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult UpdateIcon(int id, string icon = null, bool? redirect = null)
         {
-            return Update(id, pIcon, Icon, redirect);
+            return Update(id, pIcon, icon, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.UserFlag.Configure)]
-        public virtual ActionResult UpdateIconColour(int id, string IconColour = null, bool? redirect = null)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult UpdateIconColour(int id, string iconColour = null, bool? redirect = null)
         {
-            return Update(id, pIconColour, IconColour, redirect);
+            return Update(id, pIconColour, iconColour, redirect);
         }
 
         [DiscoAuthorize(Claims.Config.UserFlag.Configure)]
-        public virtual ActionResult UpdateIconAndColour(int id, string Icon = null, string IconColour = null, bool redirect = false)
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult UpdateIconAndColour(int id, string icon = null, string iconColour = null, bool redirect = false)
         {
             try
             {
                 if (id < 0)
-                    throw new ArgumentOutOfRangeException("id");
+                    throw new ArgumentOutOfRangeException(nameof(id));
 
                 var UserFlag = Database.UserFlags.Find(id);
                 if (UserFlag != null)
                 {
-                    UpdateIconAndColour(UserFlag, Icon, IconColour);
+                    UpdateIconAndColour(UserFlag, icon, iconColour);
                 }
                 else
                 {
-                    throw new ArgumentException("Invalid User Flag Id", "id");
+                    throw new ArgumentException("Invalid User Flag Id", nameof(id));
                 }
                 if (redirect)
                     return RedirectToAction(MVC.Config.UserFlag.Index(UserFlag.Id));
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         [DiscoAuthorize(Claims.Config.UserFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateOnAssignmentExpression(int id, string OnAssignmentExpression = null, bool redirect = false)
         {
             return Update(id, pOnAssignmentExpression, OnAssignmentExpression, redirect);
         }
         [DiscoAuthorize(Claims.Config.UserFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateOnUnassignmentExpression(int id, string OnUnassignmentExpression = null, bool redirect = false)
         {
             return Update(id, pOnUnassignmentExpression, OnUnassignmentExpression, redirect);
         }
         [DiscoAuthorize(Claims.Config.UserFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateAssignedUsersLinkedGroup(int id, string GroupId = null, DateTime? FilterBeginDate = null, bool redirect = false)
         {
             try
             {
                 if (id < 0)
-                    throw new ArgumentOutOfRangeException("id");
+                    throw new ArgumentOutOfRangeException(nameof(id));
 
                 var UserFlag = Database.UserFlags.Find(id);
                 if (UserFlag == null)
-                    throw new ArgumentException("Invalid User Flag Id", "id");
+                    throw new ArgumentException("Invalid User Flag Id", nameof(id));
 
 
                 var syncTaskStatus = UpdateAssignedUsersLinkedGroup(UserFlag, GroupId, FilterBeginDate);
@@ -167,27 +176,28 @@ namespace Disco.Web.Areas.API.Controllers
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
                     }
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         [DiscoAuthorize(Claims.Config.UserFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult UpdateAssignedUserDevicesLinkedGroup(int id, string GroupId = null, DateTime? FilterBeginDate = null, bool redirect = false)
         {
             try
             {
                 if (id < 0)
-                    throw new ArgumentOutOfRangeException("id");
+                    throw new ArgumentOutOfRangeException(nameof(id));
 
                 var UserFlag = Database.UserFlags.Find(id);
                 if (UserFlag == null)
-                    throw new ArgumentException("Invalid User Flag Id", "id");
+                    throw new ArgumentException("Invalid User Flag Id", nameof(id));
 
 
                 var syncTaskStatus = UpdateAssignedUserDevicesLinkedGroup(UserFlag, GroupId, FilterBeginDate);
@@ -200,14 +210,14 @@ namespace Disco.Web.Areas.API.Controllers
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(syncTaskStatus.SessionId));
                     }
                 else
-                    return Json("OK", JsonRequestBehavior.AllowGet);
+                    return Ok();
             }
             catch (Exception ex)
             {
                 if (redirect)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
         #endregion
@@ -347,6 +357,7 @@ namespace Disco.Web.Areas.API.Controllers
 
         #region Actions
         [DiscoAuthorizeAll(Claims.Config.UserFlag.Configure, Claims.Config.UserFlag.Delete)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Delete(int id, bool? redirect = false)
         {
             try
@@ -360,7 +371,7 @@ namespace Disco.Web.Areas.API.Controllers
                     if (redirect.HasValue && redirect.Value)
                         return RedirectToAction(MVC.Config.Logging.TaskStatus(status.SessionId));
                     else
-                        return Json("OK", JsonRequestBehavior.AllowGet);
+                        return Ok();
                 }
                 throw new Exception("Invalid User Flag Id");
             }
@@ -369,11 +380,12 @@ namespace Disco.Web.Areas.API.Controllers
                 if (redirect.HasValue && redirect.Value)
                     throw;
                 else
-                    return Json($"Error: {ex.Message}", JsonRequestBehavior.AllowGet);
+                    return BadRequest(ex.Message);
             }
         }
 
         [DiscoAuthorizeAll(Claims.Config.UserFlag.Configure, Claims.User.Actions.AddFlags, Claims.User.Actions.RemoveFlags, Claims.User.ShowFlagAssignments)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult BulkAssignUsers(int id, bool Override, string UserIds = null, string Comments = null)
         {
             if (id < 0)

Disco.Web/Areas/API/Models/DeviceModel/ComponentModel.cs

@@ -1,8 +1,25 @@
-namespace Disco.Web.Areas.API.Models.DeviceModel
+using System.Collections.Generic;
+using System.Linq;
+
+namespace Disco.Web.Areas.API.Models.DeviceModel
 {
     public class ComponentModel
     {
-        public _ComponentModel Component { get; set; }
-        public string Result { get; set; }
+        public int Id { get; set; }
+        public string Description { get; set; }
+        public string Cost { get; set; }
+        public List<string> JobSubTypes { get; set; }
+
+        public static ComponentModel FromDeviceComponent(Disco.Models.Repository.DeviceComponent dc)
+        {
+            return new ComponentModel
+            {
+                Id = dc.Id,
+                Description = dc.Description,
+                Cost = dc.Cost.ToString("C"),
+                JobSubTypes = dc.JobSubTypes.Select(j => $"{j.JobTypeId}_{j.Id}").ToList()
+            };
+
+        }
     }
-}
+}

Disco.Web/Areas/API/Models/DeviceModel/_ComponentModel.cs

@@ -1,25 +0,0 @@
-using System.Collections.Generic;
-using System.Linq;
-
-namespace Disco.Web.Areas.API.Models.DeviceModel
-{
-    public class _ComponentModel
-    {
-        public int Id { get; set; }
-        public string Description { get; set; }
-        public string Cost { get; set; }
-        public List<string> JobSubTypes { get; set; }
-
-        public static _ComponentModel FromDeviceComponent(Disco.Models.Repository.DeviceComponent dc)
-        {
-            return new _ComponentModel
-            {
-                Id = dc.Id,
-                Description = dc.Description,
-                Cost = dc.Cost.ToString("C"),
-                JobSubTypes = dc.JobSubTypes.Select(j => $"{j.JobTypeId}_{j.Id}").ToList()
-            };
-
-        }
-    }
-}

Disco.Web/Areas/API/Models/Job/ComponentModel.cs

@@ -2,7 +2,18 @@
 {
     public class ComponentModel
     {
-        public _ComponentModel Component { get; set; }
-        public string Result { get; set; }
+        public int Id { get; set; }
+        public string Description { get; set; }
+        public string Cost { get; set; }
+
+        public static ComponentModel FromJobComponent(Disco.Models.Repository.JobComponent jc)
+        {
+            return new ComponentModel
+            {
+                Id = jc.Id,
+                Description = jc.Description,
+                Cost = jc.Cost.ToString("C")
+            };
+        }
     }
 }

Disco.Web/Areas/API/Models/Job/_ComponentModel.cs

@@ -1,19 +0,0 @@
-namespace Disco.Web.Areas.API.Models.Job
-{
-    public class _ComponentModel
-    {
-        public int Id { get; set; }
-        public string Description { get; set; }
-        public string Cost { get; set; }
-
-        public static _ComponentModel FromJobComponent(Disco.Models.Repository.JobComponent jc)
-        {
-            return new _ComponentModel
-            {
-                Id = jc.Id,
-                Description = jc.Description,
-                Cost = jc.Cost.ToString("C")
-            };
-        }
-    }
-}

Disco.Web/Areas/Config/Controllers/AuthorizationRoleController.cs

@@ -17,6 +17,7 @@ namespace Disco.Web.Areas.Config.Controllers
     [DiscoAuthorize(Claims.DiscoAdminAccount)]
     public partial class AuthorizationRoleController : AuthorizedDatabaseController
     {
+        [HttpGet]
         public virtual ActionResult Index(int? id)
         {
             if (id.HasValue)
@@ -72,13 +73,11 @@ namespace Disco.Web.Areas.Config.Controllers
             }
         }
 
+        [HttpGet]
         public virtual ActionResult Create()
         {
             // Default Role
-            var m = new Models.AuthorizationRole.CreateModel()
-            {
-                AuthorizationRole = new Disco.Models.Repository.AuthorizationRole()
-            };
+            var m = new Models.AuthorizationRole.CreateModel();
 
             // UI Extensions
             UIExtensions.ExecuteExtensions<ConfigAuthorizationRoleCreateModel>(ControllerContext, m);
@@ -86,16 +85,16 @@ namespace Disco.Web.Areas.Config.Controllers
             return View(m);
         }
 
-        [HttpPost]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Create(Models.AuthorizationRole.CreateModel model)
         {
             if (ModelState.IsValid)
             {
                 // Check for Existing
-                var existing = Database.AuthorizationRoles.Where(m => m.Name == model.AuthorizationRole.Name).FirstOrDefault();
+                var existing = Database.AuthorizationRoles.Where(m => m.Name == model.Name).FirstOrDefault();
                 if (existing == null)
                 {
-                    var roleId = UserService.CreateAuthorizationRole(Database, model.AuthorizationRole);
+                    var roleId = UserService.CreateAuthorizationRole(Database, model.Name);
 
                     return RedirectToAction(MVC.Config.AuthorizationRole.Index(roleId));
                 }

Disco.Web/Areas/Config/Controllers/DeviceBatchController.cs

@@ -6,6 +6,7 @@ using Disco.Services.Devices;
 using Disco.Services.Devices.ManagedGroups;
 using Disco.Services.Plugins.Features.UIExtension;
 using Disco.Services.Web;
+using Disco.Web.Areas.Config.Models.DeviceBatch;
 using System;
 using System.Linq;
 using System.Web.Mvc;
@@ -24,7 +25,7 @@ namespace Disco.Web.Areas.Config.Controllers
                 var m = Database.DeviceBatches
                     .Include(nameof(DeviceBatch.DeviceBatchAttachments))
                     .Where(db => db.Id == id.Value)
-                    .Select(db => new Models.DeviceBatch.ShowModel()
+                    .Select(db => new ShowModel()
                     {
                         DeviceBatch = db,
                         DeviceCount = db.Devices.Count(),
@@ -34,7 +35,7 @@ namespace Disco.Web.Areas.Config.Controllers
                 if (m == null || m.DeviceBatch == null)
                     throw new ArgumentException("Invalid Device Batch Id", "id");
 
-                m.DeviceModelMembers = m.DeviceBatch.Devices.GroupBy(d => d.DeviceModel).Select(dG => new Models.DeviceBatch._ShowModelMembership()
+                m.DeviceModelMembers = m.DeviceBatch.Devices.GroupBy(d => d.DeviceModel).Select(dG => new _ShowModelMembership()
                 {
                     DeviceModel = dG.Key,
                     DeviceCount = dG.Count(),
@@ -82,9 +83,9 @@ namespace Disco.Web.Areas.Config.Controllers
         public virtual ActionResult Create()
         {
             // Default Batch
-            var m = new Models.DeviceBatch.CreateModel()
+            var m = new CreateModel()
             {
-                DeviceBatch = DeviceBatches.DefaultNewDeviceBatch(Database)
+                PurchaseDate = DateTime.Today,
             };
 
             // UI Extensions
@@ -93,22 +94,28 @@ namespace Disco.Web.Areas.Config.Controllers
             return View(m);
         }
 
-        [DiscoAuthorizeAll(Claims.Config.DeviceBatch.Create, Claims.Config.DeviceBatch.Configure), HttpPost]
-        public virtual ActionResult Create(Models.DeviceBatch.CreateModel model)
+        [DiscoAuthorizeAll(Claims.Config.DeviceBatch.Create, Claims.Config.DeviceBatch.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult Create(CreateModel model)
         {
             if (ModelState.IsValid)
             {
                 // Check for Existing
-                var existing = Database.DeviceBatches.Where(m => m.Name == model.DeviceBatch.Name).FirstOrDefault();
-                if (existing == null)
+                var alreadyExists = Database.DeviceBatches.Any(m => m.Name == model.Name);
+                if (!alreadyExists)
                 {
-                    Database.DeviceBatches.Add(model.DeviceBatch);
+                    var batch = new DeviceBatch()
+                    {
+                        Name = model.Name,
+                        PurchaseDate = model.PurchaseDate,
+                    };
+                    Database.DeviceBatches.Add(batch);
                     Database.SaveChanges();
-                    return RedirectToAction(MVC.Config.DeviceBatch.Index(model.DeviceBatch.Id));
+                    return RedirectToAction(MVC.Config.DeviceBatch.Index(batch.Id));
                 }
                 else
                 {
-                    ModelState.AddModelError("Name", "A Device Batch with this name already exists.");
+                    ModelState.AddModelError(nameof(CreateModel.Name), "A Device Batch with this name already exists.");
                 }
             }
 
@@ -121,7 +128,7 @@ namespace Disco.Web.Areas.Config.Controllers
         [DiscoAuthorize(Claims.Config.DeviceBatch.ShowTimeline)]
         public virtual ActionResult Timeline()
         {
-            var m = new Models.DeviceBatch.TimelineModel();
+            var m = new TimelineModel();
 
             // UI Extensions
             UIExtensions.ExecuteExtensions<ConfigDeviceBatchTimelineModel>(ControllerContext, m);

Disco.Web/Areas/Config/Controllers/DeviceFlagController.cs

@@ -79,14 +79,7 @@ namespace Disco.Web.Areas.Config.Controllers
         public virtual ActionResult Create()
         {
             // Default Queue
-            var m = new CreateModel()
-            {
-                DeviceFlag = new DeviceFlag()
-                {
-                    Icon = DeviceFlagService.RandomUnusedIcon(),
-                    IconColour = DeviceFlagService.RandomUnusedThemeColour()
-                }
-            };
+            var m = new CreateModel();
 
             // UI Extensions
             UIExtensions.ExecuteExtensions<ConfigDeviceFlagCreateModel>(ControllerContext, m);
@@ -94,16 +87,17 @@ namespace Disco.Web.Areas.Config.Controllers
             return View(m);
         }
 
-        [DiscoAuthorizeAll(Claims.Config.DeviceFlag.Create, Claims.Config.DeviceFlag.Configure), HttpPost]
+        [DiscoAuthorizeAll(Claims.Config.DeviceFlag.Create, Claims.Config.DeviceFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Create(CreateModel model)
         {
             if (ModelState.IsValid)
             {
                 // Check for Existing
-                var existing = Database.DeviceFlags.Where(m => m.Name == model.DeviceFlag.Name).FirstOrDefault();
+                var existing = Database.DeviceFlags.Where(m => m.Name == model.Name).FirstOrDefault();
                 if (existing == null)
                 {
-                    var flag = DeviceFlagService.CreateDeviceFlag(Database, model.DeviceFlag);
+                    var flag = DeviceFlagService.CreateDeviceFlag(Database, model.Name, model.Description);
 
                     return RedirectToAction(MVC.Config.DeviceFlag.Index(flag.Id));
                 }

Disco.Web/Areas/Config/Controllers/DeviceProfileController.cs

@@ -105,18 +105,10 @@ namespace Disco.Web.Areas.Config.Controllers
         }
 
         [DiscoAuthorizeAll(Claims.Config.DeviceProfile.Create, Claims.Config.DeviceProfile.Configure)]
+        [HttpGet]
         public virtual ActionResult Create()
         {
-            var m = new Models.DeviceProfile.CreateModel()
-            {
-                DeviceProfile = new DeviceProfile()
-                {
-                    ComputerNameTemplate = DeviceProfile.DefaultComputerNameTemplate,
-                    ProvisionADAccount = true,
-                    DistributionType = DeviceProfile.DistributionTypes.OneToMany,
-                    OrganisationalUnit = ActiveDirectory.Context.PrimaryDomain.DefaultComputerContainer
-                }
-            };
+            var m = new Models.DeviceProfile.CreateModel();
 
             // UI Extensions
             UIExtensions.ExecuteExtensions<ConfigDeviceProfileCreateModel>(ControllerContext, m);
@@ -124,20 +116,30 @@ namespace Disco.Web.Areas.Config.Controllers
             return View(m);
         }
 
-        [DiscoAuthorizeAll(Claims.Config.DeviceProfile.Create, Claims.Config.DeviceProfile.Configure), HttpPost]
+        [DiscoAuthorizeAll(Claims.Config.DeviceProfile.Create, Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Create(Models.DeviceProfile.CreateModel model)
         {
             if (ModelState.IsValid)
             {
                 // Check for Existing
-                var existing = Database.DeviceProfiles.Where(m => m.Name == model.DeviceProfile.Name).FirstOrDefault();
-                if (existing == null)
+                var existingName = Database.DeviceProfiles.Any(m => m.Name.Equals(model.Name, StringComparison.OrdinalIgnoreCase));
+                if (!existingName)
                 {
-                    model.DeviceProfile.ProvisionADAccount = true;
+                    var deviceProfile = new DeviceProfile()
+                    {
+                        Name = model.Name,
+                        ShortName = model.ShortName,
+                        Description = model.Description,
+                        ProvisionADAccount = true,
+                        ComputerNameTemplate = DeviceProfile.DefaultComputerNameTemplate,
+                        DistributionType = DeviceProfile.DistributionTypes.OneToMany,
+                        OrganisationalUnit = ActiveDirectory.Context.PrimaryDomain.DefaultComputerContainer
+                    };
 
-                    Database.DeviceProfiles.Add(model.DeviceProfile);
+                    Database.DeviceProfiles.Add(deviceProfile);
                     Database.SaveChanges();
-                    return RedirectToAction(MVC.Config.DeviceProfile.Index(model.DeviceProfile.Id));
+                    return RedirectToAction(MVC.Config.DeviceProfile.Index(deviceProfile.Id));
                 }
                 else
                 {

Disco.Web/Areas/Config/Controllers/DocumentTemplateController.cs

@@ -23,7 +23,7 @@ namespace Disco.Web.Areas.Config.Controllers
     public partial class DocumentTemplateController : AuthorizedDatabaseController
     {
         [DiscoAuthorize(Claims.Config.DocumentTemplate.Show)]
-        public virtual ActionResult Index(string id, string bulkGenerateId = null, string bulkGenerateFilename = null)
+        public virtual ActionResult Index(string id, Guid? bulkGenerateId = null, string bulkGenerateFilename = null)
         {
             if (string.IsNullOrEmpty(id))
             {
@@ -76,6 +76,7 @@ namespace Disco.Web.Areas.Config.Controllers
             }
         }
 
+        [DiscoAuthorize(Claims.Config.DocumentTemplate.Show)]
         public virtual ActionResult ShowPackage(string id)
         {
             // Document Template Package
@@ -139,7 +140,8 @@ namespace Disco.Web.Areas.Config.Controllers
             return View(m);
         }
 
-        [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.Create, Claims.Config.DocumentTemplate.Configure), HttpPost]
+        [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.Create, Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Create(CreateModel model)
         {
             model.UpdateModel(Database);
@@ -147,27 +149,30 @@ namespace Disco.Web.Areas.Config.Controllers
             if (ModelState.IsValid)
             {
                 // Check for Existing
-                var existing = Database.DocumentTemplates.Where(m => m.Id == model.DocumentTemplate.Id).FirstOrDefault();
+                var existing = Database.DocumentTemplates.Where(m => m.Id == model.Id).FirstOrDefault();
                 if (existing == null)
                 {
-
-                    Database.DocumentTemplates.Add(model.DocumentTemplate);
-
-                    if (model.DocumentTemplate.Scope == DocumentTemplate.DocumentTemplateScopes.Job)
+                    var template = new DocumentTemplate()
                     {
-                        model.DocumentTemplate.JobSubTypes = model.GetJobSubTypes();
-                    }
+                        Id = model.Id,
+                        Description = model.Description,
+                        Scope = model.Scope,
+                    };
 
+                    if (model.Scope == DocumentTemplate.DocumentTemplateScopes.Job)
+                        template.JobSubTypes = model.GetJobSubTypes();
+
+                    Database.DocumentTemplates.Add(template);
                     Database.SaveChanges();
 
                     // Save Template
-                    model.DocumentTemplate.SavePdfTemplate(Database, model.Template.InputStream);
+                    template.SavePdfTemplate(Database, model.Template.InputStream);
 
-                    return RedirectToAction(MVC.Config.DocumentTemplate.Index(model.DocumentTemplate.Id));
+                    return RedirectToAction(MVC.Config.DocumentTemplate.Index(template.Id));
                 }
                 else
                 {
-                    ModelState.AddModelError("Id", "A Document Template with this Id already exists.");
+                    ModelState.AddModelError(nameof(DocumentTemplate.Id), "A Document Template with this Id already exists.");
                 }
             }
 
@@ -188,18 +193,19 @@ namespace Disco.Web.Areas.Config.Controllers
             return View(m);
         }
 
-        [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.Create, Claims.Config.DocumentTemplate.Configure), HttpPost]
+        [DiscoAuthorizeAll(Claims.Config.DocumentTemplate.Create, Claims.Config.DocumentTemplate.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult CreatePackage(CreatePackageModel model)
         {
             if (ModelState.IsValid)
             {
                 // Check for Existing
-                var existing = DocumentTemplatePackages.GetPackage(model.Package.Id);
+                var existing = DocumentTemplatePackages.GetPackage(model.Id);
                 if (existing == null)
                 {
-                    DocumentTemplatePackages.CreatePackage(model.Package);
+                    DocumentTemplatePackages.CreatePackage(model.Id, model.Description, model.Scope);
 
-                    return RedirectToAction(MVC.Config.DocumentTemplate.ShowPackage(model.Package.Id));
+                    return RedirectToAction(MVC.Config.DocumentTemplate.ShowPackage(model.Id));
                 }
                 else
                 {

Disco.Web/Areas/Config/Controllers/JobQueueController.cs

@@ -78,18 +78,11 @@ namespace Disco.Web.Areas.Config.Controllers
         }
 
         [DiscoAuthorizeAll(Claims.Config.JobQueue.Create, Claims.Config.JobQueue.Configure)]
+        [HttpGet]
         public virtual ActionResult Create()
         {
             // Default Queue
-            var m = new Models.JobQueue.CreateModel()
-            {
-                JobQueue = new JobQueue()
-                {
-                    Icon = JobQueueService.RandomUnusedIcon(),
-                    IconColour = JobQueueService.RandomUnusedThemeColour(),
-                    Priority = JobQueuePriority.Normal
-                }
-            };
+            var m = new Models.JobQueue.CreateModel();
 
             // UI Extensions
             UIExtensions.ExecuteExtensions<ConfigJobQueueCreateModel>(ControllerContext, m);
@@ -97,16 +90,17 @@ namespace Disco.Web.Areas.Config.Controllers
             return View(m);
         }
 
-        [DiscoAuthorizeAll(Claims.Config.JobQueue.Create, Claims.Config.JobQueue.Configure), HttpPost]
+        [DiscoAuthorizeAll(Claims.Config.JobQueue.Create, Claims.Config.JobQueue.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Create(Models.JobQueue.CreateModel model)
         {
             if (ModelState.IsValid)
             {
                 // Check for Existing
-                var existing = Database.JobQueues.Where(m => m.Name == model.JobQueue.Name).FirstOrDefault();
-                if (existing == null)
+                var nameExists = Database.JobQueues.Any(m => m.Name.Equals(model.Name, StringComparison.Ordinal));
+                if (!nameExists)
                 {
-                    var token = JobQueueService.CreateJobQueue(Database, model.JobQueue);
+                    var token = JobQueueService.CreateJobQueue(Database, model.Name, model.Description);
 
                     return RedirectToAction(MVC.Config.JobQueue.Index(token.JobQueue.Id));
                 }

Disco.Web/Areas/Config/Controllers/PluginsController.cs

@@ -23,7 +23,8 @@ namespace Disco.Web.Areas.Config.Controllers
         }
 
         #region Plugin Configuration
-        [DiscoAuthorize(Claims.Config.Plugin.Configure), HttpPost, ValidateInput(false)]
+        [DiscoAuthorize(Claims.Config.Plugin.Configure), ValidateInput(false)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Configure(string PluginId, FormCollection form)
         {
             if (string.IsNullOrEmpty(PluginId))

Disco.Web/Areas/Config/Controllers/UserFlagController.cs

@@ -1,5 +1,4 @@
 using Disco.Models.Areas.Config.UI.UserFlag;
-using Disco.Models.Repository;
 using Disco.Models.Services.Users.UserFlags;
 using Disco.Models.UI.Config.UserFlag;
 using Disco.Services.Authorization;
@@ -76,17 +75,11 @@ namespace Disco.Web.Areas.Config.Controllers
         }
 
         [DiscoAuthorizeAll(Claims.Config.UserFlag.Create, Claims.Config.UserFlag.Configure)]
+        [HttpGet]
         public virtual ActionResult Create()
         {
             // Default Queue
-            var m = new CreateModel()
-            {
-                UserFlag = new UserFlag()
-                {
-                    Icon = UserFlagService.RandomUnusedIcon(),
-                    IconColour = UserFlagService.RandomUnusedThemeColour()
-                }
-            };
+            var m = new CreateModel();
 
             // UI Extensions
             UIExtensions.ExecuteExtensions<ConfigUserFlagCreateModel>(ControllerContext, m);
@@ -94,22 +87,23 @@ namespace Disco.Web.Areas.Config.Controllers
             return View(m);
         }
 
-        [DiscoAuthorizeAll(Claims.Config.UserFlag.Create, Claims.Config.UserFlag.Configure), HttpPost]
+        [DiscoAuthorizeAll(Claims.Config.UserFlag.Create, Claims.Config.UserFlag.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
         public virtual ActionResult Create(CreateModel model)
         {
             if (ModelState.IsValid)
             {
                 // Check for Existing
-                var existing = Database.UserFlags.Where(m => m.Name == model.UserFlag.Name).FirstOrDefault();
-                if (existing == null)
+                var nameExists = Database.UserFlags.Any(m => m.Name.Equals(model.Name, StringComparison.Ordinal));
+                if (!nameExists)
                 {
-                    var flag = UserFlagService.CreateUserFlag(Database, model.UserFlag);
+                    var flag = UserFlagService.CreateUserFlag(Database, model.Name, model.Description);
 
                     return RedirectToAction(MVC.Config.UserFlag.Index(flag.Id));
                 }
                 else
                 {
-                    ModelState.AddModelError("Name", "A User Flag with this name already exists.");
+                    ModelState.AddModelError(nameof(CreateModel.Name), "A User Flag with this name already exists.");
                 }
             }
 

Disco.Web/Areas/Config/Models/AuthorizationRole/CreateModel.cs

@@ -1,9 +1,11 @@
 using Disco.Models.UI.Config.AuthorizationRole;
+using System.ComponentModel.DataAnnotations;
 
 namespace Disco.Web.Areas.Config.Models.AuthorizationRole
 {
     public class CreateModel : ConfigAuthorizationRoleCreateModel
     {
-        public Disco.Models.Repository.AuthorizationRole AuthorizationRole { get; set; }
+        [Required, StringLength(100)]
+        public string Name { get; set; }
     }
 }

Disco.Web/Areas/Config/Models/DeviceBatch/CreateModel.cs

@@ -1,9 +1,15 @@
 using Disco.Models.UI.Config.DeviceBatch;
+using System;
+using System.ComponentModel.DataAnnotations;
 
 namespace Disco.Web.Areas.Config.Models.DeviceBatch
 {
     public class CreateModel : ConfigDeviceBatchCreateModel
     {
-        public Disco.Models.Repository.DeviceBatch DeviceBatch { get; set; }
+        [Required, StringLength(500)]
+        public string Name { get; set; }
+
+        [Required, DisplayFormat(ApplyFormatInEditMode = true, ConvertEmptyStringToNull = true, DataFormatString = "{0:yyyy/MM/dd}", HtmlEncode = false)]
+        public DateTime PurchaseDate { get; set; }
     }
 }

Disco.Web/Areas/Config/Models/DeviceFlag/CreateModel.cs

@@ -1,9 +1,14 @@
 using Disco.Models.UI.Config.DeviceFlag;
+using System.ComponentModel.DataAnnotations;
 
 namespace Disco.Web.Areas.Config.Models.DeviceFlag
 {
     public class CreateModel : ConfigDeviceFlagCreateModel
     {
-        public Disco.Models.Repository.DeviceFlag DeviceFlag { get; set; }
+        [Required, StringLength(100)]
+        public string Name { get; set; }
+
+        [StringLength(500), DataType(DataType.MultilineText)]
+        public string Description { get; set; }
     }
 }

Disco.Web/Areas/Config/Models/DeviceProfile/CreateModel.cs

@@ -1,9 +1,17 @@
 using Disco.Models.UI.Config.DeviceProfile;
+using System.ComponentModel.DataAnnotations;
 
 namespace Disco.Web.Areas.Config.Models.DeviceProfile
 {
     public class CreateModel : ConfigDeviceProfileCreateModel
     {
-        public Disco.Models.Repository.DeviceProfile DeviceProfile { get; set; }
+        [Required, StringLength(100)]
+        public string Name { get; set; }
+
+        [Required, StringLength(10)]
+        public string ShortName { get; set; }
+
+        [StringLength(500), DataType(DataType.MultilineText)]
+        public string Description { get; set; }
     }
 }

Disco.Web/Areas/Config/Models/DocumentTemplate/CreateModel.cs

@@ -10,7 +10,13 @@ namespace Disco.Web.Areas.Config.Models.DocumentTemplate
     [CustomValidation(typeof(CreateModelValidation), "ValidateCreateModel")]
     public class CreateModel : ConfigDocumentTemplateCreateModel
     {
-        public Disco.Models.Repository.DocumentTemplate DocumentTemplate { get; set; }
+        [StringLength(30), Required]
+        public string Id { get; set; }
+
+        [StringLength(250), Required]
+        public string Description { get; set; }
+        [Required, StringLength(6)]
+        public string Scope { get; set; }
 
         [Required]
         public HttpPostedFileBase Template { get; set; }
@@ -21,13 +27,8 @@ namespace Disco.Web.Areas.Config.Models.DocumentTemplate
         public List<Disco.Models.Repository.JobType> JobTypes { get; set; }
         public List<Disco.Models.Repository.JobSubType> JobSubTypes { get; set; }
 
-        public List<string> Scopes
-        {
-            get
-            {
-                return Disco.Models.Repository.DocumentTemplate.DocumentTemplateScopes.ToList();
-            }
-        }
+        public List<string> Scopes =>
+            Disco.Models.Repository.DocumentTemplate.DocumentTemplateScopes.ToList();
 
         public List<Disco.Models.Repository.JobType> GetJobTypes()
         {
@@ -63,7 +64,7 @@ namespace Disco.Web.Areas.Config.Models.DocumentTemplate
         public static ValidationResult ValidateCreateModel(CreateModel model)
         {
 
-            if (model.DocumentTemplate != null && model.DocumentTemplate.Scope == Disco.Models.Repository.DocumentTemplate.DocumentTemplateScopes.Job)
+            if (model.Scope == Disco.Models.Repository.DocumentTemplate.DocumentTemplateScopes.Job)
             {
                 if (model.Types != null && model.SubTypes != null)
                 {

Disco.Web/Areas/Config/Models/DocumentTemplate/CreatePackageModel.cs

@@ -1,20 +1,21 @@
-using Disco.Models.Services.Documents;
+using Disco.Models.Repository;
 using Disco.Models.UI.Config.DocumentTemplate;
 using System.Collections.Generic;
+using System.ComponentModel.DataAnnotations;
 
 namespace Disco.Web.Areas.Config.Models.DocumentTemplate
 {
     public class CreatePackageModel : ConfigDocumentTemplateCreatePackageModel
     {
-        public DocumentTemplatePackage Package { get; set; }
+        [StringLength(30), Required]
+        public string Id { get; set; }
+        [StringLength(250), Required]
+        public string Description { get; set; }
+        [Required]
+        public AttachmentTypes Scope { get; set; }
 
         public List<string> Scopes
-        {
-            get
-            {
-                return Disco.Models.Repository.DocumentTemplate.DocumentTemplateScopes.ToList();
-            }
-        }
+            => Disco.Models.Repository.DocumentTemplate.DocumentTemplateScopes.ToList();
 
     }
 

Disco.Web/Areas/Config/Models/DocumentTemplate/ShowModel.cs

@@ -5,6 +5,7 @@ using Disco.Models.UI.Config.DocumentTemplate;
 using Disco.Services;
 using Disco.Services.Documents.ManagedGroups;
 using Disco.Services.Expressions;
+using System;
 using System.Collections.Generic;
 using System.Linq;
 
@@ -36,7 +37,7 @@ namespace Disco.Web.Areas.Config.Models.DocumentTemplate
         public DocumentTemplateDevicesManagedGroup DevicesLinkedGroup { get; set; }
         public DocumentTemplateUsersManagedGroup UsersLinkedGroup { get; set; }
 
-        public string BulkGenerateDownloadId { get; set; }
+        public Guid? BulkGenerateDownloadId { get; set; }
 
         public string BulkGenerateDownloadFilename { get; set; }
 

Disco.Web/Areas/Config/Models/JobQueue/CreateModel.cs

@@ -1,9 +1,13 @@
 using Disco.Models.UI.Config.JobQueue;
+using System.ComponentModel.DataAnnotations;
 
 namespace Disco.Web.Areas.Config.Models.JobQueue
 {
     public class CreateModel : ConfigJobQueueCreateModel
     {
-        public Disco.Models.Repository.JobQueue JobQueue { get; set; }
+        [Required, StringLength(100)]
+        public string Name { get; set; }
+        [StringLength(500), DataType(DataType.MultilineText)]
+        public string Description { get; set; }
     }
 }

Disco.Web/Areas/Config/Models/UserFlag/CreateModel.cs

@@ -1,9 +1,14 @@
 using Disco.Models.UI.Config.UserFlag;
+using System.ComponentModel.DataAnnotations;
 
 namespace Disco.Web.Areas.Config.Models.UserFlag
 {
     public class CreateModel : ConfigUserFlagCreateModel
     {
-        public Disco.Models.Repository.UserFlag UserFlag { get; set; }
+        [Required, StringLength(100)]
+        public string Name { get; set; }
+
+        [StringLength(500), DataType(DataType.MultilineText)]
+        public string Description { get; set; }
     }
 }

Disco.Web/Areas/Config/Views/AuthorizationRole/Create.cshtml

@@ -4,7 +4,8 @@
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Authorization Roles", MVC.Config.AuthorizationRole.Index(null), "Create");
 }
 @using (Html.BeginForm())
-{ 
+{
+    @Html.AntiForgeryToken()
     <div class="form" style="width: 450px">
         <table>
             <tr>
@@ -12,7 +13,7 @@
                     Name:
                 </th>
                 <td>
-                    @Html.EditorFor(model => model.AuthorizationRole.Name)<br />@Html.ValidationMessageFor(model => model.AuthorizationRole.Name)
+                    @Html.EditorFor(model => model.Name)<br />@Html.ValidationMessageFor(model => model.Name)
                 </td>
             </tr>
         </table>
@@ -22,7 +23,7 @@
     </div>
     <script type="text/javascript">
         $(function () {
-            $('#AuthorizationRole_Name').focus().select();
+            $('#Name').focus().select();
         });
     </script>
 }

Disco.Web/Areas/Config/Views/AuthorizationRole/Create.generated.cs

@@ -57,7 +57,21 @@ WriteLiteral("\r\n");
             
             #line 6 "..\..\Areas\Config\Views\AuthorizationRole\Create.cshtml"
  using (Html.BeginForm())
-{ 
+{
+    
+            
+            #line default
+            #line hidden
+            
+            #line 8 "..\..\Areas\Config\Views\AuthorizationRole\Create.cshtml"
+Write(Html.AntiForgeryToken());
+
+            
+            #line default
+            #line hidden
+            
+            #line 8 "..\..\Areas\Config\Views\AuthorizationRole\Create.cshtml"
+                            
 
             
             #line default
@@ -74,8 +88,8 @@ WriteLiteral(">\r\n        <table>\r\n            <tr>\r\n                <th>\r
 WriteLiteral("                    ");
 
             
-            #line 15 "..\..\Areas\Config\Views\AuthorizationRole\Create.cshtml"
-               Write(Html.EditorFor(model => model.AuthorizationRole.Name));
+            #line 16 "..\..\Areas\Config\Views\AuthorizationRole\Create.cshtml"
+               Write(Html.EditorFor(model => model.Name));
 
             
             #line default
@@ -83,8 +97,8 @@ WriteLiteral("                    ");
 WriteLiteral("<br />");
 
             
-            #line 15 "..\..\Areas\Config\Views\AuthorizationRole\Create.cshtml"
-                                                                           Write(Html.ValidationMessageFor(model => model.AuthorizationRole.Name));
+            #line 16 "..\..\Areas\Config\Views\AuthorizationRole\Create.cshtml"
+                                                         Write(Html.ValidationMessageFor(model => model.Name));
 
             
             #line default
@@ -107,11 +121,11 @@ WriteLiteral("    <script");
 
 WriteLiteral(" type=\"text/javascript\"");
 
-WriteLiteral(">\r\n        $(function () {\r\n            $(\'#AuthorizationRole_Name\').focus().sele" +
-"ct();\r\n        });\r\n    </script>\r\n");
+WriteLiteral(">\r\n        $(function () {\r\n            $(\'#Name\').focus().select();\r\n        });" +
+"\r\n    </script>\r\n");
 
             
-            #line 28 "..\..\Areas\Config\Views\AuthorizationRole\Create.cshtml"
+            #line 29 "..\..\Areas\Config\Views\AuthorizationRole\Create.cshtml"
 }
 
             

Disco.Web/Areas/Config/Views/AuthorizationRole/Index.cshtml

@@ -7,15 +7,17 @@
 {
     <div class="form" style="width: 450px; padding: 100px 0;">
         <h2>No authorization roles are configured</h2>
-    </div>  
+    </div>
 }
 else
 {
     <table class="tableData">
         <tr>
-            <th>Name
+            <th>
+                Name
             </th>
-            <th>Linked Groups/Users
+            <th>
+                Linked Groups/Users
             </th>
         </tr>
         @foreach (var item in Model.Tokens)
@@ -39,58 +41,75 @@ else
     </table>
 }
 <!-- #region Administrator Subjects -->
-<div id="Config_AuthRoles_Subjects_Update_Dialog" class="dialog" title="Disco ICT Administrators">
-    <div id="Config_AuthRoles_Subjects_Update_Dialog_ListContainer">
-        <span id="Config_AuthRoles_Subjects_Update_Dialog_None" class="smallMessage">None Associated</span>
-        <ul id="Config_AuthRoles_Subjects_Update_Dialog_List" class="none">
-            @foreach (var sg in Model.AdministratorSubjects)
-            {
-                var displayName = sg.Id == sg.Name ? sg.Id : string.Format("{0} [{1}]", sg.Name, sg.Id);
-                <li class="@(sg.IsGroup ? "group" : "user")" data-subjectid="@sg.Id">@if (sg.IsGroup)
-                                                                                     {
-                    <i class="fa fa-users fa-lg"></i>@displayName
-                                                                                     }
-                                                                                     else
-                                                                                     {
-                    <i class="fa fa-user fa-lg"></i>@displayName
-                                                                                     }<i class="fa fa-times-circle remove"></i></li>
-            }
-        </ul>
-    </div>
+<div id="Config_AuthRoles_Subjects_Update_Dialog" class="dialog" title="Disco ICT Administrators" data-searchsubjectsurl="@(Url.Action(MVC.API.System.SearchSubjects()))" data-subjecturl="@Url.Action(MVC.API.System.Subject())">
+    @using (Html.BeginForm(MVC.API.AuthorizationRole.UpdateAdministratorSubjects(null, true)))
+    {
+        @Html.AntiForgeryToken()
+        <div id="Config_AuthRoles_Subjects_Update_Dialog_ListContainer">
+            <span id="Config_AuthRoles_Subjects_Update_Dialog_None" class="smallMessage">None Associated</span>
+            <ul id="Config_AuthRoles_Subjects_Update_Dialog_List" class="none">
+                @foreach (var sg in Model.AdministratorSubjects)
+                {
+                    var displayName = sg.Id == sg.Name ? sg.Id : string.Format("{0} [{1}]", sg.Name, sg.Id);
+                    <li class="@(sg.IsGroup ? "group" : "user")" data-subjectid="@sg.Id">
+                        <input type="hidden" name="subjects" value="@sg.Id" />
+                        @if (sg.IsGroup)
+                        {
+                            <i class="fa fa-users fa-lg"></i>@displayName
+                        }
+                        else
+                        {
+                            <i class="fa fa-user fa-lg"></i>@displayName
+                        }<i class="fa fa-times-circle remove"></i>
+                    </li>
+                }
+            </ul>
+        </div>
+    }
     <div id="Config_AuthRoles_Subjects_Update_Dialog_AddContainer">
         <input type="text" id="Config_AuthRoles_Subjects_Update_Dialog_TextAdd" />
-        <a id="Config_AuthRoles_Subjects_Update_Dialog_Add" href="#" class="button small">Add</a>
+        <button id="Config_AuthRoles_Subjects_Update_Dialog_Add" type="button" class="button small">Add</button>
     </div>
-    <form id="Config_AuthRoles_Subjects_Update_Dialog_Form" action="@(Url.Action(MVC.API.AuthorizationRole.UpdateAdministratorSubjects(null, true)))" method="post"></form>
 </div>
 <script>
     (function () {
-        var dialog, textAdd, list, noSubjects, form;
+        let dialog = null;
+        let originalList = null;
+        let list = null;
+        let textAdd = null;
+        let noSubjects = null;
 
         function showDialog() {
             if (!dialog) {
+                list = $('#Config_AuthRoles_Subjects_Update_Dialog_List');
+                originalList = list.html();
+                noSubjects = $('#Config_AuthRoles_Subjects_Update_Dialog_None');
+                textAdd = $('#Config_AuthRoles_Subjects_Update_Dialog_TextAdd');
+
                 dialog = $('#Config_AuthRoles_Subjects_Update_Dialog').dialog({
                     resizable: false,
                     modal: true,
                     autoOpen: false,
                     width: 350,
-                    height: 420,
                     buttons: {
                         "Save Changes": saveChanges,
-                        Cancel: cancel
+                        Cancel: function () {
+                            $(this).dialog("close");
+                        }
+                    },
+                    close: function () {
+                        list.html(originalList);
                     }
                 });
 
-                dialog.on('click', '.remove', remove);
-
-                list = $('#Config_AuthRoles_Subjects_Update_Dialog_List');
-                noSubjects = $('#Config_AuthRoles_Subjects_Update_Dialog_None');
-
-                textAdd = $('#Config_AuthRoles_Subjects_Update_Dialog_TextAdd');
+                dialog.on('click', '.remove', function () {
+                    $(this).closest('li').remove();
+                    updateNoSubjects();
+                });
 
                 textAdd.watermark('Search Subjects')
                     .autocomplete({
-                        source: '@(Url.Action(MVC.API.System.SearchSubjects()))',
+                        source: dialog.attr('data-searchsubjectsurl'),
                         minLength: 2,
                         focus: function (e, ui) {
                             textAdd.val(ui.item.Id);
@@ -98,6 +117,7 @@ else
                         },
                         select: function (e, ui) {
                             textAdd.val(ui.item.Id).blur();
+                            $('#Config_AuthRoles_Subjects_Update_Dialog_Add').trigger('click');
                             return false;
                         }
                     }).data('ui-autocomplete')._renderItem = function (ul, item) {
@@ -107,7 +127,7 @@ else
                             .appendTo(ul);
                     };
 
-                $('#Config_AuthRoles_Subjects_Update_Dialog_Add').click(add);
+                $('#Config_AuthRoles_Subjects_Update_Dialog_Add').on('click', add);
             }
 
             dialog.dialog('open');
@@ -116,79 +136,61 @@ else
             return false;
         }
 
-        function cancel() {
-            $(this).dialog("close");
+        async function add() {
+            const id = textAdd.val();
 
-            list.find('li').each(function () {
-                $this = $(this);
-                if ($this.is('[data-subjectstatus="new"]')) {
-                    $this.remove();
-                } else {
-                    if ($this.is('[data-subjectstatus="removed"]')) {
-                        $this.show();
+            try {
+                const body = new FormData();
+                body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                body.append('id', id);
+                const response = await fetch(dialog.attr('data-subjecturl'), {
+                    method: 'POST',
+                    body: body
+                });
+
+                if (response.ok) {
+                    const data = await response.json();
+
+                    if (!data)
+                        throw 'Unknown user id';
+
+                    if (!data.IsGroup && !data.IsUserAccount)
+                        throw data.Name + ' [' + data.Id + '] is a ' + data.Type + '. Only users and groups can be added.';
+
+                    if (list.find('li[data-subjectid="' + data.Id.replace('\\', '\\\\') + '"]').length != 0) {
+                        throw 'That subject has already been added';
                     }
+
+                    const liIcon = $('<i>').addClass('fa fa-lg');
+                    if (data.Type === 'user')
+                        liIcon.addClass('fa-user');
+                    else
+                        liIcon.addClass('fa-users');
+
+                    const li = $('<li>')
+                        .append($('<input>').attr({ type: 'hidden', name: 'subjects', value: data.Id }))
+                        .append(liIcon)
+                        .append($('<span>').text(data.Id == data.Name ? data.Id : data.Name + ' [' + data.Id + ']'))
+                        .append($('<i>').addClass('fa fa-times-circle remove'))
+                        .addClass(data.Type)
+                        .attr('data-subjectid', data.Id)
+                        .attr('data-subjectstatus', 'new');
+
+                    list.append(li);
+                    textAdd.val('');
+
+                    updateNoSubjects();
+                } else {
+                    alert('Error: ' + response.statusText);
                 }
-            });
-        }
 
-        function remove() {
-            $this = $(this).closest('li');
-
-            if ($this.is('[data-subjectstatus="new"]')) {
-                $this.remove();
-            } else {
-                $this.attr('data-subjectstatus', 'removed').hide();
+            } catch (e) {
+                alert('Error: ' + e);
             }
 
-            updateNoSubjects();
             return false;
         }
 
-        function add() {
-            var id = textAdd.val();
-
-            $.ajax({
-                url: '@Url.Action(MVC.API.System.Subject())',
-                method: 'post',
-                data: { Id: id }
-            }).done(function (response) {
-                if (response) {
-                    if (response.IsGroup || response.IsUserAccount) {
-                        if (list.find('li[data-subjectid="' + response.Id.replace('\\', '\\\\') + '"]').length == 0) {
-
-                            var liIcon = $('<i>').addClass('fa fa-lg');
-                            if (response.Type === 'user')
-                                liIcon.addClass('fa-user');
-                            else
-                                liIcon.addClass('fa-users');
-
-                            var li = $('<li>')
-                                .append(liIcon)
-                                .append($('<span>').text(response.Id == response.Name ? response.Id : response.Name + ' [' + response.Id + ']'))
-                                .append($('<i>').addClass('fa fa-times-circle remove'))
-                                .addClass(response.Type)
-                                .attr('data-subjectid', response.Id)
-                                .attr('data-subjectstatus', 'new');
-
-                            list.append(li);
-
-                            updateNoSubjects();
-                        } else {
-                            alert('That subject has already been added');
-                        }
-                    }
-                    else {
-                        alert(response.Name + ' ['+response.Id+'] is a ' + response.Type + '. Only users and groups can be added.');
-                    }
-                } else {
-                    alert('Unknown Id');
-                }
-            }).fail(function (jqXHR, textStatus, errorThrown) {
-                alert('Error: ' + errorThrown);
-            });
-                return false;
-            }
-
         function updateNoSubjects() {
             if (list.find('li:visible').length > 0)
                 noSubjects.hide();
@@ -197,22 +199,9 @@ else
         }
 
         function saveChanges() {
-            var form = $('#Config_AuthRoles_Subjects_Update_Dialog_Form').empty();
-
-            list.find('li[data-subjectstatus!="removed"]').each(function () {
-                var subjectId = $(this).attr('data-subjectid');
-
-                form.append($('<input>').attr({
-                    'name': 'Subjects',
-                    'type': 'hidden'
-                }).val(subjectId));
-
-            }).get();
-
-            form.submit();
-
-            dialog.dialog("disable");
-            dialog.dialog("option", "buttons", null);
+            dialog
+                .dialog("option", "buttons", null)
+                .find('form').trigger('submit');
         }
 
         $(function () {

Disco.Web/Areas/Config/Views/AuthorizationRole/Index.generated.cs

@@ -68,7 +68,7 @@ WriteLiteral(" class=\"form\"");
 
 WriteLiteral(" style=\"width: 450px; padding: 100px 0;\"");
 
-WriteLiteral(">\r\n        <h2>No authorization roles are configured</h2>\r\n    </div>  \r\n");
+WriteLiteral(">\r\n        <h2>No authorization roles are configured</h2>\r\n    </div>\r\n");
 
             
             #line 11 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
@@ -83,17 +83,18 @@ WriteLiteral("    <table");
 
 WriteLiteral(" class=\"tableData\"");
 
-WriteLiteral(">\r\n        <tr>\r\n            <th>Name\r\n            </th>\r\n            <th>Linked " +
-"Groups/Users\r\n            </th>\r\n        </tr>\r\n");
+WriteLiteral(">\r\n        <tr>\r\n            <th>\r\n                Name\r\n            </th>\r\n     " +
+"       <th>\r\n                Linked Groups/Users\r\n            </th>\r\n        </t" +
+"r>\r\n");
 
             
-            #line 21 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+            #line 23 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
         
             
             #line default
             #line hidden
             
-            #line 21 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+            #line 23 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
          foreach (var item in Model.Tokens)
         {
 
@@ -105,7 +106,7 @@ WriteLiteral("            <tr>\r\n                <td>\r\n");
 WriteLiteral("                    ");
 
             
-            #line 25 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+            #line 27 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
                Write(Html.ActionLink(item.Role.Name, MVC.Config.AuthorizationRole.Index(item.Role.Id)));
 
             
@@ -114,13 +115,13 @@ WriteLiteral("                    ");
 WriteLiteral("\r\n                </td>\r\n                <td>\r\n");
 
             
-            #line 28 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+            #line 30 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
                     
             
             #line default
             #line hidden
             
-            #line 28 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+            #line 30 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
                      if (item.SubjectIds.Count == 0)
                     {
 
@@ -134,7 +135,7 @@ WriteLiteral(" class=\"smallMessage\"");
 WriteLiteral(">&lt;None&gt;</span>\r\n");
 
             
-            #line 31 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+            #line 33 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
                     }
                     else
                     {
@@ -143,14 +144,14 @@ WriteLiteral(">&lt;None&gt;</span>\r\n");
             #line default
             #line hidden
             
-            #line 34 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+            #line 36 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
                     Write(string.Join(", ", item.SubjectIds.OrderBy(i => i)));
 
             
             #line default
             #line hidden
             
-            #line 34 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+            #line 36 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
                                                                              
                     }
 
@@ -160,7 +161,7 @@ WriteLiteral(">&lt;None&gt;</span>\r\n");
 WriteLiteral("                </td>\r\n            </tr>\r\n");
 
             
-            #line 38 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+            #line 40 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
         }
 
             
@@ -169,7 +170,7 @@ WriteLiteral("                </td>\r\n            </tr>\r\n");
 WriteLiteral("    </table>\r\n");
 
             
-            #line 40 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+            #line 42 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
 }
 
             
@@ -183,17 +184,69 @@ WriteLiteral(" class=\"dialog\"");
 
 WriteLiteral(" title=\"Disco ICT Administrators\"");
 
-WriteLiteral(">\r\n    <div");
+WriteLiteral(" data-searchsubjectsurl=\"");
+
+            
+            #line 44 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                                                                                                                      Write(Url.Action(MVC.API.System.SearchSubjects()));
+
+            
+            #line default
+            #line hidden
+WriteLiteral("\"");
+
+WriteLiteral(" data-subjecturl=\"");
+
+            
+            #line 44 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                                                                                                                                                                                      Write(Url.Action(MVC.API.System.Subject()));
+
+            
+            #line default
+            #line hidden
+WriteLiteral("\"");
+
+WriteLiteral(">\r\n");
+
+            
+            #line 45 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+    
+            
+            #line default
+            #line hidden
+            
+            #line 45 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+     using (Html.BeginForm(MVC.API.AuthorizationRole.UpdateAdministratorSubjects(null, true)))
+    {
+        
+            
+            #line default
+            #line hidden
+            
+            #line 47 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+   Write(Html.AntiForgeryToken());
+
+            
+            #line default
+            #line hidden
+            
+            #line 47 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                                
+
+            
+            #line default
+            #line hidden
+WriteLiteral("        <div");
 
 WriteLiteral(" id=\"Config_AuthRoles_Subjects_Update_Dialog_ListContainer\"");
 
-WriteLiteral(">\r\n        <span");
+WriteLiteral(">\r\n            <span");
 
 WriteLiteral(" id=\"Config_AuthRoles_Subjects_Update_Dialog_None\"");
 
 WriteLiteral(" class=\"smallMessage\"");
 
-WriteLiteral(">None Associated</span>\r\n        <ul");
+WriteLiteral(">None Associated</span>\r\n            <ul");
 
 WriteLiteral(" id=\"Config_AuthRoles_Subjects_Update_Dialog_List\"");
 
@@ -202,105 +255,127 @@ WriteLiteral(" class=\"none\"");
 WriteLiteral(">\r\n");
 
             
-            #line 46 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-            
+            #line 51 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                
             
             #line default
             #line hidden
             
-            #line 46 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-             foreach (var sg in Model.AdministratorSubjects)
-            {
-                var displayName = sg.Id == sg.Name ? sg.Id : string.Format("{0} [{1}]", sg.Name, sg.Id);
+            #line 51 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                 foreach (var sg in Model.AdministratorSubjects)
+                {
+                    var displayName = sg.Id == sg.Name ? sg.Id : string.Format("{0} [{1}]", sg.Name, sg.Id);
 
             
             #line default
             #line hidden
-WriteLiteral("                <li");
+WriteLiteral("                    <li");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 1809), Tuple.Create("\"", 1849)
+WriteAttribute("class", Tuple.Create(" class=\"", 2136), Tuple.Create("\"", 2176)
             
-            #line 49 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-, Tuple.Create(Tuple.Create("", 1817), Tuple.Create<System.Object, System.Int32>(sg.IsGroup ? "group" : "user"
+            #line 54 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+, Tuple.Create(Tuple.Create("", 2144), Tuple.Create<System.Object, System.Int32>(sg.IsGroup ? "group" : "user"
             
             #line default
             #line hidden
-, 1817), false)
+, 2144), false)
 );
 
 WriteLiteral(" data-subjectid=\"");
 
             
-            #line 49 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-                                                                        Write(sg.Id);
+            #line 54 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                                                                            Write(sg.Id);
 
             
             #line default
             #line hidden
 WriteLiteral("\"");
 
-WriteLiteral(">");
+WriteLiteral(">\r\n                        <input");
+
+WriteLiteral(" type=\"hidden\"");
+
+WriteLiteral(" name=\"subjects\"");
+
+WriteAttribute("value", Tuple.Create(" value=\"", 2264), Tuple.Create("\"", 2278)
+            
+            #line 55 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+, Tuple.Create(Tuple.Create("", 2272), Tuple.Create<System.Object, System.Int32>(sg.Id
+            
+            #line default
+            #line hidden
+, 2272), false)
+);
+
+WriteLiteral(" />\r\n");
 
             
-            #line 49 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-                                                                                      if (sg.IsGroup)
-                                                                                     {
+            #line 56 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                        
+            
+            #line default
+            #line hidden
+            
+            #line 56 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                         if (sg.IsGroup)
+                        {
 
             
             #line default
             #line hidden
-WriteLiteral("                    <i");
+WriteLiteral("                            <i");
 
 WriteLiteral(" class=\"fa fa-users fa-lg\"");
 
 WriteLiteral("></i>");
 
             
-            #line 51 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-                                                     
+            #line 58 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                                                             
             
             #line default
             #line hidden
             
-            #line 51 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-                                                Write(displayName);
+            #line 58 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                                                        Write(displayName);
 
             
             #line default
             #line hidden
             
-            #line 51 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-                                                                 
-                                                                                     }
-                                                                                     else
-                                                                                     {
+            #line 58 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                                                                         
+                        }
+                        else
+                        {
 
             
             #line default
             #line hidden
-WriteLiteral("                    <i");
+WriteLiteral("                            <i");
 
 WriteLiteral(" class=\"fa fa-user fa-lg\"");
 
 WriteLiteral("></i>");
 
             
-            #line 55 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-                                                    
+            #line 62 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                                                            
             
             #line default
             #line hidden
             
-            #line 55 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-                                               Write(displayName);
+            #line 62 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                                                       Write(displayName);
 
             
             #line default
             #line hidden
             
-            #line 55 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-                                                                
-                                                                                     }
+            #line 62 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                                                                        
+                        }
             
             #line default
             #line hidden
@@ -308,16 +383,25 @@ WriteLiteral("<i");
 
 WriteLiteral(" class=\"fa fa-times-circle remove\"");
 
-WriteLiteral("></i></li>\r\n");
+WriteLiteral("></i>\r\n                    </li>\r\n");
 
             
-            #line 57 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-            }
+            #line 65 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+                }
 
             
             #line default
             #line hidden
-WriteLiteral("        </ul>\r\n    </div>\r\n    <div");
+WriteLiteral("            </ul>\r\n        </div>\r\n");
+
+            
+            #line 68 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+    }
+
+            
+            #line default
+            #line hidden
+WriteLiteral("    <div");
 
 WriteLiteral(" id=\"Config_AuthRoles_Subjects_Update_Dialog_AddContainer\"");
 
@@ -327,136 +411,81 @@ WriteLiteral(" type=\"text\"");
 
 WriteLiteral(" id=\"Config_AuthRoles_Subjects_Update_Dialog_TextAdd\"");
 
-WriteLiteral(" />\r\n        <a");
+WriteLiteral(" />\r\n        <button");
 
 WriteLiteral(" id=\"Config_AuthRoles_Subjects_Update_Dialog_Add\"");
 
-WriteLiteral(" href=\"#\"");
+WriteLiteral(" type=\"button\"");
 
 WriteLiteral(" class=\"button small\"");
 
-WriteLiteral(">Add</a>\r\n    </div>\r\n    <form");
-
-WriteLiteral(" id=\"Config_AuthRoles_Subjects_Update_Dialog_Form\"");
-
-WriteAttribute("action", Tuple.Create(" action=\"", 2880), Tuple.Create("\"", 2969)
-            
-            #line 64 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-, Tuple.Create(Tuple.Create("", 2889), Tuple.Create<System.Object, System.Int32>(Url.Action(MVC.API.AuthorizationRole.UpdateAdministratorSubjects(null, true))
-            
-            #line default
-            #line hidden
-, 2889), false)
-);
-
-WriteLiteral(" method=\"post\"");
-
-WriteLiteral(@"></form>
-</div>
-<script>
-    (function () {
-        var dialog, textAdd, list, noSubjects, form;
-
-        function showDialog() {
-            if (!dialog) {
-                dialog = $('#Config_AuthRoles_Subjects_Update_Dialog').dialog({
-                    resizable: false,
-                    modal: true,
-                    autoOpen: false,
-                    width: 350,
-                    height: 420,
-                    buttons: {
-                        ""Save Changes"": saveChanges,
-                        Cancel: cancel
-                    }
-                });
-
-                dialog.on('click', '.remove', remove);
-
-                list = $('#Config_AuthRoles_Subjects_Update_Dialog_List');
-                noSubjects = $('#Config_AuthRoles_Subjects_Update_Dialog_None');
-
-                textAdd = $('#Config_AuthRoles_Subjects_Update_Dialog_TextAdd');
-
-                textAdd.watermark('Search Subjects')
-                    .autocomplete({
-                        source: '");
-
-            
-            #line 93 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-                             Write(Url.Action(MVC.API.System.SearchSubjects()));
-
-            
-            #line default
-            #line hidden
-WriteLiteral("\',\r\n                        minLength: 2,\r\n                        focus: functio" +
-"n (e, ui) {\r\n                            textAdd.val(ui.item.Id);\r\n             " +
-"               return false;\r\n                        },\r\n                      " +
-"  select: function (e, ui) {\r\n                            textAdd.val(ui.item.Id" +
-").blur();\r\n                            return false;\r\n                        }\r" +
-"\n                    }).data(\'ui-autocomplete\')._renderItem = function (ul, item" +
-") {\r\n                        return $(\"<li></li>\")\r\n                            " +
-".data(\"item.autocomplete\", item)\r\n                            .append(\"<a><stron" +
-"g>\" + item.Name + \"</strong><br>\" + item.Id + \" (\" + item.Type + \")</a>\")\r\n     " +
-"                       .appendTo(ul);\r\n                    };\r\n\r\n               " +
-" $(\'#Config_AuthRoles_Subjects_Update_Dialog_Add\').click(add);\r\n            }\r\n\r" +
-"\n            dialog.dialog(\'open\');\r\n\r\n            updateNoSubjects();\r\n        " +
-"    return false;\r\n        }\r\n\r\n        function cancel() {\r\n            $(this)" +
-".dialog(\"close\");\r\n\r\n            list.find(\'li\').each(function () {\r\n           " +
-"     $this = $(this);\r\n                if ($this.is(\'[data-subjectstatus=\"new\"]\'" +
-")) {\r\n                    $this.remove();\r\n                } else {\r\n           " +
-"         if ($this.is(\'[data-subjectstatus=\"removed\"]\')) {\r\n                    " +
-"    $this.show();\r\n                    }\r\n                }\r\n            });\r\n  " +
-"      }\r\n\r\n        function remove() {\r\n            $this = $(this).closest(\'li\'" +
-");\r\n\r\n            if ($this.is(\'[data-subjectstatus=\"new\"]\')) {\r\n               " +
-" $this.remove();\r\n            } else {\r\n                $this.attr(\'data-subject" +
-"status\', \'removed\').hide();\r\n            }\r\n\r\n            updateNoSubjects();\r\n " +
-"           return false;\r\n        }\r\n\r\n        function add() {\r\n            var" +
-" id = textAdd.val();\r\n\r\n            $.ajax({\r\n                url: \'");
-
-            
-            #line 151 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
-                 Write(Url.Action(MVC.API.System.Subject()));
-
-            
-            #line default
-            #line hidden
-WriteLiteral("\',\r\n                method: \'post\',\r\n                data: { Id: id }\r\n          " +
-"  }).done(function (response) {\r\n                if (response) {\r\n              " +
-"      if (response.IsGroup || response.IsUserAccount) {\r\n                       " +
-" if (list.find(\'li[data-subjectid=\"\' + response.Id.replace(\'\\\\\', \'\\\\\\\\\') + \'\"]\')" +
-".length == 0) {\r\n\r\n                            var liIcon = $(\'<i>\').addClass(\'f" +
-"a fa-lg\');\r\n                            if (response.Type === \'user\')\r\n         " +
-"                       liIcon.addClass(\'fa-user\');\r\n                            " +
-"else\r\n                                liIcon.addClass(\'fa-users\');\r\n\r\n          " +
-"                  var li = $(\'<li>\')\r\n                                .append(li" +
-"Icon)\r\n                                .append($(\'<span>\').text(response.Id == r" +
-"esponse.Name ? response.Id : response.Name + \' [\' + response.Id + \']\'))\r\n       " +
-"                         .append($(\'<i>\').addClass(\'fa fa-times-circle remove\'))" +
-"\r\n                                .addClass(response.Type)\r\n                    " +
-"            .attr(\'data-subjectid\', response.Id)\r\n                              " +
-"  .attr(\'data-subjectstatus\', \'new\');\r\n\r\n                            list.append" +
-"(li);\r\n\r\n                            updateNoSubjects();\r\n                      " +
-"  } else {\r\n                            alert(\'That subject has already been add" +
-"ed\');\r\n                        }\r\n                    }\r\n                    els" +
-"e {\r\n                        alert(response.Name + \' [\'+response.Id+\'] is a \' + " +
-"response.Type + \'. Only users and groups can be added.\');\r\n                    }" +
-"\r\n                } else {\r\n                    alert(\'Unknown Id\');\r\n          " +
-"      }\r\n            }).fail(function (jqXHR, textStatus, errorThrown) {\r\n      " +
-"          alert(\'Error: \' + errorThrown);\r\n            });\r\n                retu" +
-"rn false;\r\n            }\r\n\r\n        function updateNoSubjects() {\r\n            i" +
-"f (list.find(\'li:visible\').length > 0)\r\n                noSubjects.hide();\r\n    " +
-"        else\r\n                noSubjects.show();\r\n        }\r\n\r\n        function " +
-"saveChanges() {\r\n            var form = $(\'#Config_AuthRoles_Subjects_Update_Dia" +
-"log_Form\').empty();\r\n\r\n            list.find(\'li[data-subjectstatus!=\"removed\"]\'" +
-").each(function () {\r\n                var subjectId = $(this).attr(\'data-subject" +
-"id\');\r\n\r\n                form.append($(\'<input>\').attr({\r\n                    \'n" +
-"ame\': \'Subjects\',\r\n                    \'type\': \'hidden\'\r\n                }).val(" +
-"subjectId));\r\n\r\n            }).get();\r\n\r\n            form.submit();\r\n\r\n         " +
-"   dialog.dialog(\"disable\");\r\n            dialog.dialog(\"option\", \"buttons\", nul" +
-"l);\r\n        }\r\n\r\n        $(function () {\r\n            $(\'#Config_AuthRoles_Upda" +
-"teAdministrators\').click(showDialog);\r\n        });\r\n\r\n    })();\r\n</script>\r\n<!--" +
-" #endregion -->\r\n<div");
+WriteLiteral(">Add</button>\r\n    </div>\r\n</div>\r\n<script>\r\n    (function () {\r\n        let dial" +
+"og = null;\r\n        let originalList = null;\r\n        let list = null;\r\n        " +
+"let textAdd = null;\r\n        let noSubjects = null;\r\n\r\n        function showDial" +
+"og() {\r\n            if (!dialog) {\r\n                list = $(\'#Config_AuthRoles_" +
+"Subjects_Update_Dialog_List\');\r\n                originalList = list.html();\r\n   " +
+"             noSubjects = $(\'#Config_AuthRoles_Subjects_Update_Dialog_None\');\r\n " +
+"               textAdd = $(\'#Config_AuthRoles_Subjects_Update_Dialog_TextAdd\');\r" +
+"\n\r\n                dialog = $(\'#Config_AuthRoles_Subjects_Update_Dialog\').dialog" +
+"({\r\n                    resizable: false,\r\n                    modal: true,\r\n   " +
+"                 autoOpen: false,\r\n                    width: 350,\r\n            " +
+"        buttons: {\r\n                        \"Save Changes\": saveChanges,\r\n      " +
+"                  Cancel: function () {\r\n                            $(this).dia" +
+"log(\"close\");\r\n                        }\r\n                    },\r\n              " +
+"      close: function () {\r\n                        list.html(originalList);\r\n  " +
+"                  }\r\n                });\r\n\r\n                dialog.on(\'click\', \'" +
+".remove\', function () {\r\n                    $(this).closest(\'li\').remove();\r\n  " +
+"                  updateNoSubjects();\r\n                });\r\n\r\n                te" +
+"xtAdd.watermark(\'Search Subjects\')\r\n                    .autocomplete({\r\n       " +
+"                 source: dialog.attr(\'data-searchsubjectsurl\'),\r\n               " +
+"         minLength: 2,\r\n                        focus: function (e, ui) {\r\n     " +
+"                       textAdd.val(ui.item.Id);\r\n                            ret" +
+"urn false;\r\n                        },\r\n                        select: function" +
+" (e, ui) {\r\n                            textAdd.val(ui.item.Id).blur();\r\n       " +
+"                     $(\'#Config_AuthRoles_Subjects_Update_Dialog_Add\').trigger(\'" +
+"click\');\r\n                            return false;\r\n                        }\r\n" +
+"                    }).data(\'ui-autocomplete\')._renderItem = function (ul, item)" +
+" {\r\n                        return $(\"<li></li>\")\r\n                            ." +
+"data(\"item.autocomplete\", item)\r\n                            .append(\"<a><strong" +
+">\" + item.Name + \"</strong><br>\" + item.Id + \" (\" + item.Type + \")</a>\")\r\n      " +
+"                      .appendTo(ul);\r\n                    };\r\n\r\n                " +
+"$(\'#Config_AuthRoles_Subjects_Update_Dialog_Add\').on(\'click\', add);\r\n           " +
+" }\r\n\r\n            dialog.dialog(\'open\');\r\n\r\n            updateNoSubjects();\r\n   " +
+"         return false;\r\n        }\r\n\r\n        async function add() {\r\n           " +
+" const id = textAdd.val();\r\n\r\n            try {\r\n                const body = ne" +
+"w FormData();\r\n                body.append(\'__RequestVerificationToken\', documen" +
+"t.body.dataset.antiforgery);\r\n                body.append(\'id\', id);\r\n          " +
+"      const response = await fetch(dialog.attr(\'data-subjecturl\'), {\r\n          " +
+"          method: \'POST\',\r\n                    body: body\r\n                });\r\n" +
+"\r\n                if (response.ok) {\r\n                    const data = await res" +
+"ponse.json();\r\n\r\n                    if (!data)\r\n                        throw \'" +
+"Unknown user id\';\r\n\r\n                    if (!data.IsGroup && !data.IsUserAccoun" +
+"t)\r\n                        throw data.Name + \' [\' + data.Id + \'] is a \' + data." +
+"Type + \'. Only users and groups can be added.\';\r\n\r\n                    if (list." +
+"find(\'li[data-subjectid=\"\' + data.Id.replace(\'\\\\\', \'\\\\\\\\\') + \'\"]\').length != 0) " +
+"{\r\n                        throw \'That subject has already been added\';\r\n       " +
+"             }\r\n\r\n                    const liIcon = $(\'<i>\').addClass(\'fa fa-lg" +
+"\');\r\n                    if (data.Type === \'user\')\r\n                        liIc" +
+"on.addClass(\'fa-user\');\r\n                    else\r\n                        liIco" +
+"n.addClass(\'fa-users\');\r\n\r\n                    const li = $(\'<li>\')\r\n           " +
+"             .append($(\'<input>\').attr({ type: \'hidden\', name: \'subjects\', value" +
+": data.Id }))\r\n                        .append(liIcon)\r\n                        " +
+".append($(\'<span>\').text(data.Id == data.Name ? data.Id : data.Name + \' [\' + dat" +
+"a.Id + \']\'))\r\n                        .append($(\'<i>\').addClass(\'fa fa-times-cir" +
+"cle remove\'))\r\n                        .addClass(data.Type)\r\n                   " +
+"     .attr(\'data-subjectid\', data.Id)\r\n                        .attr(\'data-subje" +
+"ctstatus\', \'new\');\r\n\r\n                    list.append(li);\r\n                    " +
+"textAdd.val(\'\');\r\n\r\n                    updateNoSubjects();\r\n                } e" +
+"lse {\r\n                    alert(\'Error: \' + response.statusText);\r\n            " +
+"    }\r\n\r\n            } catch (e) {\r\n                alert(\'Error: \' + e);\r\n     " +
+"       }\r\n\r\n            return false;\r\n        }\r\n\r\n        function updateNoSub" +
+"jects() {\r\n            if (list.find(\'li:visible\').length > 0)\r\n                " +
+"noSubjects.hide();\r\n            else\r\n                noSubjects.show();\r\n      " +
+"  }\r\n\r\n        function saveChanges() {\r\n            dialog\r\n                .di" +
+"alog(\"option\", \"buttons\", null)\r\n                .find(\'form\').trigger(\'submit\')" +
+";\r\n        }\r\n\r\n        $(function () {\r\n            $(\'#Config_AuthRoles_Update" +
+"Administrators\').click(showDialog);\r\n        });\r\n\r\n    })();\r\n</script>\r\n<!-- #" +
+"endregion -->\r\n<div");
 
 WriteLiteral(" class=\"actionBar\"");
 
@@ -471,7 +500,7 @@ WriteLiteral(" class=\"button\"");
 WriteLiteral(">Update Disco ICT Administrators [");
 
             
-            #line 226 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+            #line 215 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
                                                                                                       Write(Model.AdministratorSubjects.Count);
 
             
@@ -482,7 +511,7 @@ WriteLiteral("]</a>\r\n");
 WriteLiteral("    ");
 
             
-            #line 227 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
+            #line 216 "..\..\Areas\Config\Views\AuthorizationRole\Index.cshtml"
 Write(Html.ActionLinkButton("Create Authorization Role", MVC.Config.AuthorizationRole.Create()));
 
             

Disco.Web/Areas/Config/Views/AuthorizationRole/Show.cshtml

@@ -11,16 +11,19 @@
 <div id="Config_AuthRoles_Show" class="form" style="width: 550px">
     <table>
         <tr>
-            <th style="width: 150px">Id:
+            <th style="width: 150px">
+                Id:
             </th>
             <td>
                 @Html.DisplayFor(model => model.Token.Role.Id)
             </td>
         </tr>
         <tr>
-            <th>Name:
+            <th>
+                Name:
             </th>
-            <td>@Html.EditorFor(model => model.Token.Role.Name)
+            <td>
+                @Html.EditorFor(model => model.Token.Role.Name)
                 @AjaxHelpers.AjaxSave()
                 @AjaxHelpers.AjaxLoader()
                 <script type="text/javascript">
@@ -48,71 +51,87 @@
                         @foreach (var sg in Model.Subjects)
                         {
                             var displayName = sg.Id == sg.Name ? sg.Id : string.Format("{0} [{1}]", sg.Name, sg.Id);
-                            <li class="@(sg.IsGroup ? "group" : "user")">@if (sg.IsGroup)
-                                                                         {
-                                <i class="fa fa-users fa-lg"></i>@displayName
-                                                                         }
-                                                                         else
-                                                                         {
-                                <a href="@(Url.Action(MVC.User.Show(sg.Id)))#UserDetailTab-Authorization"><i class="fa fa-user fa-lg"></i>@displayName</a>
-                                                                         }</li>
+                            <li class="@(sg.IsGroup ? "group" : "user")">
+                                @if (sg.IsGroup)
+                                {
+                                    <i class="fa fa-users fa-lg"></i>@displayName
+                                }
+                                else
+                                {
+                                    <a href="@(Url.Action(MVC.User.Show(sg.Id)))#UserDetailTab-Authorization"><i class="fa fa-user fa-lg"></i>@displayName</a>
+                                }
+                            </li>
                         }
                     </ul>
                 }
                 <div>
                     <a id="Config_AuthRoles_Subjects_Update" href="#" class="button small">Update</a>
-                    <div id="Config_AuthRoles_Subjects_Update_Dialog" class="dialog" title="Authorization Role Linked Groups/Users">
-                        <div id="Config_AuthRoles_Subjects_Update_Dialog_ListContainer">
-                            <span id="Config_AuthRoles_Subjects_Update_Dialog_None" class="smallMessage">None Associated</span>
-                            <ul id="Config_AuthRoles_Subjects_Update_Dialog_List" class="none">
-                                @foreach (var sg in Model.Subjects)
-                                {
-                                    var displayName = sg.Id == sg.Name ? sg.Id : string.Format("{0} [{1}]", sg.Name, sg.Id);
-                                    <li class="@(sg.IsGroup ? "group" : "user")" data-subjectid="@sg.Id">@if (sg.IsGroup)
-                                                                                                         {
-                                        <i class="fa fa-users fa-lg"></i>@displayName
-                                                                                                         }
-                                                                                                         else
-                                                                                                         {
-                                        <i class="fa fa-user fa-lg"></i>@displayName
-                                                                                                         }<i class="fa fa-times-circle remove"></i></li>
-                                }
-                            </ul>
-                        </div>
+                    <div id="Config_AuthRoles_Subjects_Update_Dialog" class="dialog" title="Authorization Role Linked Groups/Users" data-searchsubjectsurl="@(Url.Action(MVC.API.System.SearchSubjects()))" data-subjecturl="@Url.Action(MVC.API.System.Subject())">
+                        @using (Html.BeginForm(MVC.API.AuthorizationRole.UpdateSubjects(Model.Token.Role.Id, null, true)))
+                        {
+                            @Html.AntiForgeryToken()
+                            <div id="Config_AuthRoles_Subjects_Update_Dialog_ListContainer">
+                                <span id="Config_AuthRoles_Subjects_Update_Dialog_None" class="smallMessage">None Associated</span>
+                                <ul id="Config_AuthRoles_Subjects_Update_Dialog_List" class="none">
+                                    @foreach (var sg in Model.Subjects)
+                                    {
+                                        var displayName = sg.Id == sg.Name ? sg.Id : string.Format("{0} [{1}]", sg.Name, sg.Id);
+                                        <li class="@(sg.IsGroup ? "group" : "user")" data-subjectid="@sg.Id">
+                                            <input type="hidden" name="subjects" value="@sg.Id" />
+                                            @if (sg.IsGroup)
+                                            {
+                                                <i class="fa fa-users fa-lg"></i>@displayName
+                                            }
+                                            else
+                                            {
+                                                <i class="fa fa-user fa-lg"></i>@displayName
+                                            }<i class="fa fa-times-circle remove"></i>
+                                        </li>
+                                    }
+                                </ul>
+                            </div>
+                        }
                         <div id="Config_AuthRoles_Subjects_Update_Dialog_AddContainer">
                             <input type="text" id="Config_AuthRoles_Subjects_Update_Dialog_TextAdd" />
-                            <a id="Config_AuthRoles_Subjects_Update_Dialog_Add" href="#" class="button small">Add</a>
+                            <button id="Config_AuthRoles_Subjects_Update_Dialog_Add" type="button" class="button small">Add</button>
                         </div>
-                        <form id="Config_AuthRoles_Subjects_Update_Dialog_Form" action="@(Url.Action(MVC.API.AuthorizationRole.UpdateSubjects(Model.Token.Role.Id, null, true)))" method="post"></form>
                     </div>
                     <script>
-                        (function(){
-                            var dialog, textAdd, list, noSubjects, form;
-                            
-                            function showDialog(){
-                                if (!dialog){
+                        (function () {
+                            let dialog, textAdd, list, originalList, noSubjects;
+
+                            function showDialog() {
+                                if (!dialog) {
+                                    list = $('#Config_AuthRoles_Subjects_Update_Dialog_List');
+                                    originalList = list.html();
+                                    noSubjects = $('#Config_AuthRoles_Subjects_Update_Dialog_None');
+                                    textAdd = $('#Config_AuthRoles_Subjects_Update_Dialog_TextAdd');
+
                                     dialog = $('#Config_AuthRoles_Subjects_Update_Dialog').dialog({
                                         resizable: false,
                                         modal: true,
                                         autoOpen: false,
                                         width: 350,
-                                        height: 420,
                                         buttons: {
                                             "Save Changes": saveChanges,
-                                            Cancel: cancel
+                                            Cancel: function () {
+                                                $(this).dialog("close");
+                                            }
+                                        },
+                                        close: function () {
+                                            list.html(originalList);
                                         }
                                     });
 
-                                    dialog.on('click', '.remove', remove);
+                                    dialog.on('click', '.remove', function () {
+                                        $(this).closest('li').remove();
+                                        updateNoSubjects();
+                                    });
 
-                                    list = $('#Config_AuthRoles_Subjects_Update_Dialog_List');
-                                    noSubjects = $('#Config_AuthRoles_Subjects_Update_Dialog_None');
-
-                                    textAdd = $('#Config_AuthRoles_Subjects_Update_Dialog_TextAdd');
 
                                     textAdd.watermark('Search Subjects')
                                         .autocomplete({
-                                            source: '@(Url.Action(MVC.API.System.SearchSubjects()))',
+                                            source: dialog.attr('data-searchsubjectsurl'),
                                             minLength: 2,
                                             focus: function (e, ui) {
                                                 textAdd.val(ui.item.Id);
@@ -120,6 +139,7 @@
                                             },
                                             select: function (e, ui) {
                                                 textAdd.val(ui.item.Id).blur();
+                                                $('#Config_AuthRoles_Subjects_Update_Dialog_Add').trigger('click');
                                                 return false;
                                             }
                                         }).data('ui-autocomplete')._renderItem = function (ul, item) {
@@ -129,7 +149,7 @@
                                                 .appendTo(ul);
                                         };
 
-                                    $('#Config_AuthRoles_Subjects_Update_Dialog_Add').click(add);
+                                    $('#Config_AuthRoles_Subjects_Update_Dialog_Add').on('click', add);
                                 }
 
                                 dialog.dialog('open');
@@ -138,106 +158,75 @@
                                 return false;
                             }
 
-                            function cancel(){
-                                $(this).dialog("close");
+                            async function add() {
+                                const id = textAdd.val();
 
-                                list.find('li').each(function(){
-                                    $this = $(this);
-                                    if ($this.is('[data-subjectstatus="new"]')){
-                                        $this.remove();
-                                    }else{
-                                        if ($this.is('[data-subjectstatus="removed"]')){
-                                            $this.show();
+                                try {
+                                    const body = new FormData();
+                                    body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                                    body.append('id', id);
+                                    const response = await fetch(dialog.attr('data-subjecturl'), {
+                                        method: 'POST',
+                                        body: body
+                                    });
+
+                                    if (response.ok) {
+                                        const data = await response.json();
+
+                                        if (!data)
+                                            throw 'Unknown user id';
+
+                                        if (!data.IsGroup && !data.IsUserAccount)
+                                            throw data.Name + ' [' + data.Id + '] is a ' + data.Type + '. Only users and groups can be added.';
+
+                                        if (list.find('li[data-subjectid="' + data.Id.replace('\\', '\\\\') + '"]').length != 0) {
+                                            throw 'That subject has already been added';
                                         }
+
+                                        const liIcon = $('<i>').addClass('fa fa-lg');
+                                        if (data.Type === 'user')
+                                            liIcon.addClass('fa-user');
+                                        else
+                                            liIcon.addClass('fa-users');
+
+                                        const li = $('<li>')
+                                            .append($('<input>').attr({ type: 'hidden', name: 'subjects', value: data.Id }))
+                                            .append(liIcon)
+                                            .append($('<span>').text(data.Id == data.Name ? data.Id : data.Name + ' [' + data.Id + ']'))
+                                            .append($('<i>').addClass('fa fa-times-circle remove'))
+                                            .addClass(data.Type)
+                                            .attr('data-subjectid', data.Id)
+                                            .attr('data-subjectstatus', 'new');
+
+                                        list.append(li);
+                                        textAdd.val('');
+
+                                        updateNoSubjects();
+                                    } else {
+                                        alert('Error: ' + response.statusText);
                                     }
-                                });
-                            }
 
-                            function remove(){
-                                $this = $(this).closest('li');
-
-                                if ($this.is('[data-subjectstatus="new"]')){
-                                    $this.remove();
-                                }else{
-                                    $this.attr('data-subjectstatus', 'removed').hide();
+                                } catch (e) {
+                                    alert('Error: ' + e);
                                 }
 
-                                updateNoSubjects();
+                                return false;
                             }
 
-                            function add(){
-                                var id = textAdd.val();
-
-                                $.ajax({
-                                    url: '@Url.Action(MVC.API.System.Subject())',
-                                    method: 'post',
-                                    data: { Id: id }
-                                }).done(function(response){
-                                    if (response){
-                                        if (response.IsGroup || response.IsUserAccount) {
-                                            if (list.find('li[data-subjectid="'+response.Id.replace('\\', '\\\\')+'"]').length == 0){
-                                            
-                                                var liIcon = $('<i>').addClass('fa fa-lg');
-                                                if (response.Type === 'user')
-                                                    liIcon.addClass('fa-user');
-                                                else
-                                                    liIcon.addClass('fa-users');
-
-                                                var li = $('<li>')
-                                                    .append(liIcon)
-                                                    .append($('<span>').text(response.Id == response.Name ?  response.Id : response.Name + ' [' + response.Id + ']'))
-                                                    .append($('<i>').addClass('fa fa-times-circle remove'))
-                                                    .addClass(response.Type)
-                                                    .attr('data-subjectid', response.Id)
-                                                    .attr('data-subjectstatus', 'new');
-
-                                                list.append(li);
-
-                                                updateNoSubjects();                                        
-                                            }else{
-                                                alert('That subject has already been added');
-                                            }
-                                        }else{
-                                            alert(response.Name + ' ['+response.Id+'] is a ' + response.Type + '. Only users and groups can be added.');
-                                        }
-                                    }else{
-                                        alert('Unknown Id');
-                                    }
-                                }).fail(function(jqXHR, textStatus, errorThrown){
-                                    alert('Error: ' + errorThrown);
-                                });
-                                }
-
-                            function updateNoSubjects(){
+                            function updateNoSubjects() {
                                 if (list.find('li:visible').length > 0)
                                     noSubjects.hide();
                                 else
                                     noSubjects.show();
                             }
 
-                            function saveChanges(){
-                                var form = $('#Config_AuthRoles_Subjects_Update_Dialog_Form').empty();
-
-                                list.find('li[data-subjectstatus!="removed"]').each(function(){
-                                    var subjectId = $(this).attr('data-subjectid');
-                                    
-                                    form.append($('<input>').attr({
-                                        'name': 'Subjects',
-                                        'type': 'hidden'
-                                    }).val(subjectId));
-
-                                }).get();
-
-                                form.submit();
-
-                                dialog.dialog("disable");
-                                dialog.dialog("option", "buttons", null);
+                            function saveChanges() {
+                                dialog
+                                    .dialog("option", "buttons", null)
+                                    .find('form').trigger('submit');
                             }
 
-                            $(function(){
-                                $('#Config_AuthRoles_Subjects_Update').click(showDialog);
-                            });
-
+                            $('#Config_AuthRoles_Subjects_Update').click(showDialog);
                         })();
                     </script>
                 </div>
@@ -248,13 +237,16 @@
                 <div id="Config_AuthRoles_Claims_Tree">
                 </div>
                 <div>
-                    <a href="#" id="Config_AuthRoles_Claims_SaveChanges" class="button small disabled">Save Changes</a>@AjaxHelpers.AjaxLoader()
+                    <button type="button" id="Config_AuthRoles_Claims_SaveChanges" class="button small disabled" data-saveurl="@Url.Action(MVC.API.AuthorizationRole.UpdateClaims(Model.Token.Role.Id))">Save Changes</button>@AjaxHelpers.AjaxLoader()
                 </div>
+                <script id="Config_AuthRoles_Claims_NodesJson" type="application/json">
+                    @Html.Raw(Newtonsoft.Json.JsonConvert.SerializeObject(Model.ClaimNavigatorFancyTreeNodes))
+                </script>
                 <script>
-                    (function(){
-                        var claimNodes = @(new HtmlString(Newtonsoft.Json.JsonConvert.SerializeObject(Model.ClaimNavigatorFancyTreeNodes)));
+                    (function () {
+                        var claimNodes = JSON.parse($('#Config_AuthRoles_Claims_NodesJson').html());
 
-                        $(function(){
+                        $(function () {
                             var saveButton = $('#Config_AuthRoles_Claims_SaveChanges');
                             var ajaxLoading = saveButton.next('.ajaxLoading');
 
@@ -262,43 +254,45 @@
                                 source: claimNodes,
                                 checkbox: true,
                                 selectMode: 3,
-                                select: function(){
+                                select: function () {
                                     saveButton.removeClass('disabled');
                                 },
                                 keyboard: false
                             });
 
-                            saveButton.click(function(){
-                                if (!saveButton.is('.disabled')){
-                                    var selectedNodes = tree.fancytree('getTree').getSelectedNodes();
+                            saveButton.on('click', async function () {
+                                if (!saveButton.is('.disabled')) {
+                                    ajaxLoading.show();
 
-                                    var selectedKeys = [];
-                                    for (var i = 0; i < selectedNodes.length; i++) {
-                                        var node = selectedNodes[i];
-                                        if (!node.folder)
-                                            selectedKeys.push(node.key);
-                                    }
+                                    try {
+                                        const body = new FormData();
+                                        body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
 
-                                    ajaxLoading.show()
+                                        var selectedNodes = tree.fancytree('getTree').getSelectedNodes();
 
-                                    $.ajax({
-                                        url: '@Url.Action(MVC.API.AuthorizationRole.UpdateClaims(Model.Token.Role.Id))',
-                                        method: 'post',
-                                        data: { ClaimKeys: selectedKeys },
-                                        traditional: true
-                                    }).done(function(response, result){
-                                        if (result != 'success' || response != 'OK') {
-                                            alert('Unable to save changes:\n' + response);
-                                            ajaxLoading.hide();
-                                        } else {
-                                            saveButton.addClass('disabled');
-                                            ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
+                                        var selectedKeys = [];
+                                        for (var i = 0; i < selectedNodes.length; i++) {
+                                            var node = selectedNodes[i];
+                                            if (!node.folder)
+                                                body.append('claimKeys', node.key);
                                         }
-                                    }).fail(function(jqXHR, textStatus, errorThrown){
-                                        alert('Error: ' + errorThrown);
-                                    });
+
+                                        const response = await fetch(saveButton.attr('data-saveurl'), {
+                                            method: 'POST',
+                                            body: body
+                                        });
+
+                                        if (response.ok) {
+                                            saveButton.addClass('disabled');
+                                            ajaxLoading.next('.ajaxOk').show().delay('fast').fadeOut('slow');
+                                        } else {
+                                            alert('Unable to save changes:\n' + response);
+                                        }
+                                    } catch (e) {
+                                        alert('Error: ' + e);
+                                    }
+                                    ajaxLoading.hide();
                                 }
-                                return false;
                             });
                         });
                     })();
@@ -308,8 +302,12 @@
     </table>
 </div>
 <div class="actionBar">
-    @Html.ActionLinkButton("Delete", MVC.API.AuthorizationRole.Delete(Model.Token.Role.Id, true), "Config_AuthRoles_Actions_Delete_Button")
-    <div id="Config_AuthRoles_Actions_Delete_Dialog" title="Delete this Authorization Role?">
+    <button id="Config_AuthRoles_Actions_Delete_Button" type="button" class="button">Delete</button>
+    <div id="Config_AuthRoles_Actions_Delete_Dialog" class="dialog" title="Delete this Authorization Role?">
+        @using (Html.BeginForm(MVC.API.AuthorizationRole.Delete(Model.Token.Role.Id, true)))
+        {
+            @Html.AntiForgeryToken()
+        }
         <p>
             <i class="fa fa-exclamation-triangle fa-lg warning"></i>
             This item will be permanently deleted and cannot be recovered.<br />
@@ -319,30 +317,28 @@
     </div>
     <script type="text/javascript">
         $(function () {
-            var button = $('#Config_AuthRoles_Actions_Delete_Button');
-            var buttonDialog = $('#Config_AuthRoles_Actions_Delete_Dialog');
-            var buttonLink = button.attr('href');
-            button.attr('href', '#');
-            button.click(function () {
-                buttonDialog.dialog('open');
-                return false;
-            });
-            buttonDialog.dialog({
-                resizable: false,
-                modal: true,
-                autoOpen: false,
-                buttons: {
-                    "Delete": function () {
-                        var $this = $(this);
-                        $this.dialog("disable");
-                        $this.dialog("option", "buttons", null);
-                        window.location.href = buttonLink;
-                    },
-                    Cancel: function () {
-                        $(this).dialog("close");
-                    }
+            let buttonDialog = null;
+            $('#Config_AuthRoles_Actions_Delete_Button').click(function () {
+                if (!buttonDialog) {
+                    buttonDialog = $('#Config_AuthRoles_Actions_Delete_Dialog').dialog({
+                        resizable: false,
+                        modal: true,
+                        autoOpen: false,
+                        buttons: {
+                            "Delete": function () {
+                                $(this)
+                                    .dialog("option", "buttons", null)
+                                    .find('form').trigger('submit');
+                            },
+                            Cancel: function () {
+                                $(this).dialog("close");
+                            }
+                        }
+                    });
                 }
+                buttonDialog.dialog('open');
             });
+
         });
     </script>
 </div>

Disco.Web/Areas/Config/Views/DeviceBatch/Create.cshtml

@@ -4,20 +4,21 @@
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Device Batches", MVC.Config.DeviceBatch.Index(null), "Create");
 }
 @using (Html.BeginForm())
-{ 
+{
+    @Html.AntiForgeryToken()
     @Html.ValidationSummary(false)
     <div class="form" style="width: 450px">
         <table>
             <tr>
                 <th>Name:</th>
                 <td>
-                    @Html.EditorFor(model => model.DeviceBatch.Name)<br />@Html.ValidationMessageFor(model => model.DeviceBatch.Name)
+                    @Html.EditorFor(model => model.Name)<br />@Html.ValidationMessageFor(model => model.Name)
                 </td>
             </tr>
             <tr>
                 <th>Purchase Date:</th>
                 <td>
-                    @Html.EditorFor(model => model.DeviceBatch.PurchaseDate)<br />@Html.ValidationMessageFor(model => model.DeviceBatch.PurchaseDate)
+                    @Html.EditorFor(model => model.PurchaseDate)<br />@Html.ValidationMessageFor(model => model.PurchaseDate)
                 </td>
             </tr>
         </table>
@@ -29,6 +30,7 @@
         $(function () {
             $('#Name').focus().select();
             $('#PurchaseDate').datepicker({
+                minDate: new Date(1900, 1-1, 1),
                 changeYear: true,
                 changeMonth: true,
                 dateFormat: 'yy/mm/dd'

Disco.Web/Areas/Config/Views/DeviceBatch/Create.generated.cs

@@ -57,20 +57,34 @@ WriteLiteral("\r\n");
             
             #line 6 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
  using (Html.BeginForm())
-{ 
+{
     
             
             #line default
             #line hidden
             
             #line 8 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
-Write(Html.ValidationSummary(false));
+Write(Html.AntiForgeryToken());
 
             
             #line default
             #line hidden
             
             #line 8 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
+                            
+    
+            
+            #line default
+            #line hidden
+            
+            #line 9 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
+Write(Html.ValidationSummary(false));
+
+            
+            #line default
+            #line hidden
+            
+            #line 9 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
                                   
 
             
@@ -88,8 +102,8 @@ WriteLiteral(">\r\n        <table>\r\n            <tr>\r\n                <th>Na
 WriteLiteral("                    ");
 
             
-            #line 14 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
-               Write(Html.EditorFor(model => model.DeviceBatch.Name));
+            #line 15 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
+               Write(Html.EditorFor(model => model.Name));
 
             
             #line default
@@ -97,8 +111,8 @@ WriteLiteral("                    ");
 WriteLiteral("<br />");
 
             
-            #line 14 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
-                                                                     Write(Html.ValidationMessageFor(model => model.DeviceBatch.Name));
+            #line 15 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
+                                                         Write(Html.ValidationMessageFor(model => model.Name));
 
             
             #line default
@@ -109,8 +123,8 @@ WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>
 WriteLiteral("                    ");
 
             
-            #line 20 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
-               Write(Html.EditorFor(model => model.DeviceBatch.PurchaseDate));
+            #line 21 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
+               Write(Html.EditorFor(model => model.PurchaseDate));
 
             
             #line default
@@ -118,8 +132,8 @@ WriteLiteral("                    ");
 WriteLiteral("<br />");
 
             
-            #line 20 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
-                                                                             Write(Html.ValidationMessageFor(model => model.DeviceBatch.PurchaseDate));
+            #line 21 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
+                                                                 Write(Html.ValidationMessageFor(model => model.PurchaseDate));
 
             
             #line default
@@ -146,6 +160,7 @@ WriteLiteral(@">
         $(function () {
             $('#Name').focus().select();
             $('#PurchaseDate').datepicker({
+                minDate: new Date(1900, 1-1, 1),
                 changeYear: true,
                 changeMonth: true,
                 dateFormat: 'yy/mm/dd'
@@ -155,7 +170,7 @@ WriteLiteral(@">
 ");
 
             
-            #line 38 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
+            #line 40 "..\..\Areas\Config\Views\DeviceBatch\Create.cshtml"
 }
 
             

Disco.Web/Areas/Config/Views/DeviceBatch/Show.cshtml

@@ -285,7 +285,7 @@
                         </td>
                     </tr>
                 </table>
-                <div id="DeviceBatch_PurchaseDetails_Container">
+                <div id="DeviceBatch_PurchaseDetails_Container" data-updateurl="@(Url.Action(MVC.API.DeviceBatch.UpdatePurchaseDetails(Model.DeviceBatch.Id)))">
                     <div>
                         Details @AjaxHelpers.AjaxLoader("ajaxPurchaseDetails")
                     </div>
@@ -294,50 +294,39 @@
                         @Html.EditorFor(model => model.DeviceBatch.PurchaseDetails)
                         <script type="text/javascript">
                             $(function () {
-                                var model = {
-                                    $field: $('#DeviceBatch_PurchaseDetails'),
-                                    fieldName: 'PurchaseDetails',
-                                    $ajax_loading: null,
-                                    $ajax_ok: null,
-                                    updated: function () {
-                                        if (!model.$ajax_loading)
-                                            model.$ajax_loading = $('#ajax' + model.fieldName + '_loading');
-                                        if (!model.$ajax_ok)
-                                            model.$ajax_ok = $('#ajax' + model.fieldName + '_ok');
-                                        model.$ajax_loading.show();
-                                        var data = {};
-                                        data[model.fieldName] = model.$field.tinymce().getContent();
-                                        $.ajax({
-                                            url: '@(Url.Action(MVC.API.DeviceBatch.UpdatePurchaseDetails(Model.DeviceBatch.Id)))',
-                                            dataType: 'json',
-                                            data: data,
-                                            traditional: true,
-                                            type: 'POST',
-                                            success: function (d) {
-                                                if (d == 'OK') {
-                                                    model.$ajax_loading.hide();
-                                                    model.$ajax_ok.show().delay('fast').fadeOut('slow');
-                                                } else {
-                                                    model.$ajax_loading.hide();
-                                                    alert('Unable to update purchase details: ' + d);
-                                                }
-                                            },
-                                            error: function (jqXHR, textStatus, errorThrown) {
-                                                alert('Unable to update purchase details: ' + errorThrown);
-                                                model.$ajax_loading.hide();
-                                            }
-                                        })
-                                    }
-                                };
+                                const $field = $('#DeviceBatch_PurchaseDetails');
 
-                                model.$field.tinymce({
+                                async function updated() {
+                                    $('#ajaxPurchaseDetails_loading').show();
+                                    try {
+                                        const body = new FormData();
+                                        body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                                        body.append('purchaseDetails', $field.tinymce().getContent())
+
+                                        const response = await fetch($('#DeviceBatch_PurchaseDetails_Container').attr('data-updateurl'), {
+                                            method: 'POST',
+                                            body: body
+                                        });
+
+                                        if (response.ok) {
+                                            $('#ajaxPurchaseDetails_ok').show().delay('fast').fadeOut('slow');
+                                        } else {
+                                            alert('Unable to update purchase details: ' + response.statusText);
+                                        }
+                                    } catch (e) {
+                                        alert('Unable to update purchase details: ' + e);
+                                    }
+                                    $('#ajaxPurchaseDetails_loading').hide();
+                                }
+
+                                $field.tinymce({
                                     theme: 'simple',
                                     add_unload_trigger: false,
                                     schema: "html5",
                                     statusbar: false,
                                     setup: function (ed) {
                                         ed.on('init', function () {
-                                            $(ed.getWin()).blur(model.updated);
+                                            $(ed.getWin()).blur(function () { updated(); });
                                         });
                                     }
                                 });
@@ -390,7 +379,7 @@
                         </td>
                     </tr>
                 </table>
-                <div id="DeviceBatch_WarrantyDetails_Container">
+                <div id="DeviceBatch_WarrantyDetails_Container" data-updateurl="@(Url.Action(MVC.API.DeviceBatch.UpdateWarrantyDetails(Model.DeviceBatch.Id)))">
                     <div>
                         Details @AjaxHelpers.AjaxLoader("ajaxWarrantyDetails")
                     </div>
@@ -399,50 +388,39 @@
                         @Html.EditorFor(model => model.DeviceBatch.WarrantyDetails)
                         <script type="text/javascript">
                             $(function () {
-                                var model = {
-                                    $field: $('#DeviceBatch_WarrantyDetails'),
-                                    fieldName: 'WarrantyDetails',
-                                    $ajax_loading: null,
-                                    $ajax_ok: null,
-                                    updated: function () {
-                                        if (!model.$ajax_loading)
-                                            model.$ajax_loading = $('#ajax' + model.fieldName + '_loading');
-                                        if (!model.$ajax_ok)
-                                            model.$ajax_ok = $('#ajax' + model.fieldName + '_ok');
-                                        model.$ajax_loading.show();
-                                        var data = {};
-                                        data[model.fieldName] = model.$field.tinymce().getContent();
-                                        $.ajax({
-                                            url: '@(Url.Action(MVC.API.DeviceBatch.UpdateWarrantyDetails(Model.DeviceBatch.Id)))',
-                                            dataType: 'json',
-                                            data: data,
-                                            traditional: true,
-                                            type: 'POST',
-                                            success: function (d) {
-                                                if (d == 'OK') {
-                                                    model.$ajax_loading.hide();
-                                                    model.$ajax_ok.show().delay('fast').fadeOut('slow');
-                                                } else {
-                                                    model.$ajax_loading.hide();
-                                                    alert('Unable to update warranty details: ' + d);
-                                                }
-                                            },
-                                            error: function (jqXHR, textStatus, errorThrown) {
-                                                alert('Unable to update warranty details: ' + errorThrown);
-                                                model.$ajax_loading.hide();
-                                            }
-                                        })
-                                    }
-                                };
+                                const $field = $('#DeviceBatch_WarrantyDetails');
 
-                                model.$field.tinymce({
+                                async function updated() {
+                                    $('#ajaxWarrantyDetails_loading').show();
+                                    try {
+                                        const body = new FormData();
+                                        body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                                        body.append('warrantyDetails', $field.tinymce().getContent())
+
+                                        const response = await fetch($('#DeviceBatch_WarrantyDetails_Container').attr('data-updateurl'), {
+                                            method: 'POST',
+                                            body: body
+                                        });
+
+                                        if (response.ok) {
+                                            $('#ajaxWarrantyDetails_ok').show().delay('fast').fadeOut('slow');
+                                        } else {
+                                            alert('Unable to update warranty details: ' + response.statusText);
+                                        }
+                                    } catch (e) {
+                                        alert('Unable to update warranty details: ' + e);
+                                    }
+                                    $('#ajaxWarrantyDetails_loading').hide();
+                                }
+
+                                $field.tinymce({
                                     theme: 'simple',
                                     add_unload_trigger: false,
                                     schema: "html5",
                                     statusbar: false,
                                     setup: function (ed) {
                                         ed.on('init', function () {
-                                            $(ed.getWin()).blur(model.updated);
+                                            $(ed.getWin()).blur(function () { updated(); });
                                         });
                                     }
                                 });
@@ -555,7 +533,7 @@
                         </td>
                     </tr>
                 </table>
-                <div id="DeviceBatch_InsuranceDetails_Container">
+                <div id="DeviceBatch_InsuranceDetails_Container" data-updateurl="@(Url.Action(MVC.API.DeviceBatch.UpdateInsuranceDetails(Model.DeviceBatch.Id)))">
                     <div>
                         Details @AjaxHelpers.AjaxLoader("ajaxInsuranceDetails")
                     </div>
@@ -564,48 +542,38 @@
                         @Html.EditorFor(model => model.DeviceBatch.InsuranceDetails)
                         <script type="text/javascript">
                             $(function () {
-                                var model = {
-                                    $field: $('#DeviceBatch_InsuranceDetails'),
-                                    $ajax_loading: null,
-                                    $ajax_ok: null,
-                                    updated: function () {
-                                        if (!model.$ajax_loading)
-                                            model.$ajax_loading = $('#ajaxInsuranceDetails_loading');
-                                        if (!model.$ajax_ok)
-                                            model.$ajax_ok = $('#ajaxInsuranceDetails_ok');
-                                        model.$ajax_loading.show();
-                                        var data = { InsuranceDetails: model.$field.tinymce().getContent() };
-                                        $.ajax({
-                                            url: '@(Url.Action(MVC.API.DeviceBatch.UpdateInsuranceDetails(Model.DeviceBatch.Id)))',
-                                            dataType: 'json',
-                                            data: data,
-                                            traditional: true,
-                                            type: 'POST',
-                                            success: function (d) {
-                                                if (d == 'OK') {
-                                                    model.$ajax_loading.hide();
-                                                    model.$ajax_ok.show().delay('fast').fadeOut('slow');
-                                                } else {
-                                                    model.$ajax_loading.hide();
-                                                    alert('Unable to update insurance details: ' + d);
-                                                }
-                                            },
-                                            error: function (jqXHR, textStatus, errorThrown) {
-                                                alert('Unable to update insurance details: ' + errorThrown);
-                                                model.$ajax_loading.hide();
-                                            }
-                                        })
-                                    }
-                                };
+                                const $field = $('#DeviceBatch_InsuranceDetails');
+                                async function updated() {
+                                    $('#ajaxInsuranceDetails_loading').show();
+                                    try {
+                                        const body = new FormData();
+                                        body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                                        body.append('insuranceDetails', $field.tinymce().getContent())
 
-                                model.$field.tinymce({
+                                        const response = await fetch($('#DeviceBatch_InsuranceDetails_Container').attr('data-updateurl'), {
+                                            method: 'POST',
+                                            body: body
+                                        });
+
+                                        if (response.ok) {
+                                            $('#ajaxInsuranceDetails_ok').show().delay('fast').fadeOut('slow');
+                                        } else {
+                                            alert('Unable to update insurance details: ' + response.statusText);
+                                        }
+                                    } catch (e) {
+                                        alert('Unable to update insurance details: ' + e);
+                                    }
+                                    $('#ajaxInsuranceDetails_loading').hide();
+                                }
+
+                                $field.tinymce({
                                     theme: 'simple',
                                     add_unload_trigger: false,
                                     schema: "html5",
                                     statusbar: false,
                                     setup: function (ed) {
                                         ed.on('init', function () {
-                                            $(ed.getWin()).blur(model.updated);
+                                            $(ed.getWin()).blur(function () { updated(); });
                                         });
                                     }
                                 });
@@ -622,7 +590,7 @@
                 </div>
             </td>
         </tr>
-        <tr>
+        <tr id="DeviceBatch_Comments_Container" data-updateurl="@(Url.Action(MVC.API.DeviceBatch.UpdateComments(Model.DeviceBatch.Id)))">
             <th>
                 Comments:<br />
                 @AjaxHelpers.AjaxLoader("ajaxComments")
@@ -632,53 +600,43 @@
                 {
                     @Html.EditorFor(model => model.DeviceBatch.Comments)
                     <script type="text/javascript">
-                    $(function () {
-                        var model = {
-                            $field: $('#DeviceBatch_Comments'),
-                            $ajax_loading: null,
-                            $ajax_ok: null,
-                            updated: function () {
-                                if (!model.$ajax_loading)
-                                    model.$ajax_loading = $('#ajaxComments_loading');
-                                if (!model.$ajax_ok)
-                                    model.$ajax_ok = $('#ajaxComments_ok');
-                                model.$ajax_loading.show();
-                                var data = { Comments: model.$field.tinymce().getContent() };
-                                $.ajax({
-                                    url: '@(Url.Action(MVC.API.DeviceBatch.UpdateComments(Model.DeviceBatch.Id)))',
-                                    dataType: 'json',
-                                    data: data,
-                                    traditional: true,
-                                    type: 'POST',
-                                    success: function (d) {
-                                        if (d == 'OK') {
-                                            model.$ajax_loading.hide();
-                                            model.$ajax_ok.show().delay('fast').fadeOut('slow');
-                                        } else {
-                                            model.$ajax_loading.hide();
-                                            alert('Unable to update comments: ' + d);
-                                        }
-                                    },
-                                    error: function (jqXHR, textStatus, errorThrown) {
-                                        alert('Unable to update comments: ' + errorThrown);
-                                        model.$ajax_loading.hide();
-                                    }
-                                })
-                            }
-                        };
+                        $(function () {
+                            const $field = $('#DeviceBatch_Comments');
+                            async function updated() {
+                                $('#ajaxComments_loading').show();
+                                try {
+                                    const body = new FormData();
+                                    body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                                    body.append('comments', $field.tinymce().getContent())
 
-                        model.$field.tinymce({
-                            theme: 'simple',
-                            add_unload_trigger: false,
-                            schema: "html5",
-                            statusbar: false,
-                            setup: function (ed) {
-                                ed.on('init', function () {
-                                    $(ed.getWin()).blur(model.updated);
-                                });
+                                    const response = await fetch($('#DeviceBatch_Comments_Container').attr('data-updateurl'), {
+                                        method: 'POST',
+                                        body: body
+                                    });
+
+                                    if (response.ok) {
+                                        $('#ajaxComments_ok').show().delay('fast').fadeOut('slow');
+                                    } else {
+                                        alert('Unable to update comments: ' + response.statusText);
+                                    }
+                                } catch (e) {
+                                    alert('Unable to update comments: ' + e);
+                                }
+                                $('#ajaxComments_loading').hide();
                             }
+
+                            $field.tinymce({
+                                theme: 'simple',
+                                add_unload_trigger: false,
+                                schema: "html5",
+                                statusbar: false,
+                                setup: function (ed) {
+                                    ed.on('init', function () {
+                                        $(ed.getWin()).blur(function () { updated(); });
+                                    });
+                                }
+                            });
                         });
-                    });
                     </script>
                 }
                 else
@@ -693,8 +651,7 @@
         <tr>
             <th>Attachments:</th>
             <td>
-                <div id="DeviceBatch_Attachments" class="@(canConfig ? "canAddAttachments" : "cannotAddAttachments")" data-uploadurl="@(Url.Action(MVC.API.DeviceBatch.AttachmentUpload(Model.DeviceBatch.Id, null)))">
-                    @Html.AntiForgeryToken()
+                <div id="DeviceBatch_Attachments" class="@(canConfig ? "canAddAttachments" : "cannotAddAttachments")" data-uploadurl="@(Url.Action(MVC.API.DeviceBatch.AttachmentUpload(Model.DeviceBatch.Id, null)))" data-removeurl="@Url.Action(MVC.API.DeviceBatch.AttachmentRemove())">
                     <div class="Disco-AttachmentUpload-DropTarget">
                         <h2>Drop Attachments Here</h2>
                     </div>
@@ -708,7 +665,7 @@
                                         <img alt="Attachment Thumbnail" src="@(Url.Action(MVC.API.DeviceBatch.AttachmentThumbnail(attachment.Id)))" />
                                     </span>
                                     <span class="comments" title="@attachment.Comments">
-                                        @attachment.Comments
+                                        @(attachment.Comments ?? attachment.Filename)
                                     </span><span class="author">@attachment.TechUser.ToString()</span>@if (canConfig)
                                     {<text><span class="remove fa fa-times-circle"></span></text>}<span class="timestamp" title="@attachment.Timestamp.ToFullDateTime()" data-livestamp="@attachment.Timestamp.ToUnixEpoc()">@attachment.Timestamp.ToFullDateTime()</span>
                                 </a>
@@ -926,12 +883,10 @@
                             });
                             //#endregion
                             //#region Remove Attachments
-                            $attachmentOutput.find('span.remove').click(removeAttachment);
+                            $attachmentOutput.find('span.remove').on('click', removeAttachment);
 
                             function removeAttachment() {
-                                $this = $(this).closest('a');
-
-                                var data = { id: $this.attr('data-attachmentid') };
+                                const attachmentId = $(this).closest('a').attr('data-attachmentid');
 
                                 if (!$dialogRemoveAttachment) {
                                     $dialogRemoveAttachment = $('#dialogRemoveAttachment').dialog({
@@ -942,31 +897,28 @@
                                     });
                                 }
 
-                                $dialogRemoveAttachment.dialog("enable");
                                 $dialogRemoveAttachment.dialog('option', 'buttons', {
                                     "Remove": function () {
-                                        $dialogRemoveAttachment.dialog("disable");
                                         $dialogRemoveAttachment.dialog("option", "buttons", null);
-                                        $.ajax({
-                                            url: '@Url.Action(MVC.API.DeviceBatch.AttachmentRemove())',
-                                            dataType: 'json',
-                                            data: data,
-                                            success: function (d) {
-                                                if (d == 'OK') {
-                                                    // Do nothing, await SignalR notification
-                                                } else {
-                                                    alert('Unable to remove attachment: ' + d);
-                                                }
-                                                $dialogRemoveAttachment.dialog("close");
-                                            },
-                                            error: function (jqXHR, textStatus, errorThrown) {
-                                                alert('Unable to remove attachment: ' + textStatus);
-                                                $dialogRemoveAttachment.dialog("close");
+
+                                        const body = new FormData();
+                                        body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                                        body.append('id', attachmentId);
+                                        fetch($Attachments.attr('data-removeurl'), {
+                                            method: 'POST',
+                                            body: body
+                                        }).then(r => {
+                                            if (!r.ok) {
+                                                alert('Unable to remove attachment: ' + r.statusText);
                                             }
+                                            $dialogRemoveAttachment.dialog('close');
+                                        }).catch(e => {
+                                            alert('Unable to remove attachment: ' + e);
+                                            $dialogRemoveAttachment.dialog('close');
                                         });
                                     },
                                     Cancel: function () {
-                                        $dialogRemoveAttachment.dialog("close");
+                                        $(this).dialog("close");
                                     }
                                 });
 
@@ -1044,7 +996,7 @@
     {
         <button id="DeviceBatch_Decommission" class="button">Decommission All Devices</button>
         <div id="DeviceBatch_Decommission_Dialog" class="dialog" title="Batch Device Decommission">
-            @using (Html.BeginForm(MVC.API.Device.DeviceBatchDecommission(Model.DeviceBatch.Id), FormMethod.Post))
+            @using (Html.BeginForm(MVC.API.Device.DeviceBatchDecommission(Model.DeviceBatch.Id)))
             {
                 @Html.AntiForgeryToken()
                 <div class="clearfix" style="margin-bottom: 10px;">
@@ -1101,7 +1053,44 @@
     }
     @if (Model.CanDelete)
     {
-        @Html.ActionLinkButton("Delete", MVC.API.DeviceBatch.Delete(Model.DeviceBatch.Id, true), "buttonDelete")
+        <button id="buttonDelete" type="button" class="button">Delete</button>
+        <div id="dialogConfirmDelete" class="dialog" title="Delete this Device Batch?">
+            @using (Html.BeginForm(MVC.API.DeviceBatch.Delete(Model.DeviceBatch.Id, true)))
+            {
+                @Html.AntiForgeryToken()
+            }
+            <p>
+                <i class="fa fa-exclamation-triangle fa-lg warning"></i>
+                This item will be permanently deleted and cannot be recovered. Are you sure?
+            </p>
+        </div>
+        <script type="text/javascript">
+            $(function () {
+                let dialog = null;
+                $('#buttonDelete').on('click', function () {
+                    if (!dialog) {
+                        dialog = $("#dialogConfirmDelete").dialog({
+                            resizable: false,
+                            width: 300,
+                            modal: true,
+                            autoOpen: false,
+                            buttons: {
+                                "Delete": function () {
+                                    $(this)
+                                        .dialog("option", "buttons", null)
+                                        .find('form').trigger('submit');
+                                },
+                                Cancel: function () {
+                                    $(this).dialog("close");
+                                }
+                            }
+                        });
+                    }
+
+                    dialog.dialog('open');
+                });
+            });
+        </script>
     }
     @if (Model.DeviceCount > 0)
     {

Disco.Web/Areas/Config/Views/DeviceBatch/Timeline.cshtml

@@ -1,15 +1,14 @@
 @{
     Authorization.Require(Claims.Config.DeviceBatch.ShowTimeline);
-    
+
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Device Batches", MVC.Config.DeviceBatch.Index(null), "Timeline");
     Html.BundleDeferred("~/Style/Timeline");
     Html.BundleDeferred("~/ClientScripts/Modules/Timeline");
 }
-<div id="deviceBatchesTimeline" style="height: 550px;">
+<div id="deviceBatchesTimeline" style="height: 550px;" data-url="@(Url.Action(MVC.API.DeviceBatch.Timeline()))">
 </div>
 <script type="text/javascript">
     (function () {
-        var dataUrl = '@(Url.Action(MVC.API.DeviceBatch.Timeline()))';
         var tl;
 
         $(function () {
@@ -23,7 +22,7 @@
             var sixMonthsDate = new Date();
             sixMonthsDate.setDate(currentDate.getDate());
             sixMonthsDate.setMonth(currentDate.getMonth() + 6);
-            
+
             var hotZoneStart1 = new Date(currentDate.getFullYear(), 0, 1, 10, 0, 0);
             var hotZoneEnd1 = new Date(currentDate.getFullYear(), 11, 31, 10, 0, 0);
             var hotZoneStart2 = new Date(currentDate.getFullYear() + 1, 0, 1, 10, 0, 0);
@@ -37,18 +36,18 @@
             var bandInfos = [
                 Timeline.createHotZoneBandInfo({
                     zones: [
-                    {
-                        start: hotZoneStart1,
-                        end: hotZoneEnd1,
-                        magnify: 4,
-                        unit: Timeline.DateTime.MONTH
-                    },
-                    {
-                        start: hotZoneStart2,
-                        end: hotZoneEnd2,
-                        magnify: 4,
-                        unit: Timeline.DateTime.MONTH
-                    }
+                        {
+                            start: hotZoneStart1,
+                            end: hotZoneEnd1,
+                            magnify: 4,
+                            unit: Timeline.DateTime.MONTH
+                        },
+                        {
+                            start: hotZoneStart2,
+                            end: hotZoneEnd2,
+                            magnify: 4,
+                            unit: Timeline.DateTime.MONTH
+                        }
                     ],
                     eventSource: eventSource,
                     width: "85%",
@@ -106,17 +105,26 @@
             });
 
             // Load Events
-            $.ajax({
-                url: dataUrl,
-                dataType: 'json',
-                type: 'POST',
-                success: function (data) {
-                    eventSource.loadJSON(data, dataUrl);
-                },
-                error: function (jqXHR, textStatus, errorThrown) {
-                    alert('Unable to load Timeline Data: ' + errorThrown);
+            async function loadEventsAsync() {
+                try {
+                    const dataUrl = $('#deviceBatchesTimeline').attr('data-url');
+                    const body = new FormData();
+                    body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                    const response = await fetch(dataUrl, {
+                        method: 'POST',
+                        body: body
+                    });
+                    if (response.ok) {
+                        const data = await response.json();
+                        eventSource.loadJSON(data, dataUrl);
+                    } else {
+                        alert('Unable to load Timeline Data: ' + response.statusText);
+                    }
+                } catch (e) {
+                    alert('Unable to load Timeline Data: ' + e);
                 }
-            });
+            }
+            loadEventsAsync();
         });
 
     })();

Disco.Web/Areas/Config/Views/DeviceBatch/Timeline.generated.cs

@@ -47,7 +47,7 @@ namespace Disco.Web.Areas.Config.Views.DeviceBatch
             #line 1 "..\..\Areas\Config\Views\DeviceBatch\Timeline.cshtml"
   
     Authorization.Require(Claims.Config.DeviceBatch.ShowTimeline);
-    
+
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Device Batches", MVC.Config.DeviceBatch.Index(null), "Timeline");
     Html.BundleDeferred("~/Style/Timeline");
     Html.BundleDeferred("~/ClientScripts/Modules/Timeline");
@@ -61,74 +61,83 @@ WriteLiteral(" id=\"deviceBatchesTimeline\"");
 
 WriteLiteral(" style=\"height: 550px;\"");
 
-WriteLiteral(">\r\n</div>\r\n<script");
-
-WriteLiteral(" type=\"text/javascript\"");
-
-WriteLiteral(">\r\n    (function () {\r\n        var dataUrl = \'");
+WriteLiteral(" data-url=\"");
 
             
-            #line 12 "..\..\Areas\Config\Views\DeviceBatch\Timeline.cshtml"
-                   Write(Url.Action(MVC.API.DeviceBatch.Timeline()));
+            #line 8 "..\..\Areas\Config\Views\DeviceBatch\Timeline.cshtml"
+                                                             Write(Url.Action(MVC.API.DeviceBatch.Timeline()));
 
             
             #line default
             #line hidden
-WriteLiteral("\';\r\n        var tl;\r\n\r\n        $(function () {\r\n\r\n            var eventSource = n" +
-"ew Timeline.DefaultEventSource();\r\n\r\n            var currentDate = new Date();\r\n" +
-"            currentDate = new Date(currentDate.getFullYear(), currentDate.getMon" +
-"th(), currentDate.getDay(), 10, 0, 0);\r\n            var tomorrowDate = new Date(" +
-");\r\n            tomorrowDate.setDate(currentDate.getDate() + 1);\r\n            va" +
-"r sixMonthsDate = new Date();\r\n            sixMonthsDate.setDate(currentDate.get" +
-"Date());\r\n            sixMonthsDate.setMonth(currentDate.getMonth() + 6);\r\n     " +
-"       \r\n            var hotZoneStart1 = new Date(currentDate.getFullYear(), 0, " +
-"1, 10, 0, 0);\r\n            var hotZoneEnd1 = new Date(currentDate.getFullYear()," +
-" 11, 31, 10, 0, 0);\r\n            var hotZoneStart2 = new Date(currentDate.getFul" +
-"lYear() + 1, 0, 1, 10, 0, 0);\r\n            var hotZoneEnd2 = new Date(currentDat" +
-"e.getFullYear() + 1, 11, 31, 10, 0, 0);\r\n            //hotZoneEnd.setDate(hotZon" +
-"eEnd.getDate() - 1);\r\n\r\n            //hotZoneStart = hotZoneStart.toLocaleDateSt" +
-"ring();\r\n            //hotZoneEnd = hotZoneEnd.toLocaleDateString();\r\n\r\n\r\n      " +
-"      var bandInfos = [\r\n                Timeline.createHotZoneBandInfo({\r\n     " +
-"               zones: [\r\n                    {\r\n                        start: h" +
-"otZoneStart1,\r\n                        end: hotZoneEnd1,\r\n                      " +
-"  magnify: 4,\r\n                        unit: Timeline.DateTime.MONTH\r\n          " +
-"          },\r\n                    {\r\n                        start: hotZoneStart" +
-"2,\r\n                        end: hotZoneEnd2,\r\n                        magnify: " +
-"4,\r\n                        unit: Timeline.DateTime.MONTH\r\n                    }" +
-"\r\n                    ],\r\n                    eventSource: eventSource,\r\n       " +
-"             width: \"85%\",\r\n                    intervalUnit: Timeline.DateTime." +
-"YEAR,\r\n                    intervalPixels: 150,\r\n                    timeZone: 1" +
-"0,\r\n                    date: sixMonthsDate\r\n                }),\r\n              " +
-"  Timeline.createBandInfo({\r\n                    eventSource: eventSource,\r\n    " +
-"                width: \"15%\",\r\n                    intervalUnit: Timeline.DateTi" +
-"me.YEAR,\r\n                    intervalPixels: 150,\r\n                    overview" +
-": true,\r\n                    timeZone: 10,\r\n                    date: sixMonthsD" +
-"ate\r\n                })\r\n            ];\r\n            bandInfos[1].syncWith = 0;\r" +
-"\n            bandInfos[1].highlight = true;\r\n\r\n            for (var i = 0; i < b" +
-"andInfos.length; i++) {\r\n                bandInfos[i].decorators = [\r\n          " +
-"          new Timeline.SpanHighlightDecorator({\r\n                        startDa" +
-"te: currentDate,\r\n                        endDate: tomorrowDate,\r\n              " +
-"          color: \"#CC2222\",\r\n                        opacity: 50\r\n              " +
-"      }),\r\n                    new Timeline.SpanHighlightDecorator({\r\n          " +
-"              startDate: hotZoneStart1,\r\n                        endDate: hotZon" +
-"eEnd1,\r\n                        color: \"#CEA5A5\",\r\n                        opaci" +
-"ty: 50\r\n                    }),\r\n                    new Timeline.SpanHighlightD" +
-"ecorator({\r\n                        startDate: hotZoneStart2,\r\n                 " +
-"       endDate: hotZoneEnd2,\r\n                        color: \"#CCB7B7\",\r\n       " +
-"                 opacity: 50\r\n                    })\r\n                ];\r\n      " +
-"      }\r\n\r\n            tl = Timeline.create($(\'#deviceBatchesTimeline\')[0], band" +
-"Infos);\r\n\r\n            var tlResizeLayoutHandle = null;\r\n            $(window).r" +
-"esize(function () {\r\n                if (tlResizeLayoutHandle)\r\n                " +
-"    window.clearTimeout(tlResizeLayoutHandle);\r\n                tlResizeLayoutHa" +
-"ndle = window.setTimeout(function () {\r\n                    tlResizeLayoutHandle" +
-" = null;\r\n                    tl.layout();\r\n                }, 500);\r\n          " +
-"  });\r\n\r\n            // Load Events\r\n            $.ajax({\r\n                url: " +
-"dataUrl,\r\n                dataType: \'json\',\r\n                type: \'POST\',\r\n    " +
-"            success: function (data) {\r\n                    eventSource.loadJSON" +
-"(data, dataUrl);\r\n                },\r\n                error: function (jqXHR, te" +
-"xtStatus, errorThrown) {\r\n                    alert(\'Unable to load Timeline Dat" +
-"a: \' + errorThrown);\r\n                }\r\n            });\r\n        });\r\n\r\n    })(" +
-");\r\n\r\n</script>\r\n");
+WriteLiteral("\"");
+
+WriteLiteral(">\r\n</div>\r\n<script");
+
+WriteLiteral(" type=\"text/javascript\"");
+
+WriteLiteral(">\r\n    (function () {\r\n        var tl;\r\n\r\n        $(function () {\r\n\r\n            " +
+"var eventSource = new Timeline.DefaultEventSource();\r\n\r\n            var currentD" +
+"ate = new Date();\r\n            currentDate = new Date(currentDate.getFullYear()," +
+" currentDate.getMonth(), currentDate.getDay(), 10, 0, 0);\r\n            var tomor" +
+"rowDate = new Date();\r\n            tomorrowDate.setDate(currentDate.getDate() + " +
+"1);\r\n            var sixMonthsDate = new Date();\r\n            sixMonthsDate.setD" +
+"ate(currentDate.getDate());\r\n            sixMonthsDate.setMonth(currentDate.getM" +
+"onth() + 6);\r\n\r\n            var hotZoneStart1 = new Date(currentDate.getFullYear" +
+"(), 0, 1, 10, 0, 0);\r\n            var hotZoneEnd1 = new Date(currentDate.getFull" +
+"Year(), 11, 31, 10, 0, 0);\r\n            var hotZoneStart2 = new Date(currentDate" +
+".getFullYear() + 1, 0, 1, 10, 0, 0);\r\n            var hotZoneEnd2 = new Date(cur" +
+"rentDate.getFullYear() + 1, 11, 31, 10, 0, 0);\r\n            //hotZoneEnd.setDate" +
+"(hotZoneEnd.getDate() - 1);\r\n\r\n            //hotZoneStart = hotZoneStart.toLocal" +
+"eDateString();\r\n            //hotZoneEnd = hotZoneEnd.toLocaleDateString();\r\n\r\n\r" +
+"\n            var bandInfos = [\r\n                Timeline.createHotZoneBandInfo({" +
+"\r\n                    zones: [\r\n                        {\r\n                     " +
+"       start: hotZoneStart1,\r\n                            end: hotZoneEnd1,\r\n   " +
+"                         magnify: 4,\r\n                            unit: Timeline" +
+".DateTime.MONTH\r\n                        },\r\n                        {\r\n        " +
+"                    start: hotZoneStart2,\r\n                            end: hotZ" +
+"oneEnd2,\r\n                            magnify: 4,\r\n                            u" +
+"nit: Timeline.DateTime.MONTH\r\n                        }\r\n                    ],\r" +
+"\n                    eventSource: eventSource,\r\n                    width: \"85%\"" +
+",\r\n                    intervalUnit: Timeline.DateTime.YEAR,\r\n                  " +
+"  intervalPixels: 150,\r\n                    timeZone: 10,\r\n                    d" +
+"ate: sixMonthsDate\r\n                }),\r\n                Timeline.createBandInfo" +
+"({\r\n                    eventSource: eventSource,\r\n                    width: \"1" +
+"5%\",\r\n                    intervalUnit: Timeline.DateTime.YEAR,\r\n               " +
+"     intervalPixels: 150,\r\n                    overview: true,\r\n                " +
+"    timeZone: 10,\r\n                    date: sixMonthsDate\r\n                })\r\n" +
+"            ];\r\n            bandInfos[1].syncWith = 0;\r\n            bandInfos[1]" +
+".highlight = true;\r\n\r\n            for (var i = 0; i < bandInfos.length; i++) {\r\n" +
+"                bandInfos[i].decorators = [\r\n                    new Timeline.Sp" +
+"anHighlightDecorator({\r\n                        startDate: currentDate,\r\n       " +
+"                 endDate: tomorrowDate,\r\n                        color: \"#CC2222" +
+"\",\r\n                        opacity: 50\r\n                    }),\r\n              " +
+"      new Timeline.SpanHighlightDecorator({\r\n                        startDate: " +
+"hotZoneStart1,\r\n                        endDate: hotZoneEnd1,\r\n                 " +
+"       color: \"#CEA5A5\",\r\n                        opacity: 50\r\n                 " +
+"   }),\r\n                    new Timeline.SpanHighlightDecorator({\r\n             " +
+"           startDate: hotZoneStart2,\r\n                        endDate: hotZoneEn" +
+"d2,\r\n                        color: \"#CCB7B7\",\r\n                        opacity:" +
+" 50\r\n                    })\r\n                ];\r\n            }\r\n\r\n            tl" +
+" = Timeline.create($(\'#deviceBatchesTimeline\')[0], bandInfos);\r\n\r\n            va" +
+"r tlResizeLayoutHandle = null;\r\n            $(window).resize(function () {\r\n    " +
+"            if (tlResizeLayoutHandle)\r\n                    window.clearTimeout(t" +
+"lResizeLayoutHandle);\r\n                tlResizeLayoutHandle = window.setTimeout(" +
+"function () {\r\n                    tlResizeLayoutHandle = null;\r\n               " +
+"     tl.layout();\r\n                }, 500);\r\n            });\r\n\r\n            // L" +
+"oad Events\r\n            async function loadEventsAsync() {\r\n                try " +
+"{\r\n                    const dataUrl = $(\'#deviceBatchesTimeline\').attr(\'data-ur" +
+"l\');\r\n                    const body = new FormData();\r\n                    body" +
+".append(\'__RequestVerificationToken\', document.body.dataset.antiforgery);\r\n     " +
+"               const response = await fetch(dataUrl, {\r\n                        " +
+"method: \'POST\',\r\n                        body: body\r\n                    });\r\n  " +
+"                  if (response.ok) {\r\n                        const data = await" +
+" response.json();\r\n                        eventSource.loadJSON(data, dataUrl);\r" +
+"\n                    } else {\r\n                        alert(\'Unable to load Tim" +
+"eline Data: \' + response.statusText);\r\n                    }\r\n                } " +
+"catch (e) {\r\n                    alert(\'Unable to load Timeline Data: \' + e);\r\n " +
+"               }\r\n            }\r\n            loadEventsAsync();\r\n        });\r\n\r\n" +
+"    })();\r\n\r\n</script>\r\n");
 
         }
     }

Disco.Web/Areas/Config/Views/DeviceFlag/Create.cshtml

@@ -4,23 +4,24 @@
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Device Flags", MVC.Config.DeviceFlag.Index(null), "Create");
 }
 @using (Html.BeginForm())
-{ 
-    @Html.HiddenFor(m => m.DeviceFlag.Icon)
-    @Html.HiddenFor(m => m.DeviceFlag.IconColour)
+{
+    @Html.AntiForgeryToken()
     <div class="form" style="width: 450px">
         <table>
             <tr>
-                <th>Name:
+                <th>
+                    Name:
                 </th>
                 <td>
-                    @Html.EditorFor(model => model.DeviceFlag.Name)<br />@Html.ValidationMessageFor(model => model.DeviceFlag.Name)
+                    @Html.EditorFor(model => model.Name)<br />@Html.ValidationMessageFor(model => model.Name)
                 </td>
             </tr>
             <tr>
-                <th>Description:
+                <th>
+                    Description:
                 </th>
                 <td>
-                    @Html.EditorFor(model => model.DeviceFlag.Description)<br />@Html.ValidationMessageFor(model => model.DeviceFlag.Description)
+                    @Html.EditorFor(model => model.Description)<br />@Html.ValidationMessageFor(model => model.Description)
                 </td>
             </tr>
         </table>
@@ -30,7 +31,7 @@
     </div>
     <script type="text/javascript">
         $(function () {
-            $('#DeviceFlag_Name').focus().select();
+            $('#Name').focus().select();
         });
     </script>
 }

Disco.Web/Areas/Config/Views/DeviceFlag/Create.generated.cs

@@ -57,35 +57,21 @@ WriteLiteral("\r\n");
             
             #line 6 "..\..\Areas\Config\Views\DeviceFlag\Create.cshtml"
  using (Html.BeginForm())
-{ 
+{
     
             
             #line default
             #line hidden
             
             #line 8 "..\..\Areas\Config\Views\DeviceFlag\Create.cshtml"
-Write(Html.HiddenFor(m => m.DeviceFlag.Icon));
+Write(Html.AntiForgeryToken());
 
             
             #line default
             #line hidden
             
             #line 8 "..\..\Areas\Config\Views\DeviceFlag\Create.cshtml"
-                                           
-    
-            
-            #line default
-            #line hidden
-            
-            #line 9 "..\..\Areas\Config\Views\DeviceFlag\Create.cshtml"
-Write(Html.HiddenFor(m => m.DeviceFlag.IconColour));
-
-            
-            #line default
-            #line hidden
-            
-            #line 9 "..\..\Areas\Config\Views\DeviceFlag\Create.cshtml"
-                                                 
+                            
 
             
             #line default
@@ -96,14 +82,14 @@ WriteLiteral(" class=\"form\"");
 
 WriteLiteral(" style=\"width: 450px\"");
 
-WriteLiteral(">\r\n        <table>\r\n            <tr>\r\n                <th>Name:\r\n                " +
-"</th>\r\n                <td>\r\n");
+WriteLiteral(">\r\n        <table>\r\n            <tr>\r\n                <th>\r\n                    N" +
+"ame:\r\n                </th>\r\n                <td>\r\n");
 
 WriteLiteral("                    ");
 
             
             #line 16 "..\..\Areas\Config\Views\DeviceFlag\Create.cshtml"
-               Write(Html.EditorFor(model => model.DeviceFlag.Name));
+               Write(Html.EditorFor(model => model.Name));
 
             
             #line default
@@ -112,19 +98,20 @@ WriteLiteral("<br />");
 
             
             #line 16 "..\..\Areas\Config\Views\DeviceFlag\Create.cshtml"
-                                                                    Write(Html.ValidationMessageFor(model => model.DeviceFlag.Name));
+                                                         Write(Html.ValidationMessageFor(model => model.Name));
 
             
             #line default
             #line hidden
 WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>\r\n                <th" +
-">Description:\r\n                </th>\r\n                <td>\r\n");
+">\r\n                    Description:\r\n                </th>\r\n                <td>" +
+"\r\n");
 
 WriteLiteral("                    ");
 
             
-            #line 23 "..\..\Areas\Config\Views\DeviceFlag\Create.cshtml"
-               Write(Html.EditorFor(model => model.DeviceFlag.Description));
+            #line 24 "..\..\Areas\Config\Views\DeviceFlag\Create.cshtml"
+               Write(Html.EditorFor(model => model.Description));
 
             
             #line default
@@ -132,8 +119,8 @@ WriteLiteral("                    ");
 WriteLiteral("<br />");
 
             
-            #line 23 "..\..\Areas\Config\Views\DeviceFlag\Create.cshtml"
-                                                                           Write(Html.ValidationMessageFor(model => model.DeviceFlag.Description));
+            #line 24 "..\..\Areas\Config\Views\DeviceFlag\Create.cshtml"
+                                                                Write(Html.ValidationMessageFor(model => model.Description));
 
             
             #line default
@@ -156,11 +143,11 @@ WriteLiteral("    <script");
 
 WriteLiteral(" type=\"text/javascript\"");
 
-WriteLiteral(">\r\n        $(function () {\r\n            $(\'#DeviceFlag_Name\').focus().select();\r\n" +
-"        });\r\n    </script>\r\n");
+WriteLiteral(">\r\n        $(function () {\r\n            $(\'#Name\').focus().select();\r\n        });" +
+"\r\n    </script>\r\n");
 
             
-            #line 36 "..\..\Areas\Config\Views\DeviceFlag\Create.cshtml"
+            #line 37 "..\..\Areas\Config\Views\DeviceFlag\Create.cshtml"
 }
 
             

Disco.Web/Areas/Config/Views/DeviceFlag/Show.cshtml

@@ -38,10 +38,10 @@
             </th>
             <td>
                 @if (canConfig)
-            {@Html.EditorFor(model => model.DeviceFlag.Name)
-                    @AjaxHelpers.AjaxSave()
-                    @AjaxHelpers.AjaxLoader()
-                    <script type="text/javascript">
+                {@Html.EditorFor(model => model.DeviceFlag.Name)
+                @AjaxHelpers.AjaxSave()
+                @AjaxHelpers.AjaxLoader()
+                <script type="text/javascript">
                         $(function () {
                             document.DiscoFunctions.PropertyChangeHelper(
                                 $('#DeviceFlag_Name'),
@@ -50,12 +50,12 @@
                                 'FlagName'
                             );
                         });
-                    </script>
-                }
-                else
-                {
-                    @Model.DeviceFlag.Name
-                }
+                </script>
+            }
+            else
+            {
+                @Model.DeviceFlag.Name
+            }
             </td>
         </tr>
         <tr>
@@ -65,9 +65,9 @@
             <td>
                 @if (canConfig)
                 {@Html.EditorFor(model => model.DeviceFlag.Description)
-                    @AjaxHelpers.AjaxSave()
-                    @AjaxHelpers.AjaxLoader()
-                    <script type="text/javascript">
+                @AjaxHelpers.AjaxSave()
+                @AjaxHelpers.AjaxLoader()
+                <script type="text/javascript">
                         $(function () {
                             document.DiscoFunctions.PropertyChangeHelper(
                                 $('#DeviceFlag_Description'),
@@ -76,11 +76,11 @@
                                 'Description'
                             );
                         });
-                    </script>
-                }
-                else
-                {
-                    <pre>
+                </script>
+            }
+            else
+            {
+                <pre>
                     @if (string.IsNullOrEmpty(Model.DeviceFlag.Description))
                     {
                     <text>&lt;None&gt;</text>
@@ -90,7 +90,7 @@
                         @Model.DeviceFlag.Description.ToHtmlComment()
                     }
                     </pre>
-                }
+            }
             </td>
         </tr>
         <tr>
@@ -113,6 +113,12 @@
                     <div>
                         <a id="Config_DeviceFlags_Icon_Update" href="#" class="button small">Update</a>
                         <div id="Config_DeviceFlags_Icon_Update_Dialog" class="dialog" title="Device Flag Icon">
+                            @using (Html.BeginForm(MVC.API.DeviceFlag.UpdateIconAndColour(id: Model.DeviceFlag.Id, redirect: true)))
+                            {
+                                @Html.AntiForgeryToken()
+                                <input type="hidden" name="icon" />
+                                <input type="hidden" name="iconColour" />
+                            }
                             <div>
                                 <div class="colours">
                                     @foreach (var colour in Model.ThemeColours)
@@ -183,15 +189,11 @@
                                 }
 
                                 function save() {
-                                    var url = '@(Url.Action(MVC.API.DeviceFlag.UpdateIconAndColour(id: Model.DeviceFlag.Id, redirect: true)))',
-                                        data = {
-                                            Icon: icons.find('i.selected').attr('data-icon'),
-                                            IconColour: colours.find('i.selected').attr('data-colour')
-                                        };
-                                    window.location.href = url + '&' + $.param(data);
-
-                                    dialog.dialog("disable");
                                     dialog.dialog("option", "buttons", null);
+                                    const $form = dialog.find('form');
+                                    $form.find('input[name="icon"]').val(icons.find('i.selected').attr('data-icon'));
+                                    $form.find('input[name="iconColour"]').val(colours.find('i.selected').attr('data-colour'));
+                                    $form.trigger('submit');
                                 }
 
                                 function cancel() {
@@ -391,7 +393,7 @@
                    UpdateUrl = Url.Action(MVC.API.DeviceFlag.UpdateAssignedUserLinkedGroup(Model.DeviceFlag.Id, redirect: true))
                })
                     @if (canConfig)
-            {
+                    {
                         @Html.Partial(MVC.Config.Shared.Views.LinkedGroupShared)
                     }
                 </div>
@@ -442,7 +444,8 @@
                 <div class="loading">
                     <h4><i class="fa fa-lg fa-cog fa-spin" title="Please Wait"></i>Loading current assignments...</h4>
                 </div>
-                <form action="#" method="post">
+                <form action="#" method="post" data-overrideaction="@(Url.Action(MVC.API.DeviceFlag.BulkAssignDevices(Model.DeviceFlag.Id, true)))" data-addaction="@(Url.Action(MVC.API.DeviceFlag.BulkAssignDevices(Model.DeviceFlag.Id, false)))">
+                    @Html.AntiForgeryToken()
                     <textarea id="Config_DeviceFlags_BulkAssign_AssignDialog_DeviceSerialNumbers" name="DeviceSerialNumbers"></textarea>
                     <h4>Comments:</h4>
                     <textarea id="Config_DeviceFlags_BulkAssign_AssignDialog_Comments" name="Comments"></textarea>
@@ -502,8 +505,9 @@
                         assignDialog.dialog('option', 'buttons', buttons);
                         assignDialog.dialog('option', 'title', 'Bulk Assign Devices: ' + mode);
 
+                        const $form = assignDeviceSerialNumbers.closest('form');
                         if (mode == "Override") {
-                            assignDeviceSerialNumbers.closest('form').attr('action', '@(Url.Action(MVC.API.DeviceFlag.BulkAssignDevices(Model.DeviceFlag.Id, true)))');
+                            $form.attr('action', $form.attr('data-overrideaction'));
 
                             assignDialog.addClass('loading');
                             $.getJSON('@Url.Action(MVC.API.DeviceFlag.AssignedDevices(Model.DeviceFlag.Id))', function (response, result) {
@@ -523,7 +527,7 @@
                         }
                         else // Assume Add
                         {
-                            assignDeviceSerialNumbers.closest('form').attr('action', '@(Url.Action(MVC.API.DeviceFlag.BulkAssignDevices(Model.DeviceFlag.Id, false)))');
+                            $form.attr('action', $form.attr('data-addaction'));
                         }
 
                         assignDialog.dialog('open');
@@ -538,8 +542,12 @@
         }
         @if (canDelete)
         {
-            @Html.ActionLinkButton("Delete", MVC.API.DeviceFlag.Delete(Model.DeviceFlag.Id, true), "Config_DeviceFlags_Actions_Delete_Button")
-            <div id="Config_DeviceFlags_Actions_Delete_Dialog" title="Delete this Device Flag?">
+            <button id="Config_DeviceFlags_Actions_Delete_Button" type="button" class="button">Delete</button>
+            <div id="Config_DeviceFlags_Actions_Delete_Dialog" class="dialog" title="Delete this Device Flag?">
+                @using (Html.BeginForm(MVC.API.DeviceFlag.Delete(Model.DeviceFlag.Id, true)))
+                {
+                    @Html.AntiForgeryToken()
+                }
                 <p>
                     <i class="fa fa-exclamation-triangle fa-lg warning"></i>
                     This item will be permanently deleted and cannot be recovered.<br />
@@ -555,29 +563,27 @@
             </div>
             <script type="text/javascript">
                 $(function () {
-                    var button = $('#Config_DeviceFlags_Actions_Delete_Button');
-                    var buttonDialog = $('#Config_DeviceFlags_Actions_Delete_Dialog');
-                    var buttonLink = button.attr('href');
-                    button.attr('href', '#');
-                    button.click(function () {
-                        buttonDialog.dialog('open');
-                        return false;
-                    });
-                    buttonDialog.dialog({
-                        resizable: false,
-                        modal: true,
-                        autoOpen: false,
-                        buttons: {
-                            "Delete": function () {
-                                var $this = $(this);
-                                $this.dialog("disable");
-                                $this.dialog("option", "buttons", null);
-                                window.location.href = buttonLink;
-                            },
-                            Cancel: function () {
-                                $(this).dialog("close");
-                            }
+                    let buttonDialog = null;
+                    $('#Config_DeviceFlags_Actions_Delete_Button').on('click', function () {
+                        const $button = $(this);
+                        if (!buttonDialog) {
+                            buttonDialog = $('#Config_DeviceFlags_Actions_Delete_Dialog').dialog({
+                                resizable: false,
+                                modal: true,
+                                autoOpen: false,
+                                buttons: {
+                                    "Delete": function () {
+                                        $(this)
+                                            .dialog("option", "buttons", null)
+                                            .find('form').trigger('submit');
+                                    },
+                                    Cancel: function () {
+                                        $(this).dialog("close");
+                                    }
+                                }
+                            });
                         }
+                        buttonDialog.dialog('open');
                     });
                 });
             </script>

Disco.Web/Areas/Config/Views/DeviceModel/Create.cshtml

@@ -1,11 +1,11 @@
 @model Disco.Web.Areas.Config.Models.DeviceModel.CreateModel
 @{
     Authorization.RequireAll(Claims.Config.DeviceModel.CreateCustom, Claims.Config.DeviceModel.Configure);
-    
+
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Device Models", MVC.Config.DeviceModel.Index(null), "Create Custom");
 }
 @using (Html.BeginForm())
-{ 
+{
     @Html.AntiForgeryToken()
     <div class="form" style="width: 450px">
         <table>
@@ -14,21 +14,23 @@
                     Name / Description:
                 </th>
                 <td>
-                @Html.TextBoxFor(model => model.Description)<br />@Html.ValidationMessageFor(model => model.Description)
+                    @Html.TextBoxFor(model => model.Description)<br />@Html.ValidationMessageFor(model => model.Description)
                 </td>
             </tr>
             <tr>
                 <th>
                     Manufacturer:
                 </th>
-                <td>@Html.TextBoxFor(model => model.Manufacturer)<br />@Html.ValidationMessageFor(model => model.Manufacturer)
+                <td>
+                    @Html.TextBoxFor(model => model.Manufacturer)<br />@Html.ValidationMessageFor(model => model.Manufacturer)
                 </td>
             </tr>
             <tr>
                 <th>
                     Model:
                 </th>
-                <td>@Html.TextBoxFor(model => model.ManufacturerModel)<br />@Html.ValidationMessageFor(model => model.ManufacturerModel)
+                <td>
+                    @Html.TextBoxFor(model => model.ManufacturerModel)<br />@Html.ValidationMessageFor(model => model.ManufacturerModel)
                 </td>
             </tr>
         </table>

Disco.Web/Areas/Config/Views/DeviceModel/Create.generated.cs

@@ -47,7 +47,7 @@ namespace Disco.Web.Areas.Config.Views.DeviceModel
             #line 2 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
   
     Authorization.RequireAll(Claims.Config.DeviceModel.CreateCustom, Claims.Config.DeviceModel.Configure);
-    
+
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Device Models", MVC.Config.DeviceModel.Index(null), "Create Custom");
 
             
@@ -58,7 +58,7 @@ WriteLiteral("\r\n");
             
             #line 7 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
  using (Html.BeginForm())
-{ 
+{
     
             
             #line default
@@ -86,11 +86,11 @@ WriteLiteral(" style=\"width: 450px\"");
 WriteLiteral(">\r\n        <table>\r\n            <tr>\r\n                <th>\r\n                    N" +
 "ame / Description:\r\n                </th>\r\n                <td>\r\n");
 
-WriteLiteral("                ");
+WriteLiteral("                    ");
 
             
             #line 17 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
-           Write(Html.TextBoxFor(model => model.Description));
+               Write(Html.TextBoxFor(model => model.Description));
 
             
             #line default
@@ -99,17 +99,19 @@ WriteLiteral("<br />");
 
             
             #line 17 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
-                                                             Write(Html.ValidationMessageFor(model => model.Description));
+                                                                 Write(Html.ValidationMessageFor(model => model.Description));
 
             
             #line default
             #line hidden
 WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>\r\n                <th" +
 ">\r\n                    Manufacturer:\r\n                </th>\r\n                <td" +
-">");
+">\r\n");
+
+WriteLiteral("                    ");
 
             
-            #line 24 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
+            #line 25 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
                Write(Html.TextBoxFor(model => model.Manufacturer));
 
             
@@ -118,17 +120,19 @@ WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>
 WriteLiteral("<br />");
 
             
-            #line 24 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
+            #line 25 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
                                                                   Write(Html.ValidationMessageFor(model => model.Manufacturer));
 
             
             #line default
             #line hidden
 WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>\r\n                <th" +
-">\r\n                    Model:\r\n                </th>\r\n                <td>");
+">\r\n                    Model:\r\n                </th>\r\n                <td>\r\n");
+
+WriteLiteral("                    ");
 
             
-            #line 31 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
+            #line 33 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
                Write(Html.TextBoxFor(model => model.ManufacturerModel));
 
             
@@ -137,7 +141,7 @@ WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>
 WriteLiteral("<br />");
 
             
-            #line 31 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
+            #line 33 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
                                                                        Write(Html.ValidationMessageFor(model => model.ManufacturerModel));
 
             
@@ -165,7 +169,7 @@ WriteLiteral(">\r\n        $(function () {\r\n            $(\'#Description\').fo
 "    });\r\n    </script>\r\n");
 
             
-            #line 44 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
+            #line 46 "..\..\Areas\Config\Views\DeviceModel\Create.cshtml"
 }
 
             

Disco.Web/Areas/Config/Views/DeviceModel/Show.cshtml

@@ -274,6 +274,7 @@
                     <hr />
                     using (Html.BeginForm(MVC.API.DeviceModel.Image(Model.DeviceModel.Id, true, null), FormMethod.Post, new { enctype = "multipart/form-data" }))
                     {
+                        @Html.AntiForgeryToken()
                         <input type="file" name="Image" id="Image" style="width: 220px;" />
                         <input class="button small" type="submit" value="Upload Image" />
                     }
@@ -290,7 +291,7 @@
     {
         <button id="DeviceModel_Decommission" class="button">Decommission All Devices</button>
         <div id="DeviceModel_Decommission_Dialog" class="dialog" title="Model Device Decommission">
-            @using (Html.BeginForm(MVC.API.Device.DeviceModelDecommission(Model.DeviceModel.Id), FormMethod.Post))
+            @using (Html.BeginForm(MVC.API.Device.DeviceModelDecommission(Model.DeviceModel.Id)))
             {
                 @Html.AntiForgeryToken()
                 <div class="clearfix" style="margin-bottom: 10px;">
@@ -347,7 +348,44 @@
     }
     @if (Model.CanDelete)
     {
-        @Html.ActionLinkButton("Delete", MVC.API.DeviceModel.Delete(Model.DeviceModel.Id, true), "buttonDelete")
+        <button id="buttonDelete" type="button" class="button">Delete</button>
+        <div id="dialogConfirmDelete" class="dialog" title="Delete this Device Model?">
+            @using (Html.BeginForm(MVC.API.DeviceModel.Delete(Model.DeviceModel.Id, true)))
+            {
+                @Html.AntiForgeryToken()
+            }
+            <p>
+                <i class="fa fa-exclamation-triangle fa-lg warning"></i>
+                This item will be permanently deleted and cannot be recovered. Are you sure?
+            </p>
+        </div>
+        <script type="text/javascript">
+            $(function () {
+                let dialog = null;
+                $('#buttonDelete').on('click', function () {
+                    if (!dialog) {
+                        dialog = $("#dialogConfirmDelete").dialog({
+                            resizable: false,
+                            width: 300,
+                            modal: true,
+                            autoOpen: false,
+                            buttons: {
+                                "Delete": function () {
+                                    $(this)
+                                        .dialog("option", "buttons", null)
+                                        .find('form').trigger('submit');
+                                },
+                                Cancel: function () {
+                                    $(this).dialog("close");
+                                }
+                            }
+                        });
+                    }
+
+                    dialog.dialog('open');
+                });
+            });
+        </script>
     }
     @if (Model.DeviceCount > 0)
     {

Disco.Web/Areas/Config/Views/DeviceModel/Show.generated.cs

@@ -936,6 +936,20 @@ WriteLiteral("                    <hr />\r\n");
             #line 275 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
                     using (Html.BeginForm(MVC.API.DeviceModel.Image(Model.DeviceModel.Id, true, null), FormMethod.Post, new { enctype = "multipart/form-data" }))
                     {
+                        
+            
+            #line default
+            #line hidden
+            
+            #line 277 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+                   Write(Html.AntiForgeryToken());
+
+            
+            #line default
+            #line hidden
+            
+            #line 277 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+                                                
 
             
             #line default
@@ -963,7 +977,7 @@ WriteLiteral(" value=\"Upload Image\"");
 WriteLiteral(" />\r\n");
 
             
-            #line 279 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 280 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
                     }
                 }
 
@@ -973,7 +987,7 @@ WriteLiteral(" />\r\n");
 WriteLiteral("            </td>\r\n        </tr>\r\n    </table>\r\n</div>\r\n<h2>Components</h2>\r\n");
 
             
-            #line 286 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 287 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
 Write(Html.Partial(MVC.Config.DeviceModel.Views._DeviceComponentsTable, Model.DeviceComponentsModel));
 
             
@@ -982,7 +996,7 @@ Write(Html.Partial(MVC.Config.DeviceModel.Views._DeviceComponentsTable, Model.De
 WriteLiteral("\r\n");
 
             
-            #line 287 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 288 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
 Write(Html.Partial(MVC.Config.Shared.Views._DeviceGroupDocumentBulkGenerate, Model));
 
             
@@ -995,13 +1009,13 @@ WriteLiteral(" class=\"actionBar\"");
 WriteLiteral(">\r\n");
 
             
-            #line 289 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 290 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
     
             
             #line default
             #line hidden
             
-            #line 289 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 290 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
      if (Model.CanDecommission)
     {
 
@@ -1027,28 +1041,28 @@ WriteLiteral(" title=\"Model Device Decommission\"");
 WriteLiteral(">\r\n");
 
             
-            #line 293 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 294 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
             
             
             #line default
             #line hidden
             
-            #line 293 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
-             using (Html.BeginForm(MVC.API.Device.DeviceModelDecommission(Model.DeviceModel.Id), FormMethod.Post))
+            #line 294 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+             using (Html.BeginForm(MVC.API.Device.DeviceModelDecommission(Model.DeviceModel.Id)))
             {
                 
             
             #line default
             #line hidden
             
-            #line 295 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 296 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
            Write(Html.AntiForgeryToken());
 
             
             #line default
             #line hidden
             
-            #line 295 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 296 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
                                         
 
             
@@ -1073,13 +1087,13 @@ WriteLiteral(" class=\"none\"");
 WriteLiteral(">\r\n");
 
             
-            #line 301 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 302 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
                         
             
             #line default
             #line hidden
             
-            #line 301 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 302 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
                          foreach (DecommissionReasons decommissionReason in Enum.GetValues(typeof(DecommissionReasons)).Cast<DecommissionReasons>().OrderBy(r => r.ToString()))
                         {
 
@@ -1090,33 +1104,33 @@ WriteLiteral("                            <li>\r\n
 
 WriteLiteral(" type=\"radio\"");
 
-WriteAttribute("id", Tuple.Create(" id=\"", 12649), Tuple.Create("\"", 12719)
-, Tuple.Create(Tuple.Create("", 12654), Tuple.Create("DeviceModel_Decommission_Dialog_Reason_", 12654), true)
+WriteAttribute("id", Tuple.Create(" id=\"", 12682), Tuple.Create("\"", 12752)
+, Tuple.Create(Tuple.Create("", 12687), Tuple.Create("DeviceModel_Decommission_Dialog_Reason_", 12687), true)
             
-            #line 304 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
-               , Tuple.Create(Tuple.Create("", 12693), Tuple.Create<System.Object, System.Int32>((int)decommissionReason
+            #line 305 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+               , Tuple.Create(Tuple.Create("", 12726), Tuple.Create<System.Object, System.Int32>((int)decommissionReason
             
             #line default
             #line hidden
-, 12693), false)
+, 12726), false)
 );
 
 WriteLiteral("\r\n                                       name=\"decommissionReason\"");
 
-WriteAttribute("value", Tuple.Create(" value=\"", 12786), Tuple.Create("\"", 12820)
+WriteAttribute("value", Tuple.Create(" value=\"", 12819), Tuple.Create("\"", 12853)
             
-            #line 305 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
-, Tuple.Create(Tuple.Create("", 12794), Tuple.Create<System.Object, System.Int32>((int)decommissionReason
+            #line 306 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+, Tuple.Create(Tuple.Create("", 12827), Tuple.Create<System.Object, System.Int32>((int)decommissionReason
             
             #line default
             #line hidden
-, 12794), false)
+, 12827), false)
 );
 
 WriteLiteral(" ");
 
             
-            #line 305 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 306 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
                                                                                                 Write((decommissionReason == DecommissionReasons.EndOfLife) ? "checked=\"checked\"" : string.Empty);
 
             
@@ -1124,21 +1138,21 @@ WriteLiteral(" ");
             #line hidden
 WriteLiteral(" />\r\n                                <label");
 
-WriteAttribute("for", Tuple.Create(" for=\"", 12960), Tuple.Create("\"", 13031)
-, Tuple.Create(Tuple.Create("", 12966), Tuple.Create("DeviceModel_Decommission_Dialog_Reason_", 12966), true)
+WriteAttribute("for", Tuple.Create(" for=\"", 12993), Tuple.Create("\"", 13064)
+, Tuple.Create(Tuple.Create("", 12999), Tuple.Create("DeviceModel_Decommission_Dialog_Reason_", 12999), true)
             
-            #line 306 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
-   , Tuple.Create(Tuple.Create("", 13005), Tuple.Create<System.Object, System.Int32>((int)decommissionReason
+            #line 307 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+   , Tuple.Create(Tuple.Create("", 13038), Tuple.Create<System.Object, System.Int32>((int)decommissionReason
             
             #line default
             #line hidden
-, 13005), false)
+, 13038), false)
 );
 
 WriteLiteral(">");
 
             
-            #line 306 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 307 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
                                                                                                            Write(decommissionReason.ReasonMessage());
 
             
@@ -1147,7 +1161,7 @@ WriteLiteral(">");
 WriteLiteral("</label>\r\n                            </li>\r\n");
 
             
-            #line 308 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 309 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
                         }
 
             
@@ -1166,7 +1180,7 @@ WriteLiteral(" />\r\n                        Unassign devices users\r\n
 "\r\n                </div>\r\n");
 
             
-            #line 316 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 317 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
             }
 
             
@@ -1210,7 +1224,7 @@ WriteLiteral(@">
 ");
 
             
-            #line 347 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 348 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
     }
 
             
@@ -1219,23 +1233,104 @@ WriteLiteral(@">
 WriteLiteral("    ");
 
             
-            #line 348 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 349 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
      if (Model.CanDelete)
     {
-        
+
+            
+            #line default
+            #line hidden
+WriteLiteral("        <button");
+
+WriteLiteral(" id=\"buttonDelete\"");
+
+WriteLiteral(" type=\"button\"");
+
+WriteLiteral(" class=\"button\"");
+
+WriteLiteral(">Delete</button>\r\n");
+
+WriteLiteral("        <div");
+
+WriteLiteral(" id=\"dialogConfirmDelete\"");
+
+WriteLiteral(" class=\"dialog\"");
+
+WriteLiteral(" title=\"Delete this Device Model?\"");
+
+WriteLiteral(">\r\n");
+
+            
+            #line 353 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            
             
             #line default
             #line hidden
             
-            #line 350 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
-   Write(Html.ActionLinkButton("Delete", MVC.API.DeviceModel.Delete(Model.DeviceModel.Id, true), "buttonDelete"));
+            #line 353 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+             using (Html.BeginForm(MVC.API.DeviceModel.Delete(Model.DeviceModel.Id, true)))
+            {
+                
+            
+            #line default
+            #line hidden
+            
+            #line 355 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+           Write(Html.AntiForgeryToken());
 
             
             #line default
             #line hidden
             
-            #line 350 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
-                                                                                                                
+            #line 355 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+                                        
+            }
+
+            
+            #line default
+            #line hidden
+WriteLiteral("            <p>\r\n                <i");
+
+WriteLiteral(" class=\"fa fa-exclamation-triangle fa-lg warning\"");
+
+WriteLiteral("></i>\r\n                This item will be permanently deleted and cannot be recove" +
+"red. Are you sure?\r\n            </p>\r\n        </div>\r\n");
+
+WriteLiteral("        <script");
+
+WriteLiteral(" type=\"text/javascript\"");
+
+WriteLiteral(@">
+            $(function () {
+                let dialog = null;
+                $('#buttonDelete').on('click', function () {
+                    if (!dialog) {
+                        dialog = $(""#dialogConfirmDelete"").dialog({
+                            resizable: false,
+                            width: 300,
+                            modal: true,
+                            autoOpen: false,
+                            buttons: {
+                                ""Delete"": function () {
+                                    $(this)
+                                        .dialog(""option"", ""buttons"", null)
+                                        .find('form').trigger('submit');
+                                },
+                                Cancel: function () {
+                                    $(this).dialog(""close"");
+                                }
+                            }
+                        });
+                    }
+
+                    dialog.dialog('open');
+                });
+            });
+        </script>
+");
+
+            
+            #line 389 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
     }
 
             
@@ -1244,7 +1339,7 @@ WriteLiteral("    ");
 WriteLiteral("    ");
 
             
-            #line 352 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 390 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
      if (Model.DeviceCount > 0)
     {
         if (Authorization.Has(Claims.Device.Actions.Export))
@@ -1254,14 +1349,14 @@ WriteLiteral("    ");
             #line default
             #line hidden
             
-            #line 356 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 394 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
        Write(Html.ActionLinkButton("Export Devices", MVC.Device.Export(null, Disco.Models.Services.Devices.DeviceExportTypes.Model, Model.DeviceModel.Id)));
 
             
             #line default
             #line hidden
             
-            #line 356 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 394 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
                                                                                                                                                           
         }
         if (Authorization.Has(Claims.Device.Search) && Model.DeviceCount > 0)
@@ -1271,14 +1366,14 @@ WriteLiteral("    ");
             #line default
             #line hidden
             
-            #line 360 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 398 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
        Write(Html.ActionLinkButton(string.Format("View {0} Device{1}", Model.DeviceCount, (Model.DeviceCount != 1 ? "s" : null)), MVC.Search.Query(Model.DeviceModel.Id.ToString(), "DeviceModel")));
 
             
             #line default
             #line hidden
             
-            #line 360 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
+            #line 398 "..\..\Areas\Config\Views\DeviceModel\Show.cshtml"
                                                                                                                                                                                                    
         }
     }

Disco.Web/Areas/Config/Views/DeviceModel/_DeviceComponentsTable.cshtml

@@ -8,15 +8,19 @@
 }
 @if (canConfig)
 {
-    <table id="deviceComponents" data-devicemodelid="@(Model.DeviceModelId.HasValue ? Model.DeviceModelId.Value.ToString() : string.Empty)">
+    <table id="deviceComponents" data-devicemodelid="@(Model.DeviceModelId.HasValue ? Model.DeviceModelId.Value.ToString() : string.Empty)" data-addurl="@Url.Action(MVC.API.DeviceModel.ComponentAdd(null, null, null))" data-updateurl="@Url.Action(MVC.API.DeviceModel.ComponentUpdate())" data-removeurl="@Url.Action(MVC.API.DeviceModel.ComponentRemove())" data-geturl="@Url.Action(MVC.API.DeviceModel.Component())" data-updatejobsubtypesurl="@Url.Action(MVC.API.DeviceModel.ComponentUpdateJobSubTypes())">
         <tr>
-            <th>Description
+            <th>
+                Description
             </th>
-            <th>Cost
+            <th>
+                Cost
             </th>
-            <th>Job Types
+            <th>
+                Job Types
             </th>
-            <th class="actions">&nbsp;
+            <th class="actions">
+                &nbsp;
             </th>
         </tr>
         @foreach (var item in Model.DeviceComponents)
@@ -47,183 +51,179 @@
     </table>
     <script type="text/javascript">
         $(function () {
-            var $deviceComponents = $('#deviceComponents');
+            const $deviceComponents = $('#deviceComponents');
 
             $('#addDeviceComponent').click(function () {
-                var dc = $('<tr><td><input type="text" class="description" /></td><td><input type="text" class="cost" /></td><td><span class="fa-stack edit"><i class="fa fa-list-alt fa-stack-2x"></i><i class="fa fa-asterisk fa-stack-1x hidden"></i></span></td><td><i class="fa fa-times-circle remove"></i></td></tr>');
-                dc.find('input').focus(function () { $(this).select() })
+                const dc = $('<tr><td><input type="text" class="description" /></td><td><input type="text" class="cost" /></td><td><span class="fa-stack edit"><i class="fa fa-list-alt fa-stack-2x"></i><i class="fa fa-asterisk fa-stack-1x hidden"></i></span></td><td><i class="fa fa-times-circle remove"></i></td></tr>');
                 dc.insertBefore($deviceComponents.find('tr').last());
                 dc.find('input.description').focus();
                 return false;
             });
 
-            $deviceComponents.on('change', 'input', updateComponent);
+            $deviceComponents.on('change', 'input', function () { updateComponent(this); });
             $deviceComponents.on('focus', 'input', function () { $(this).select(); });
 
             $deviceComponents.on('click', '.remove', removeComponent);
-            $deviceComponents.on('click', '.edit', editComponentJobTypes);
+            $deviceComponents.on('click', '.edit', function () { editComponentJobTypes(this); });
 
-            function removeComponentConfirmed(id, row) {
-                var data = { id: id };
-                $.ajax({
-                    url: '@Url.Action(MVC.API.DeviceModel.ComponentRemove())',
-                    dataType: 'json',
-                    data: data,
-                    success: function (d) {
-                        if (d == 'OK') {
-                            row.remove();
-                        } else {
-                            alert('Unable to remove component: ' + d);
-                        }
-                    },
-                    error: function (jqXHR, textStatus, errorThrown) {
-                        alert('Unable to remove component: ' + textStatus);
+            async function removeComponentConfirmed(id, row) {
+                const body = new FormData();
+                body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                body.append('id', id);
+
+                try {
+                    const response = await fetch($deviceComponents.attr('data-removeurl'), {
+                        method: 'POST',
+                        body: body
+                    });
+
+                    if (response.ok) {
+                        row.remove();
+                    } else {
+                        alert('Unable to remove component: ' + response.statusText);
                     }
-                });
-        }
+                } catch (e) {
+                    alert('Unable to remove component: ' + e);
+                }
+            }
             function removeComponent() {
-                var componentRow = $(this).closest('tr');
-                var id = componentRow.attr('data-devicecomponentid');
+                const componentRow = $(this).closest('tr');
+                const id = componentRow.attr('data-devicecomponentid');
                 if (id) {
-                    var dialog = $("#dialogConfirmRemove");
-                    var buttons = dialog.dialog("option", "buttons");
+                    const dialog = $("#dialogConfirmRemove");
+                    const buttons = dialog.dialog("option", "buttons");
                     buttons['Remove'] = function () { removeComponentConfirmed(id, componentRow); $(this).dialog("close"); };
-                    var buttons = dialog.dialog("option", "buttons", buttons);
+                    dialog.dialog("option", "buttons", buttons);
                     dialog.dialog('open');
                 } else {
                     // New - Remove
                     componentRow.remove();
                 }
             }
-            function updateComponent() {
-                var componentRow = $(this).closest('tr');
+            async function updateComponent(input) {
+                const componentRow = $(input).closest('tr');
                 componentRow.find('input').attr('disabled', true).addClass('updating');
 
-                var id = componentRow.attr('data-devicecomponentid');
+                const id = componentRow.attr('data-devicecomponentid');
                 if (id) {
                     // Update
-                    var data = {
-                        id: id,
-                        Description: componentRow.find('input.description').val(),
-                        Cost: componentRow.find('input.cost').val()
-                    };
-                    $.ajax({
-                        url: '@Url.Action(MVC.API.DeviceModel.ComponentUpdate())',
-                        dataType: 'json',
-                        type: 'POST',
-                        data: data,
-                        success: function (d) {
+                    const body = new FormData();
+                    body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                    body.append('id', id);
+                    body.append('description', componentRow.find('input.description').val());
+                    body.append('cost', componentRow.find('input.cost').val());
+
+                    try {
+                        const response = await fetch($deviceComponents.attr('data-updateurl'), {
+                            method: 'POST',
+                            body: body
+                        });
+
+                        if (response.ok) {
+                            const result = await response.json();
                             componentRow.find('input').attr('disabled', false).removeClass('updating');
-                            if (d.Result == 'OK') {
-                                componentRow.find('input.description').val(d.Component.Description);
-                                componentRow.find('input.cost').val(d.Component.Cost);
-                            } else {
-                                alert('Unable to update component: ' + d.Result);
-                            }
-                        },
-                        error: function (jqXHR, textStatus, errorThrown) {
-                            alert('Unable to update component: ' + textStatus);
+                            componentRow.find('input.description').val(result.Description);
+                            componentRow.find('input.cost').val(result.Cost);
+                        } else {
+                            alert('Unable to update component: ' + response.statusText);
                         }
-                    });
+                    } catch (e) {
+                        alert('Unable to update component: ' + e);
+                    }
                 } else {
                     // Add
-                    id = componentRow.closest('table').attr('data-devicemodelid');
-                    var data = {
-                        id: id,
-                        Description: componentRow.find('input.description').val(),
-                        Cost: componentRow.find('input.cost').val()
-                    };
-                    $.ajax({
-                        url: '@Url.Action(MVC.API.DeviceModel.ComponentAdd(null, null, null))',
-                        dataType: 'json',
-                        type: 'POST',
-                        data: data,
-                        success: function (d) {
+                    const modelId = componentRow.closest('table').attr('data-devicemodelid');
+                    const body = new FormData();
+                    body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                    body.append('id', modelId);
+                    body.append('description', componentRow.find('input.description').val());
+                    body.append('cost', componentRow.find('input.cost').val());
+
+                    try {
+                        const response = await fetch($deviceComponents.attr('data-addurl'), {
+                            method: 'POST',
+                            body: body
+                        });
+
+                        if (response.ok) {
+                            const result = await response.json();
                             componentRow.find('input').attr('disabled', false).removeClass('updating');
-                            if (d.Result == 'OK') {
-                                componentRow.attr('data-devicecomponentid', d.Component.Id);
-                                componentRow.find('input.description').val(d.Component.Description);
-                                componentRow.find('input.cost').val(d.Component.Cost);
-                            } else {
-                                alert('Unable to add component: ' + d.Result);
-                            }
-                        },
-                        error: function (jqXHR, textStatus, errorThrown) {
-                            alert('Unable to add component: ' + textStatus);
+                            componentRow.attr('data-devicecomponentid', result.Id);
+                            componentRow.find('input.description').val(result.Description);
+                            componentRow.find('input.cost').val(result.Cost);
+                        } else {
+                            alert('Unable to add component: ' + response.statusText);
                         }
-                    });
+                    } catch (e) {
+                        alert('Unable to add component: ' + e);
+                    }
                 }
             }
-            function editComponentJobTypes() {
-                var edit$this = $(this);
-                var componentRow = edit$this.closest('tr');
-
-                var id = componentRow.attr('data-devicecomponentid');
+            async function editComponentJobTypes(input) {
+                const edit$this = $(input);
+                const componentRow = edit$this.closest('tr');
+                const id = componentRow.attr('data-devicecomponentid');
 
                 if (id) {
-                    var data = {
-                        id: id
-                    };
-                    $.ajax({
-                        url: '@Url.Action(MVC.API.DeviceModel.Component())',
-                        dataType: 'json',
-                        data: data,
-                        success: function (d) {
-                            componentRow.find('input').attr('disabled', false).removeClass('updating');
-                            if (d.Result == 'OK') {
-                                $dialogUpdateJobTypes = $('#dialogUpdateJobTypes');
-                                $dialogUpdateJobTypes.find('input:checked').each(function () { $(this).prop('checked', false) });
-                                for (var i = 0; i < d.Component.JobSubTypes.length; i++) {
-                                    var sjt = d.Component.JobSubTypes[i];
-                                    $dialogUpdateJobTypes.find('#SubTypes_' + sjt).prop('checked', true);
-                                }
-                                $('#CheckboxBulkSelect_dialogUpdateJobTypes').checkboxBulkSelect('update');
-                                var buttons = $dialogUpdateJobTypes.dialog("option", "buttons");
-                                buttons['Save'] = function () {
-                                    $dialogUpdateJobTypes.dialog("disable");
-                                    var selectedSJTs = [];
-                                    $dialogUpdateJobTypes.find('input:checked').each(function () { selectedSJTs.push($(this).val()) });
+                    try {
+                        const body = new FormData();
+                        body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                        body.append('id', id);
+                        const getResponse = await fetch($deviceComponents.attr('data-geturl'), {
+                            method: 'POST',
+                            body: body
+                        })
 
-                                    var data = {
-                                        id: id,
-                                        JobSubTypes: selectedSJTs
-                                    };
-                                    $.ajax({
-                                        url: '@Url.Action(MVC.API.DeviceModel.ComponentUpdateJobSubTypes())',
-                                        dataType: 'json',
-                                        type: 'POST',
-                                        traditional: true,
-                                        data: data,
-                                        success: function (d) {
-                                            if (d.Result == 'OK') {
-                                                if (d.Component.JobSubTypes.length > 0) {
-                                                    edit$this.find('.fa-asterisk').removeClass('hidden');
-                                                } else {
-                                                    edit$this.find('.fa-asterisk').addClass('hidden');
-                                                }
-                                                $dialogUpdateJobTypes.dialog("enable");
-                                                $dialogUpdateJobTypes.dialog("close");
-                                            } else {
-                                                alert('Unable to update component sub types: ' + d.Result);
-                                            }
-                                        },
-                                        error: function (jqXHR, textStatus, errorThrown) {
-                                            alert('Unable to update component sub types: ' + textStatus);
-                                        }
-                                    });
-                                };
-                                var buttons = $dialogUpdateJobTypes.dialog("option", "buttons", buttons);
-                                $dialogUpdateJobTypes.dialog('open');
-                            } else {
-                                alert('Unable to load component: ' + d.Result);
+                        componentRow.find('input').attr('disabled', false).removeClass('updating');
+                        if (getResponse.ok) {
+                            const component = await getResponse.json();
+                            $dialogUpdateJobTypes = $('#dialogUpdateJobTypes');
+                            $dialogUpdateJobTypes.find('input:checked').each(function () { $(this).prop('checked', false) });
+                            for (var i = 0; i < component.JobSubTypes.length; i++) {
+                                var sjt = component.JobSubTypes[i];
+                                $dialogUpdateJobTypes.find('#SubTypes_' + sjt).prop('checked', true);
                             }
-                        },
-                        error: function (jqXHR, textStatus, errorThrown) {
-                            alert('Unable to load component: ' + textStatus);
-                        }
-                    });
-                }
+                            $('#CheckboxBulkSelect_dialogUpdateJobTypes').checkboxBulkSelect('update');
+                            const buttons = $dialogUpdateJobTypes.dialog("option", "buttons");
+                            buttons['Save'] = function () {
+                                async function saveAsync() {
+                                    const body = new FormData();
+                                    let jobSubTypeCount = 0;
+                                    body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                                    body.append('id', id);
+                                    $dialogUpdateJobTypes.find('input:checked').each(function () { body.append('jobSubTypes', $(this).val()); jobSubTypeCount++; });
 
+                                    try {
+                                        const updateResponse = await fetch($deviceComponents.attr('data-updatejobsubtypesurl'), {
+                                            method: 'POST',
+                                            body: body
+                                        })
+
+                                        if (updateResponse.ok) {
+                                            if (jobSubTypeCount > 0) {
+                                                edit$this.find('.fa-asterisk').removeClass('hidden');
+                                            } else {
+                                                edit$this.find('.fa-asterisk').addClass('hidden');
+                                            }
+                                            $dialogUpdateJobTypes.dialog("close");
+                                        } else {
+                                            alert('Unable to update component sub types: ' + updateResponse.statusText);
+                                        }
+                                    } catch (e) {
+                                        alert('Unable to update component sub types: ' + e);
+                                    }
+                                }
+                                saveAsync();
+                            };
+                            $dialogUpdateJobTypes.dialog("option", "buttons", buttons);
+                            $dialogUpdateJobTypes.dialog('open');
+                        } else {
+                            alert('Unable to load component: ' + getResponse.statusText);
+                        }
+                    } catch (e) {
+                        alert('Unable to load component: ' + e);
+                    }
+                }
             }
 
             $("#dialogConfirmRemove").dialog({
@@ -278,11 +278,14 @@ else
 {
     <table id="deviceComponents" data-devicemodelid="@(Model.DeviceModelId.HasValue ? Model.DeviceModelId.Value.ToString() : string.Empty)">
         <tr>
-            <th>Description
+            <th>
+                Description
             </th>
-            <th>Cost
+            <th>
+                Cost
             </th>
-            <th>Job Types
+            <th>
+                Job Types
             </th>
         </tr>
         @foreach (var item in Model.DeviceComponents)

Disco.Web/Areas/Config/Views/DeviceModel/_DeviceComponentsTable.generated.cs

@@ -80,22 +80,77 @@ WriteLiteral(" data-devicemodelid=\"");
             #line hidden
 WriteLiteral("\"");
 
-WriteLiteral(">\r\n        <tr>\r\n            <th>Description\r\n            </th>\r\n            <th>" +
-"Cost\r\n            </th>\r\n            <th>Job Types\r\n            </th>\r\n         " +
-"   <th");
+WriteLiteral(" data-addurl=\"");
+
+            
+            #line 11 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+                                                                                                                                                    Write(Url.Action(MVC.API.DeviceModel.ComponentAdd(null, null, null)));
+
+            
+            #line default
+            #line hidden
+WriteLiteral("\"");
+
+WriteLiteral(" data-updateurl=\"");
+
+            
+            #line 11 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+                                                                                                                                                                                                                                     Write(Url.Action(MVC.API.DeviceModel.ComponentUpdate()));
+
+            
+            #line default
+            #line hidden
+WriteLiteral("\"");
+
+WriteLiteral(" data-removeurl=\"");
+
+            
+            #line 11 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+                                                                                                                                                                                                                                                                                                         Write(Url.Action(MVC.API.DeviceModel.ComponentRemove()));
+
+            
+            #line default
+            #line hidden
+WriteLiteral("\"");
+
+WriteLiteral(" data-geturl=\"");
+
+            
+            #line 11 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+                                                                                                                                                                                                                                                                                                                                                                          Write(Url.Action(MVC.API.DeviceModel.Component()));
+
+            
+            #line default
+            #line hidden
+WriteLiteral("\"");
+
+WriteLiteral(" data-updatejobsubtypesurl=\"");
+
+            
+            #line 11 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+                                                                                                                                                                                                                                                                                                                                                                                                                                                   Write(Url.Action(MVC.API.DeviceModel.ComponentUpdateJobSubTypes()));
+
+            
+            #line default
+            #line hidden
+WriteLiteral("\"");
+
+WriteLiteral(">\r\n        <tr>\r\n            <th>\r\n                Description\r\n            </th>" +
+"\r\n            <th>\r\n                Cost\r\n            </th>\r\n            <th>\r\n " +
+"               Job Types\r\n            </th>\r\n            <th");
 
 WriteLiteral(" class=\"actions\"");
 
-WriteLiteral(">&nbsp;\r\n            </th>\r\n        </tr>\r\n");
+WriteLiteral(">\r\n                &nbsp;\r\n            </th>\r\n        </tr>\r\n");
 
             
-            #line 22 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 26 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
         
             
             #line default
             #line hidden
             
-            #line 22 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 26 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
          foreach (var item in Model.DeviceComponents)
         {
 
@@ -107,7 +162,7 @@ WriteLiteral("            <tr");
 WriteLiteral(" data-devicecomponentid=\"");
 
             
-            #line 24 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 28 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
                                    Write(item.Id);
 
             
@@ -121,14 +176,14 @@ WriteLiteral(" type=\"text\"");
 
 WriteLiteral(" class=\"description\"");
 
-WriteAttribute("value", Tuple.Create(" value=\"", 883), Tuple.Create("\"", 908)
+WriteAttribute("value", Tuple.Create(" value=\"", 1318), Tuple.Create("\"", 1343)
             
-            #line 26 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
-, Tuple.Create(Tuple.Create("", 891), Tuple.Create<System.Object, System.Int32>(item.Description
+            #line 30 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+, Tuple.Create(Tuple.Create("", 1326), Tuple.Create<System.Object, System.Int32>(item.Description
             
             #line default
             #line hidden
-, 891), false)
+, 1326), false)
 );
 
 WriteLiteral(" />\r\n                </td>\r\n                <td>\r\n                    <input");
@@ -137,14 +192,14 @@ WriteLiteral(" type=\"text\"");
 
 WriteLiteral(" class=\"cost\"");
 
-WriteAttribute("value", Tuple.Create(" value=\"", 1010), Tuple.Create("\"", 1042)
+WriteAttribute("value", Tuple.Create(" value=\"", 1445), Tuple.Create("\"", 1477)
             
-            #line 29 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
-, Tuple.Create(Tuple.Create("", 1018), Tuple.Create<System.Object, System.Int32>(item.Cost.ToString("C")
+            #line 33 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+, Tuple.Create(Tuple.Create("", 1453), Tuple.Create<System.Object, System.Int32>(item.Cost.ToString("C")
             
             #line default
             #line hidden
-, 1018), false)
+, 1453), false)
 );
 
 WriteLiteral(" />\r\n                </td>\r\n                <td>\r\n                    <span");
@@ -157,17 +212,17 @@ WriteLiteral(" class=\"fa fa-list-alt fa-stack-2x\"");
 
 WriteLiteral("></i>\r\n                        <i");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 1237), Tuple.Create("\"", 1328)
-, Tuple.Create(Tuple.Create("", 1245), Tuple.Create("fa", 1245), true)
-, Tuple.Create(Tuple.Create(" ", 1247), Tuple.Create("fa-asterisk", 1248), true)
-, Tuple.Create(Tuple.Create(" ", 1259), Tuple.Create("fa-stack-1x", 1260), true)
+WriteAttribute("class", Tuple.Create(" class=\"", 1672), Tuple.Create("\"", 1763)
+, Tuple.Create(Tuple.Create("", 1680), Tuple.Create("fa", 1680), true)
+, Tuple.Create(Tuple.Create(" ", 1682), Tuple.Create("fa-asterisk", 1683), true)
+, Tuple.Create(Tuple.Create(" ", 1694), Tuple.Create("fa-stack-1x", 1695), true)
             
-            #line 34 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
-, Tuple.Create(Tuple.Create("", 1271), Tuple.Create<System.Object, System.Int32>(item.JobSubTypes.Count == 0 ? " hidden" : string.Empty
+            #line 38 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+, Tuple.Create(Tuple.Create("", 1706), Tuple.Create<System.Object, System.Int32>(item.JobSubTypes.Count == 0 ? " hidden" : string.Empty
             
             #line default
             #line hidden
-, 1271), false)
+, 1706), false)
 );
 
 WriteLiteral("></i>\r\n                    </span>\r\n                </td>\r\n                <td>\r\n" +
@@ -178,7 +233,7 @@ WriteLiteral(" class=\"fa fa-times-circle remove\"");
 WriteLiteral("></i>\r\n                </td>\r\n            </tr>\r\n");
 
             
-            #line 41 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 45 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
         }
 
             
@@ -200,213 +255,142 @@ WriteLiteral("    <script");
 
 WriteLiteral(" type=\"text/javascript\"");
 
-WriteLiteral(@">
-        $(function () {
-            var $deviceComponents = $('#deviceComponents');
-
-            $('#addDeviceComponent').click(function () {
-                var dc = $('<tr><td><input type=""text"" class=""description"" /></td><td><input type=""text"" class=""cost"" /></td><td><span class=""fa-stack edit""><i class=""fa fa-list-alt fa-stack-2x""></i><i class=""fa fa-asterisk fa-stack-1x hidden""></i></span></td><td><i class=""fa fa-times-circle remove""></i></td></tr>');
-                dc.find('input').focus(function () { $(this).select() })
-                dc.insertBefore($deviceComponents.find('tr').last());
-                dc.find('input.description').focus();
-                return false;
-            });
-
-            $deviceComponents.on('change', 'input', updateComponent);
-            $deviceComponents.on('focus', 'input', function () { $(this).select(); });
-
-            $deviceComponents.on('click', '.remove', removeComponent);
-            $deviceComponents.on('click', '.edit', editComponentJobTypes);
-
-            function removeComponentConfirmed(id, row) {
-                var data = { id: id };
-                $.ajax({
-                    url: '");
-
-            
-            #line 69 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
-                     Write(Url.Action(MVC.API.DeviceModel.ComponentRemove()));
-
-            
-            #line default
-            #line hidden
-WriteLiteral("\',\r\n                    dataType: \'json\',\r\n                    data: data,\r\n     " +
-"               success: function (d) {\r\n                        if (d == \'OK\') {" +
-"\r\n                            row.remove();\r\n                        } else {\r\n " +
-"                           alert(\'Unable to remove component: \' + d);\r\n         " +
-"               }\r\n                    },\r\n                    error: function (j" +
-"qXHR, textStatus, errorThrown) {\r\n                        alert(\'Unable to remov" +
-"e component: \' + textStatus);\r\n                    }\r\n                });\r\n     " +
-"   }\r\n            function removeComponent() {\r\n                var componentRow" +
-" = $(this).closest(\'tr\');\r\n                var id = componentRow.attr(\'data-devi" +
-"cecomponentid\');\r\n                if (id) {\r\n                    var dialog = $(" +
-"\"#dialogConfirmRemove\");\r\n                    var buttons = dialog.dialog(\"optio" +
-"n\", \"buttons\");\r\n                    buttons[\'Remove\'] = function () { removeCom" +
-"ponentConfirmed(id, componentRow); $(this).dialog(\"close\"); };\r\n                " +
-"    var buttons = dialog.dialog(\"option\", \"buttons\", buttons);\r\n                " +
-"    dialog.dialog(\'open\');\r\n                } else {\r\n                    // New" +
-" - Remove\r\n                    componentRow.remove();\r\n                }\r\n      " +
-"      }\r\n            function updateComponent() {\r\n                var component" +
-"Row = $(this).closest(\'tr\');\r\n                componentRow.find(\'input\').attr(\'d" +
-"isabled\', true).addClass(\'updating\');\r\n\r\n                var id = componentRow.a" +
-"ttr(\'data-devicecomponentid\');\r\n                if (id) {\r\n                    /" +
-"/ Update\r\n                    var data = {\r\n                        id: id,\r\n   " +
-"                     Description: componentRow.find(\'input.description\').val(),\r" +
-"\n                        Cost: componentRow.find(\'input.cost\').val()\r\n          " +
-"          };\r\n                    $.ajax({\r\n                        url: \'");
-
-            
-            #line 111 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
-                         Write(Url.Action(MVC.API.DeviceModel.ComponentUpdate()));
-
-            
-            #line default
-            #line hidden
-WriteLiteral(@"',
-                        dataType: 'json',
-                        type: 'POST',
-                        data: data,
-                        success: function (d) {
-                            componentRow.find('input').attr('disabled', false).removeClass('updating');
-                            if (d.Result == 'OK') {
-                                componentRow.find('input.description').val(d.Component.Description);
-                                componentRow.find('input.cost').val(d.Component.Cost);
-                            } else {
-                                alert('Unable to update component: ' + d.Result);
-                            }
-                        },
-                        error: function (jqXHR, textStatus, errorThrown) {
-                            alert('Unable to update component: ' + textStatus);
-                        }
-                    });
-                } else {
-                    // Add
-                    id = componentRow.closest('table').attr('data-devicemodelid');
-                    var data = {
-                        id: id,
-                        Description: componentRow.find('input.description').val(),
-                        Cost: componentRow.find('input.cost').val()
-                    };
-                    $.ajax({
-                        url: '");
-
-            
-            #line 137 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
-                         Write(Url.Action(MVC.API.DeviceModel.ComponentAdd(null, null, null)));
-
-            
-            #line default
-            #line hidden
-WriteLiteral(@"',
-                        dataType: 'json',
-                        type: 'POST',
-                        data: data,
-                        success: function (d) {
-                            componentRow.find('input').attr('disabled', false).removeClass('updating');
-                            if (d.Result == 'OK') {
-                                componentRow.attr('data-devicecomponentid', d.Component.Id);
-                                componentRow.find('input.description').val(d.Component.Description);
-                                componentRow.find('input.cost').val(d.Component.Cost);
-                            } else {
-                                alert('Unable to add component: ' + d.Result);
-                            }
-                        },
-                        error: function (jqXHR, textStatus, errorThrown) {
-                            alert('Unable to add component: ' + textStatus);
-                        }
-                    });
-                }
-            }
-            function editComponentJobTypes() {
-                var edit$this = $(this);
-                var componentRow = edit$this.closest('tr');
-
-                var id = componentRow.attr('data-devicecomponentid');
-
-                if (id) {
-                    var data = {
-                        id: id
-                    };
-                    $.ajax({
-                        url: '");
-
-            
-            #line 168 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
-                         Write(Url.Action(MVC.API.DeviceModel.Component()));
-
-            
-            #line default
-            #line hidden
-WriteLiteral("\',\r\n                        dataType: \'json\',\r\n                        data: data" +
-",\r\n                        success: function (d) {\r\n                            " +
-"componentRow.find(\'input\').attr(\'disabled\', false).removeClass(\'updating\');\r\n   " +
-"                         if (d.Result == \'OK\') {\r\n                              " +
-"  $dialogUpdateJobTypes = $(\'#dialogUpdateJobTypes\');\r\n                         " +
-"       $dialogUpdateJobTypes.find(\'input:checked\').each(function () { $(this).pr" +
-"op(\'checked\', false) });\r\n                                for (var i = 0; i < d." +
-"Component.JobSubTypes.length; i++) {\r\n                                    var sj" +
-"t = d.Component.JobSubTypes[i];\r\n                                    $dialogUpda" +
-"teJobTypes.find(\'#SubTypes_\' + sjt).prop(\'checked\', true);\r\n                    " +
-"            }\r\n                                $(\'#CheckboxBulkSelect_dialogUpda" +
-"teJobTypes\').checkboxBulkSelect(\'update\');\r\n                                var " +
-"buttons = $dialogUpdateJobTypes.dialog(\"option\", \"buttons\");\r\n                  " +
-"              buttons[\'Save\'] = function () {\r\n                                 " +
-"   $dialogUpdateJobTypes.dialog(\"disable\");\r\n                                   " +
-" var selectedSJTs = [];\r\n                                    $dialogUpdateJobTyp" +
-"es.find(\'input:checked\').each(function () { selectedSJTs.push($(this).val()) });" +
-"\r\n\r\n                                    var data = {\r\n                          " +
-"              id: id,\r\n                                        JobSubTypes: sele" +
-"ctedSJTs\r\n                                    };\r\n                              " +
-"      $.ajax({\r\n                                        url: \'");
-
-            
-            #line 192 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
-                                         Write(Url.Action(MVC.API.DeviceModel.ComponentUpdateJobSubTypes()));
-
-            
-            #line default
-            #line hidden
-WriteLiteral("\',\r\n                                        dataType: \'json\',\r\n                  " +
-"                      type: \'POST\',\r\n                                        tra" +
-"ditional: true,\r\n                                        data: data,\r\n          " +
-"                              success: function (d) {\r\n                         " +
-"                   if (d.Result == \'OK\') {\r\n                                    " +
-"            if (d.Component.JobSubTypes.length > 0) {\r\n                         " +
-"                           edit$this.find(\'.fa-asterisk\').removeClass(\'hidden\');" +
-"\r\n                                                } else {\r\n                    " +
-"                                edit$this.find(\'.fa-asterisk\').addClass(\'hidden\'" +
-");\r\n                                                }\r\n                         " +
-"                       $dialogUpdateJobTypes.dialog(\"enable\");\r\n                " +
-"                                $dialogUpdateJobTypes.dialog(\"close\");\r\n        " +
-"                                    } else {\r\n                                  " +
-"              alert(\'Unable to update component sub types: \' + d.Result);\r\n     " +
-"                                       }\r\n                                      " +
-"  },\r\n                                        error: function (jqXHR, textStatus" +
-", errorThrown) {\r\n                                            alert(\'Unable to u" +
-"pdate component sub types: \' + textStatus);\r\n                                   " +
-"     }\r\n                                    });\r\n                               " +
-" };\r\n                                var buttons = $dialogUpdateJobTypes.dialog(" +
-"\"option\", \"buttons\", buttons);\r\n                                $dialogUpdateJob" +
-"Types.dialog(\'open\');\r\n                            } else {\r\n                   " +
-"             alert(\'Unable to load component: \' + d.Result);\r\n                  " +
-"          }\r\n                        },\r\n                        error: function" +
-" (jqXHR, textStatus, errorThrown) {\r\n                            alert(\'Unable t" +
-"o load component: \' + textStatus);\r\n                        }\r\n                 " +
-"   });\r\n                }\r\n\r\n            }\r\n\r\n            $(\"#dialogConfirmRemov" +
-"e\").dialog({\r\n                resizable: false,\r\n                height: 140,\r\n " +
-"               modal: true,\r\n                autoOpen: false,\r\n                b" +
-"uttons: {\r\n                    \"Remove\": function () {\r\n                        " +
-"$(this).dialog(\"close\");\r\n                    },\r\n                    Cancel: fu" +
-"nction () {\r\n                        $(this).dialog(\"close\");\r\n                 " +
-"   }\r\n                }\r\n            });\r\n\r\n            $(\'#dialogUpdateJobTypes" +
-"\').dialog({\r\n                resizable: false,\r\n                modal: true,\r\n  " +
-"              autoOpen: false,\r\n                width: 550,\r\n                but" +
-"tons: {\r\n                    \"Save\": function () {\r\n                        $(th" +
-"is).dialog(\"close\");\r\n                    },\r\n                    Cancel: functi" +
-"on () {\r\n                        $(this).dialog(\"close\");\r\n                    }" +
-"\r\n                }\r\n            });\r\n\r\n            $(\'#CheckboxBulkSelect_dialo" +
-"gUpdateJobTypes\').checkboxBulkSelect({ parentSelector: \'div\' });\r\n        });\r\n " +
-"   </script>\r\n");
+WriteLiteral(">\r\n        $(function () {\r\n            const $deviceComponents = $(\'#deviceCompo" +
+"nents\');\r\n\r\n            $(\'#addDeviceComponent\').click(function () {\r\n          " +
+"      const dc = $(\'<tr><td><input type=\"text\" class=\"description\" /></td><td><i" +
+"nput type=\"text\" class=\"cost\" /></td><td><span class=\"fa-stack edit\"><i class=\"f" +
+"a fa-list-alt fa-stack-2x\"></i><i class=\"fa fa-asterisk fa-stack-1x hidden\"></i>" +
+"</span></td><td><i class=\"fa fa-times-circle remove\"></i></td></tr>\');\r\n        " +
+"        dc.insertBefore($deviceComponents.find(\'tr\').last());\r\n                d" +
+"c.find(\'input.description\').focus();\r\n                return false;\r\n           " +
+" });\r\n\r\n            $deviceComponents.on(\'change\', \'input\', function () { update" +
+"Component(this); });\r\n            $deviceComponents.on(\'focus\', \'input\', functio" +
+"n () { $(this).select(); });\r\n\r\n            $deviceComponents.on(\'click\', \'.remo" +
+"ve\', removeComponent);\r\n            $deviceComponents.on(\'click\', \'.edit\', funct" +
+"ion () { editComponentJobTypes(this); });\r\n\r\n            async function removeCo" +
+"mponentConfirmed(id, row) {\r\n                const body = new FormData();\r\n     " +
+"           body.append(\'__RequestVerificationToken\', document.body.dataset.antif" +
+"orgery);\r\n                body.append(\'id\', id);\r\n\r\n                try {\r\n     " +
+"               const response = await fetch($deviceComponents.attr(\'data-removeu" +
+"rl\'), {\r\n                        method: \'POST\',\r\n                        body: " +
+"body\r\n                    });\r\n\r\n                    if (response.ok) {\r\n       " +
+"                 row.remove();\r\n                    } else {\r\n                  " +
+"      alert(\'Unable to remove component: \' + response.statusText);\r\n            " +
+"        }\r\n                } catch (e) {\r\n                    alert(\'Unable to r" +
+"emove component: \' + e);\r\n                }\r\n            }\r\n            function" +
+" removeComponent() {\r\n                const componentRow = $(this).closest(\'tr\')" +
+";\r\n                const id = componentRow.attr(\'data-devicecomponentid\');\r\n    " +
+"            if (id) {\r\n                    const dialog = $(\"#dialogConfirmRemov" +
+"e\");\r\n                    const buttons = dialog.dialog(\"option\", \"buttons\");\r\n " +
+"                   buttons[\'Remove\'] = function () { removeComponentConfirmed(id" +
+", componentRow); $(this).dialog(\"close\"); };\r\n                    dialog.dialog(" +
+"\"option\", \"buttons\", buttons);\r\n                    dialog.dialog(\'open\');\r\n    " +
+"            } else {\r\n                    // New - Remove\r\n                    c" +
+"omponentRow.remove();\r\n                }\r\n            }\r\n            async funct" +
+"ion updateComponent(input) {\r\n                const componentRow = $(input).clos" +
+"est(\'tr\');\r\n                componentRow.find(\'input\').attr(\'disabled\', true).ad" +
+"dClass(\'updating\');\r\n\r\n                const id = componentRow.attr(\'data-device" +
+"componentid\');\r\n                if (id) {\r\n                    // Update\r\n      " +
+"              const body = new FormData();\r\n                    body.append(\'__R" +
+"equestVerificationToken\', document.body.dataset.antiforgery);\r\n                 " +
+"   body.append(\'id\', id);\r\n                    body.append(\'description\', compon" +
+"entRow.find(\'input.description\').val());\r\n                    body.append(\'cost\'" +
+", componentRow.find(\'input.cost\').val());\r\n\r\n                    try {\r\n        " +
+"                const response = await fetch($deviceComponents.attr(\'data-update" +
+"url\'), {\r\n                            method: \'POST\',\r\n                         " +
+"   body: body\r\n                        });\r\n\r\n                        if (respon" +
+"se.ok) {\r\n                            const result = await response.json();\r\n   " +
+"                         componentRow.find(\'input\').attr(\'disabled\', false).remo" +
+"veClass(\'updating\');\r\n                            componentRow.find(\'input.descr" +
+"iption\').val(result.Description);\r\n                            componentRow.find" +
+"(\'input.cost\').val(result.Cost);\r\n                        } else {\r\n            " +
+"                alert(\'Unable to update component: \' + response.statusText);\r\n  " +
+"                      }\r\n                    } catch (e) {\r\n                    " +
+"    alert(\'Unable to update component: \' + e);\r\n                    }\r\n         " +
+"       } else {\r\n                    // Add\r\n                    const modelId =" +
+" componentRow.closest(\'table\').attr(\'data-devicemodelid\');\r\n                    " +
+"const body = new FormData();\r\n                    body.append(\'__RequestVerifica" +
+"tionToken\', document.body.dataset.antiforgery);\r\n                    body.append" +
+"(\'id\', modelId);\r\n                    body.append(\'description\', componentRow.fi" +
+"nd(\'input.description\').val());\r\n                    body.append(\'cost\', compone" +
+"ntRow.find(\'input.cost\').val());\r\n\r\n                    try {\r\n                 " +
+"       const response = await fetch($deviceComponents.attr(\'data-addurl\'), {\r\n  " +
+"                          method: \'POST\',\r\n                            body: bod" +
+"y\r\n                        });\r\n\r\n                        if (response.ok) {\r\n  " +
+"                          const result = await response.json();\r\n               " +
+"             componentRow.find(\'input\').attr(\'disabled\', false).removeClass(\'upd" +
+"ating\');\r\n                            componentRow.attr(\'data-devicecomponentid\'" +
+", result.Id);\r\n                            componentRow.find(\'input.description\'" +
+").val(result.Description);\r\n                            componentRow.find(\'input" +
+".cost\').val(result.Cost);\r\n                        } else {\r\n                   " +
+"         alert(\'Unable to add component: \' + response.statusText);\r\n            " +
+"            }\r\n                    } catch (e) {\r\n                        alert(" +
+"\'Unable to add component: \' + e);\r\n                    }\r\n                }\r\n   " +
+"         }\r\n            async function editComponentJobTypes(input) {\r\n         " +
+"       const edit$this = $(input);\r\n                const componentRow = edit$th" +
+"is.closest(\'tr\');\r\n                const id = componentRow.attr(\'data-devicecomp" +
+"onentid\');\r\n\r\n                if (id) {\r\n                    try {\r\n            " +
+"            const body = new FormData();\r\n                        body.append(\'_" +
+"_RequestVerificationToken\', document.body.dataset.antiforgery);\r\n               " +
+"         body.append(\'id\', id);\r\n                        const getResponse = awa" +
+"it fetch($deviceComponents.attr(\'data-geturl\'), {\r\n                            m" +
+"ethod: \'POST\',\r\n                            body: body\r\n                        " +
+"})\r\n\r\n                        componentRow.find(\'input\').attr(\'disabled\', false)" +
+".removeClass(\'updating\');\r\n                        if (getResponse.ok) {\r\n      " +
+"                      const component = await getResponse.json();\r\n             " +
+"               $dialogUpdateJobTypes = $(\'#dialogUpdateJobTypes\');\r\n            " +
+"                $dialogUpdateJobTypes.find(\'input:checked\').each(function () { $" +
+"(this).prop(\'checked\', false) });\r\n                            for (var i = 0; i" +
+" < component.JobSubTypes.length; i++) {\r\n                                var sjt" +
+" = component.JobSubTypes[i];\r\n                                $dialogUpdateJobTy" +
+"pes.find(\'#SubTypes_\' + sjt).prop(\'checked\', true);\r\n                           " +
+" }\r\n                            $(\'#CheckboxBulkSelect_dialogUpdateJobTypes\').ch" +
+"eckboxBulkSelect(\'update\');\r\n                            const buttons = $dialog" +
+"UpdateJobTypes.dialog(\"option\", \"buttons\");\r\n                            buttons" +
+"[\'Save\'] = function () {\r\n                                async function saveAsy" +
+"nc() {\r\n                                    const body = new FormData();\r\n      " +
+"                              let jobSubTypeCount = 0;\r\n                        " +
+"            body.append(\'__RequestVerificationToken\', document.body.dataset.anti" +
+"forgery);\r\n                                    body.append(\'id\', id);\r\n         " +
+"                           $dialogUpdateJobTypes.find(\'input:checked\').each(func" +
+"tion () { body.append(\'jobSubTypes\', $(this).val()); jobSubTypeCount++; });\r\n\r\n " +
+"                                   try {\r\n                                      " +
+"  const updateResponse = await fetch($deviceComponents.attr(\'data-updatejobsubty" +
+"pesurl\'), {\r\n                                            method: \'POST\',\r\n      " +
+"                                      body: body\r\n                              " +
+"          })\r\n\r\n                                        if (updateResponse.ok) {" +
+"\r\n                                            if (jobSubTypeCount > 0) {\r\n      " +
+"                                          edit$this.find(\'.fa-asterisk\').removeC" +
+"lass(\'hidden\');\r\n                                            } else {\r\n         " +
+"                                       edit$this.find(\'.fa-asterisk\').addClass(\'" +
+"hidden\');\r\n                                            }\r\n                      " +
+"                      $dialogUpdateJobTypes.dialog(\"close\");\r\n                  " +
+"                      } else {\r\n                                            aler" +
+"t(\'Unable to update component sub types: \' + updateResponse.statusText);\r\n      " +
+"                                  }\r\n                                    } catch" +
+" (e) {\r\n                                        alert(\'Unable to update componen" +
+"t sub types: \' + e);\r\n                                    }\r\n                   " +
+"             }\r\n                                saveAsync();\r\n                  " +
+"          };\r\n                            $dialogUpdateJobTypes.dialog(\"option\"," +
+" \"buttons\", buttons);\r\n                            $dialogUpdateJobTypes.dialog(" +
+"\'open\');\r\n                        } else {\r\n                            alert(\'U" +
+"nable to load component: \' + getResponse.statusText);\r\n                        }" +
+"\r\n                    } catch (e) {\r\n                        alert(\'Unable to lo" +
+"ad component: \' + e);\r\n                    }\r\n                }\r\n            }\r\n" +
+"\r\n            $(\"#dialogConfirmRemove\").dialog({\r\n                resizable: fal" +
+"se,\r\n                height: 140,\r\n                modal: true,\r\n               " +
+" autoOpen: false,\r\n                buttons: {\r\n                    \"Remove\": fun" +
+"ction () {\r\n                        $(this).dialog(\"close\");\r\n                  " +
+"  },\r\n                    Cancel: function () {\r\n                        $(this)" +
+".dialog(\"close\");\r\n                    }\r\n                }\r\n            });\r\n\r\n" +
+"            $(\'#dialogUpdateJobTypes\').dialog({\r\n                resizable: fals" +
+"e,\r\n                modal: true,\r\n                autoOpen: false,\r\n            " +
+"    width: 550,\r\n                buttons: {\r\n                    \"Save\": functio" +
+"n () {\r\n                        $(this).dialog(\"close\");\r\n                    }," +
+"\r\n                    Cancel: function () {\r\n                        $(this).dia" +
+"log(\"close\");\r\n                    }\r\n                }\r\n            });\r\n\r\n    " +
+"        $(\'#CheckboxBulkSelect_dialogUpdateJobTypes\').checkboxBulkSelect({ paren" +
+"tSelector: \'div\' });\r\n        });\r\n    </script>\r\n");
 
 WriteLiteral("    <div");
 
@@ -470,18 +454,18 @@ WriteLiteral(" data-devicemodelid=\"");
             #line hidden
 WriteLiteral("\"");
 
-WriteLiteral(">\r\n        <tr>\r\n            <th>Description\r\n            </th>\r\n            <th>" +
-"Cost\r\n            </th>\r\n            <th>Job Types\r\n            </th>\r\n        <" +
-"/tr>\r\n");
+WriteLiteral(">\r\n        <tr>\r\n            <th>\r\n                Description\r\n            </th>" +
+"\r\n            <th>\r\n                Cost\r\n            </th>\r\n            <th>\r\n " +
+"               Job Types\r\n            </th>\r\n        </tr>\r\n");
 
             
-            #line 288 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 291 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
         
             
             #line default
             #line hidden
             
-            #line 288 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 291 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
          foreach (var item in Model.DeviceComponents)
         {
 
@@ -493,7 +477,7 @@ WriteLiteral("            <tr");
 WriteLiteral(" data-devicecomponentid=\"");
 
             
-            #line 290 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 293 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
                                    Write(item.Id);
 
             
@@ -506,7 +490,7 @@ WriteLiteral(">\r\n                <td>\r\n");
 WriteLiteral("                    ");
 
             
-            #line 292 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 295 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
                Write(item.Description);
 
             
@@ -517,7 +501,7 @@ WriteLiteral("\r\n                </td>\r\n                <td>\r\n");
 WriteLiteral("                    ");
 
             
-            #line 295 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 298 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
                Write(item.Cost.ToString("C"));
 
             
@@ -526,13 +510,13 @@ WriteLiteral("                    ");
 WriteLiteral("\r\n                </td>\r\n                <td>\r\n");
 
             
-            #line 298 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 301 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
                     
             
             #line default
             #line hidden
             
-            #line 298 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 301 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
                      if (item.JobSubTypes.Count > 0)
                     {
 
@@ -542,13 +526,13 @@ WriteLiteral("\r\n                </td>\r\n                <td>\r\n");
 WriteLiteral("                        <ul>\r\n");
 
             
-            #line 301 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 304 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
                             
             
             #line default
             #line hidden
             
-            #line 301 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 304 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
                              foreach (var jst in item.JobSubTypes)
                             {
 
@@ -558,7 +542,7 @@ WriteLiteral("                        <ul>\r\n");
 WriteLiteral("                                <li>");
 
             
-            #line 303 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 306 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
                                Write(jst.Description);
 
             
@@ -567,7 +551,7 @@ WriteLiteral("                                <li>");
 WriteLiteral("</li>\r\n");
 
             
-            #line 304 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 307 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
                             }
 
             
@@ -576,7 +560,7 @@ WriteLiteral("</li>\r\n");
 WriteLiteral("                        </ul>\r\n");
 
             
-            #line 306 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 309 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
                     }
                     else
                     {
@@ -591,7 +575,7 @@ WriteLiteral(" class=\"smallMessage\"");
 WriteLiteral(">&lt;None Specified&gt;</span>\r\n");
 
             
-            #line 310 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 313 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
                     }
 
             
@@ -600,7 +584,7 @@ WriteLiteral(">&lt;None Specified&gt;</span>\r\n");
 WriteLiteral("                </td>\r\n            </tr>\r\n");
 
             
-            #line 313 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 316 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
         }
 
             
@@ -609,7 +593,7 @@ WriteLiteral("                </td>\r\n            </tr>\r\n");
 WriteLiteral("    </table>\r\n");
 
             
-            #line 315 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
+            #line 318 "..\..\Areas\Config\Views\DeviceModel\_DeviceComponentsTable.cshtml"
 }
             
             #line default

Disco.Web/Areas/Config/Views/DeviceProfile/Create.cshtml

@@ -1,11 +1,12 @@
 @model Disco.Web.Areas.Config.Models.DeviceProfile.CreateModel
 @{
     Authorization.RequireAll(Claims.Config.DeviceProfile.Create, Claims.Config.DeviceProfile.Configure);
-    
+
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Device Profiles", MVC.Config.DeviceProfile.Index(null), "Create");
 }
 @using (Html.BeginForm())
-{ 
+{
+    @Html.AntiForgeryToken()
     @Html.ValidationSummary(false)
     <div class="form" style="width: 450px">
         <table>
@@ -14,28 +15,26 @@
                     Name:
                 </th>
                 <td>
-                @Html.TextBoxFor(model => model.DeviceProfile.Name)<br />@Html.ValidationMessageFor(model => model.DeviceProfile.Name)
+                    @Html.TextBoxFor(model => model.Name)<br />@Html.ValidationMessageFor(model => model.Name)
                 </td>
             </tr>
             <tr>
                 <th>
                     Short Name:
                 </th>
-                <td>@Html.TextBoxFor(model => model.DeviceProfile.ShortName)<br />@Html.ValidationMessageFor(model => model.DeviceProfile.ShortName)
+                <td>
+                    @Html.TextBoxFor(model => model.ShortName)<br />@Html.ValidationMessageFor(model => model.ShortName)
                 </td>
             </tr>
             <tr>
                 <th>
                     Description:
                 </th>
-                <td>@Html.TextBoxFor(model => model.DeviceProfile.Description)<br />@Html.ValidationMessageFor(model => model.DeviceProfile.Description)
+                <td>
+                    @Html.TextBoxFor(model => model.Description)<br />@Html.ValidationMessageFor(model => model.Description)
                 </td>
             </tr>
         </table>
-        @Html.HiddenFor(model => model.DeviceProfile.ComputerNameTemplate)
-        @Html.HiddenFor(model => model.DeviceProfile.ProvisionADAccount)
-        @Html.HiddenFor(model => model.DeviceProfile.DistributionType)
-        @Html.HiddenFor(model => model.DeviceProfile.OrganisationalUnit)
         <p class="actions">
             <input type="submit" class="button" value="Create" />
         </p>

Disco.Web/Areas/Config/Views/DeviceProfile/Create.generated.cs

@@ -47,7 +47,7 @@ namespace Disco.Web.Areas.Config.Views.DeviceProfile
             #line 2 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
   
     Authorization.RequireAll(Claims.Config.DeviceProfile.Create, Claims.Config.DeviceProfile.Configure);
-    
+
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Device Profiles", MVC.Config.DeviceProfile.Index(null), "Create");
 
             
@@ -58,20 +58,34 @@ WriteLiteral("\r\n");
             
             #line 7 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
  using (Html.BeginForm())
-{ 
+{
     
             
             #line default
             #line hidden
             
             #line 9 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
-Write(Html.ValidationSummary(false));
+Write(Html.AntiForgeryToken());
 
             
             #line default
             #line hidden
             
             #line 9 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
+                            
+    
+            
+            #line default
+            #line hidden
+            
+            #line 10 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
+Write(Html.ValidationSummary(false));
+
+            
+            #line default
+            #line hidden
+            
+            #line 10 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
                                   
 
             
@@ -86,11 +100,11 @@ WriteLiteral(" style=\"width: 450px\"");
 WriteLiteral(">\r\n        <table>\r\n            <tr>\r\n                <th>\r\n                    N" +
 "ame:\r\n                </th>\r\n                <td>\r\n");
 
-WriteLiteral("                ");
+WriteLiteral("                    ");
 
             
-            #line 17 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
-           Write(Html.TextBoxFor(model => model.DeviceProfile.Name));
+            #line 18 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
+               Write(Html.TextBoxFor(model => model.Name));
 
             
             #line default
@@ -98,18 +112,21 @@ WriteLiteral("                ");
 WriteLiteral("<br />");
 
             
-            #line 17 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
-                                                                    Write(Html.ValidationMessageFor(model => model.DeviceProfile.Name));
+            #line 18 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
+                                                          Write(Html.ValidationMessageFor(model => model.Name));
 
             
             #line default
             #line hidden
 WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>\r\n                <th" +
-">\r\n                    Short Name:\r\n                </th>\r\n                <td>");
+">\r\n                    Short Name:\r\n                </th>\r\n                <td>\r" +
+"\n");
+
+WriteLiteral("                    ");
 
             
-            #line 24 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
-               Write(Html.TextBoxFor(model => model.DeviceProfile.ShortName));
+            #line 26 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
+               Write(Html.TextBoxFor(model => model.ShortName));
 
             
             #line default
@@ -117,19 +134,21 @@ WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>
 WriteLiteral("<br />");
 
             
-            #line 24 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
-                                                                             Write(Html.ValidationMessageFor(model => model.DeviceProfile.ShortName));
+            #line 26 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
+                                                               Write(Html.ValidationMessageFor(model => model.ShortName));
 
             
             #line default
             #line hidden
 WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>\r\n                <th" +
 ">\r\n                    Description:\r\n                </th>\r\n                <td>" +
-"");
+"\r\n");
+
+WriteLiteral("                    ");
 
             
-            #line 31 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
-               Write(Html.TextBoxFor(model => model.DeviceProfile.Description));
+            #line 34 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
+               Write(Html.TextBoxFor(model => model.Description));
 
             
             #line default
@@ -137,57 +156,13 @@ WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>
 WriteLiteral("<br />");
 
             
-            #line 31 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
-                                                                               Write(Html.ValidationMessageFor(model => model.DeviceProfile.Description));
+            #line 34 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
+                                                                 Write(Html.ValidationMessageFor(model => model.Description));
 
             
             #line default
             #line hidden
-WriteLiteral("\r\n                </td>\r\n            </tr>\r\n        </table>\r\n");
-
-WriteLiteral("        ");
-
-            
-            #line 35 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
-   Write(Html.HiddenFor(model => model.DeviceProfile.ComputerNameTemplate));
-
-            
-            #line default
-            #line hidden
-WriteLiteral("\r\n");
-
-WriteLiteral("        ");
-
-            
-            #line 36 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
-   Write(Html.HiddenFor(model => model.DeviceProfile.ProvisionADAccount));
-
-            
-            #line default
-            #line hidden
-WriteLiteral("\r\n");
-
-WriteLiteral("        ");
-
-            
-            #line 37 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
-   Write(Html.HiddenFor(model => model.DeviceProfile.DistributionType));
-
-            
-            #line default
-            #line hidden
-WriteLiteral("\r\n");
-
-WriteLiteral("        ");
-
-            
-            #line 38 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
-   Write(Html.HiddenFor(model => model.DeviceProfile.OrganisationalUnit));
-
-            
-            #line default
-            #line hidden
-WriteLiteral("\r\n        <p");
+WriteLiteral("\r\n                </td>\r\n            </tr>\r\n        </table>\r\n        <p");
 
 WriteLiteral(" class=\"actions\"");
 
@@ -209,7 +184,7 @@ WriteLiteral(">\r\n        $(function () {\r\n            $(\'#Name\').focus().s
 "\r\n    </script>\r\n");
 
             
-            #line 48 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
+            #line 47 "..\..\Areas\Config\Views\DeviceProfile\Create.cshtml"
 }
 
             

Disco.Web/Areas/Config/Views/DeviceProfile/Defaults.cshtml

@@ -1,8 +1,10 @@
 @model Disco.Web.Areas.Config.Models.DeviceProfile.DefaultsModel
 @{
     Authorization.Require(Claims.Config.DeviceProfile.ConfigureDefaults);
-    
+
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Device Profiles", MVC.Config.DeviceProfile.Index(null), "Defaults");
+
+    Html.BundleDeferred("~/ClientScripts/Modules/Disco-PropertyChangeHelpers");
 }
 <div class="form" style="width: 600px">
     <table>
@@ -15,19 +17,12 @@
                 @AjaxHelpers.AjaxLoader()
                 <script type="text/javascript">
                     $(function () {
-                        $('#Default').change(function () {
-                            $this = $(this);
-                            $ajaxLoading = $this.next('.ajaxLoading').show();
-                            var data = { id: $this.val() };
-                            $.getJSON('@(Url.Action(MVC.API.DeviceProfile.Default()))', data, function (response, result) {
-                                if (result != 'success' || response != 'OK') {
-                                    alert('Unable to change Default Device Profile:\n' + response);
-                                    $ajaxLoading.hide();
-                                } else {
-                                    $ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
-                                }
-                            });
-                        });
+                        document.DiscoFunctions.PropertyChangeHelper(
+                            $('#Default'),
+                            'Default Profile',
+                            '@Url.Action(MVC.API.DeviceProfile.Default())',
+                            'id'
+                        );
                     });
                 </script>
             </td>
@@ -41,19 +36,12 @@
                 @AjaxHelpers.AjaxLoader()
                 <script type="text/javascript">
                     $(function () {
-                        $('#DefaultAddDeviceOffline').change(function () {
-                            $this = $(this);
-                            $ajaxLoading = $this.next('.ajaxLoading').show();
-                            var data = { id: $this.val() };
-                            $.getJSON('@(Url.Action(MVC.API.DeviceProfile.DefaultAddDeviceOffline()))', data, function (response, result) {
-                                if (result != 'success' || response != 'OK') {
-                                    alert('Unable to change Default Add Device Offline Device Profile:\n' + response);
-                                    $ajaxLoading.hide();
-                                } else {
-                                    $ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
-                                }
-                            });
-                        });
+                        document.DiscoFunctions.PropertyChangeHelper(
+                            $('#DefaultAddDeviceOffline'),
+                            'Default Add Device Offline Profile',
+                            '@Url.Action(MVC.API.DeviceProfile.DefaultAddDeviceOffline())',
+                            'id'
+                        );
                     });
                 </script>
             </td>

Disco.Web/Areas/Config/Views/DeviceProfile/Defaults.generated.cs

@@ -47,9 +47,11 @@ namespace Disco.Web.Areas.Config.Views.DeviceProfile
             #line 2 "..\..\Areas\Config\Views\DeviceProfile\Defaults.cshtml"
   
     Authorization.Require(Claims.Config.DeviceProfile.ConfigureDefaults);
-    
+
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Device Profiles", MVC.Config.DeviceProfile.Index(null), "Defaults");
 
+    Html.BundleDeferred("~/ClientScripts/Modules/Disco-PropertyChangeHelpers");
+
             
             #line default
             #line hidden
@@ -74,7 +76,7 @@ WriteLiteral(">\r\n");
 WriteLiteral("                ");
 
             
-            #line 14 "..\..\Areas\Config\Views\DeviceProfile\Defaults.cshtml"
+            #line 16 "..\..\Areas\Config\Views\DeviceProfile\Defaults.cshtml"
            Write(Html.DropDownListFor(m => m.Default, Model.DeviceProfiles.ToSelectListItems(Model.Default)));
 
             
@@ -85,7 +87,7 @@ WriteLiteral("\r\n");
 WriteLiteral("                ");
 
             
-            #line 15 "..\..\Areas\Config\Views\DeviceProfile\Defaults.cshtml"
+            #line 17 "..\..\Areas\Config\Views\DeviceProfile\Defaults.cshtml"
            Write(AjaxHelpers.AjaxLoader());
 
             
@@ -95,36 +97,20 @@ WriteLiteral("\r\n                <script");
 
 WriteLiteral(" type=\"text/javascript\"");
 
-WriteLiteral(@">
-                    $(function () {
-                        $('#Default').change(function () {
-                            $this = $(this);
-                            $ajaxLoading = $this.next('.ajaxLoading').show();
-                            var data = { id: $this.val() };
-                            $.getJSON('");
+WriteLiteral(">\r\n                    $(function () {\r\n                        document.DiscoFun" +
+"ctions.PropertyChangeHelper(\r\n                            $(\'#Default\'),\r\n      " +
+"                      \'Default Profile\',\r\n                            \'");
 
             
-            #line 22 "..\..\Areas\Config\Views\DeviceProfile\Defaults.cshtml"
-                                   Write(Url.Action(MVC.API.DeviceProfile.Default()));
+            #line 23 "..\..\Areas\Config\Views\DeviceProfile\Defaults.cshtml"
+                        Write(Url.Action(MVC.API.DeviceProfile.Default()));
 
             
             #line default
             #line hidden
-WriteLiteral(@"', data, function (response, result) {
-                                if (result != 'success' || response != 'OK') {
-                                    alert('Unable to change Default Device Profile:\n' + response);
-                                    $ajaxLoading.hide();
-                                } else {
-                                    $ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
-                                }
-                            });
-                        });
-                    });
-                </script>
-            </td>
-        </tr>
-        <tr>
-            <th");
+WriteLiteral("\',\r\n                            \'id\'\r\n                        );\r\n               " +
+"     });\r\n                </script>\r\n            </td>\r\n        </tr>\r\n        <" +
+"tr>\r\n            <th");
 
 WriteLiteral(" class=\"name\"");
 
@@ -138,7 +124,7 @@ WriteLiteral(">\r\n");
 WriteLiteral("                ");
 
             
-            #line 40 "..\..\Areas\Config\Views\DeviceProfile\Defaults.cshtml"
+            #line 35 "..\..\Areas\Config\Views\DeviceProfile\Defaults.cshtml"
            Write(Html.DropDownListFor(m => m.DefaultAddDeviceOffline, Model.DeviceProfilesAndNone.ToSelectListItems(Model.DefaultAddDeviceOffline)));
 
             
@@ -149,7 +135,7 @@ WriteLiteral("\r\n");
 WriteLiteral("                ");
 
             
-            #line 41 "..\..\Areas\Config\Views\DeviceProfile\Defaults.cshtml"
+            #line 36 "..\..\Areas\Config\Views\DeviceProfile\Defaults.cshtml"
            Write(AjaxHelpers.AjaxLoader());
 
             
@@ -161,35 +147,21 @@ WriteLiteral(" type=\"text/javascript\"");
 
 WriteLiteral(@">
                     $(function () {
-                        $('#DefaultAddDeviceOffline').change(function () {
-                            $this = $(this);
-                            $ajaxLoading = $this.next('.ajaxLoading').show();
-                            var data = { id: $this.val() };
-                            $.getJSON('");
+                        document.DiscoFunctions.PropertyChangeHelper(
+                            $('#DefaultAddDeviceOffline'),
+                            'Default Add Device Offline Profile',
+                            '");
 
             
-            #line 48 "..\..\Areas\Config\Views\DeviceProfile\Defaults.cshtml"
-                                   Write(Url.Action(MVC.API.DeviceProfile.DefaultAddDeviceOffline()));
+            #line 42 "..\..\Areas\Config\Views\DeviceProfile\Defaults.cshtml"
+                        Write(Url.Action(MVC.API.DeviceProfile.DefaultAddDeviceOffline()));
 
             
             #line default
             #line hidden
-WriteLiteral(@"', data, function (response, result) {
-                                if (result != 'success' || response != 'OK') {
-                                    alert('Unable to change Default Add Device Offline Device Profile:\n' + response);
-                                    $ajaxLoading.hide();
-                                } else {
-                                    $ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
-                                }
-                            });
-                        });
-                    });
-                </script>
-            </td>
-        </tr>
-    </table>
-</div>
-");
+WriteLiteral("\',\r\n                            \'id\'\r\n                        );\r\n               " +
+"     });\r\n                </script>\r\n            </td>\r\n        </tr>\r\n    </tab" +
+"le>\r\n</div>\r\n");
 
         }
     }

Disco.Web/Areas/Config/Views/DeviceProfile/Show.cshtml

@@ -568,7 +568,7 @@
                         </div>
                         <div id="treeOrganisationalUnit" class="organisationalUnitTree">
                         </div>
-                        @using (Html.BeginForm(MVC.API.DeviceProfile.UpdateOrganisationalUnit(Model.DeviceProfile.Id, redirect: true), FormMethod.Post))
+                        @using (Html.BeginForm(MVC.API.DeviceProfile.UpdateOrganisationalUnit(Model.DeviceProfile.Id, redirect: true)))
                         {
                             @Html.AntiForgeryToken();
                             <input type="hidden" name="OrganisationalUnit" />
@@ -754,23 +754,30 @@
                 {
                     <script type="text/javascript">
                         $(function () {
-                            var $container = $('#DeviceProfile_CertificateProviders');
+                            const $container = $('#DeviceProfile_CertificateProviders');
 
                             $container.on('change', 'input', function () {
-                                var $ajaxLoading = $('#DeviceProfile_CertificateProviders_loading').show();
+                                const $ajaxLoading = $('#DeviceProfile_CertificateProviders_loading').show();
 
-                                var data = {
-                                    CertificateProviders: $('input:checked', $container).map(function () { return $(this).val() }).get().join(',')
-                                };
-                                $.getJSON('@(Url.Action(MVC.API.DeviceProfile.UpdateCertificateProviders(Model.DeviceProfile.Id)))', data, function (response, result) {
-                                    if (result != 'success' || response != 'OK') {
-                                        alert('Unable to change property "CertificateProviders":\n' + response);
-                                        $ajaxLoading.hide();
-                                    } else {
+                                const body = new FormData();
+                                body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                                body.append('certificateProviders', $container.find('input:checked',).map(function () { return $(this).val() }).get().join(','));
+
+                                fetch('@(Url.Action(MVC.API.DeviceProfile.UpdateCertificateProviders(Model.DeviceProfile.Id)))', {
+                                    method: 'POST',
+                                    body: body
+                                }).then(r => {
+                                    if (r.ok) {
                                         $ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
+                                    } else {
+                                        alert('Unable to change property "CertificateProviders":\n' + r.statusText);
+                                        $ajaxLoading.hide();
                                     }
-                                })
-                            })
+                                }).catch(e => {
+                                    alert('Unable to change property "CertificateProviders":\n' + e);
+                                    $ajaxLoading.hide();
+                                });
+                            });
                         });
                     </script>
                 }
@@ -783,18 +790,25 @@
                             $container.on('change', 'input', function () {
                                 var $ajaxLoading = $('#DeviceProfile_CertificateProviders_loading').show();
 
-                                var data = {
-                                    CertificateAuthorityProviders: $('input:checked', $container).map(function () { return $(this).val() }).get().join(',')
-                                };
-                                $.getJSON('@(Url.Action(MVC.API.DeviceProfile.UpdateCertificateAuthorityProviders(Model.DeviceProfile.Id)))', data, function (response, result) {
-                                    if (result != 'success' || response != 'OK') {
-                                        alert('Unable to change property "CertificateAuthorityProviders":\n' + response);
-                                        $ajaxLoading.hide();
-                                    } else {
+                                const body = new FormData();
+                                body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                                body.append('certificateAuthorityProviders', $container.find('input:checked',).map(function () { return $(this).val() }).get().join(','));
+
+                                fetch('@(Url.Action(MVC.API.DeviceProfile.UpdateCertificateAuthorityProviders(Model.DeviceProfile.Id)))', {
+                                    method: 'POST',
+                                    body: body
+                                }).then(r => {
+                                    if (r.ok) {
                                         $ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
+                                    } else {
+                                        alert('Unable to change property "CertificateAuthorityProviders":\n' + r.statusText);
+                                        $ajaxLoading.hide();
                                     }
-                                })
-                            })
+                                }).catch(e => {
+                                    alert('Unable to change property "CertificateAuthorityProviders":\n' + e);
+                                    $ajaxLoading.hide();
+                                });
+                            });
                         });
                     </script>
                 }
@@ -870,18 +884,25 @@
                             $container.on('change', 'input', function () {
                                 var $ajaxLoading = $('#DeviceProfile_WirelessProfileProviders_loading').show();
 
-                                var data = {
-                                    WirelessProfileProviders: $('input:checked', $container).map(function () { return $(this).val() }).get().join(',')
-                                };
-                                $.getJSON('@(Url.Action(MVC.API.DeviceProfile.UpdateWirelessProfileProviders(Model.DeviceProfile.Id)))', data, function (response, result) {
-                                    if (result != 'success' || response != 'OK') {
-                                        alert('Unable to change property "WirelessProfileProviders":\n' + response);
-                                        $ajaxLoading.hide();
-                                    } else {
+                                const body = new FormData();
+                                body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                                body.append('wirelessProfileProviders', $container.find('input:checked',).map(function () { return $(this).val() }).get().join(','));
+
+                                fetch('@(Url.Action(MVC.API.DeviceProfile.UpdateWirelessProfileProviders(Model.DeviceProfile.Id)))', {
+                                    method: 'POST',
+                                    body: body
+                                }).then(r => {
+                                    if (r.ok) {
                                         $ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
+                                    } else {
+                                        alert('Unable to change property "WirelessProfileProviders":\n' + r.statusText);
+                                        $ajaxLoading.hide();
                                     }
-                                })
-                            })
+                                }).catch(e => {
+                                    alert('Unable to change property "WirelessProfileProviders":\n' + e);
+                                    $ajaxLoading.hide();
+                                });
+                            });
                         });
                     </script>
                 }
@@ -967,50 +988,13 @@
         </tr>
     </table>
 </div>
-@if (canDelete)
-{
-    <div id="dialogConfirmDelete" title="Delete this Device Profile?">
-        <p>
-            <i class="fa fa-exclamation-triangle fa-lg warning"></i>
-            This item will be permanently deleted and cannot be recovered. Are you sure?
-        </p>
-    </div>
-    <script type="text/javascript">
-        $(function () {
-
-            var button = $('#buttonDelete');
-            var buttonLink = button.attr('href');
-            button.attr('href', '#');
-            button.click(function () {
-                $("#dialogConfirmDelete").dialog('open');
-            });
-
-            $("#dialogConfirmDelete").dialog({
-                resizable: false,
-                height: 140,
-                modal: true,
-                autoOpen: false,
-                buttons: {
-                    "Delete": function () {
-                        $(this).dialog('disable');
-                        window.location.href = buttonLink;
-                    },
-                    Cancel: function () {
-                        $(this).dialog("close");
-                    }
-                }
-            });
-
-        });
-    </script>
-}
 @Html.Partial(MVC.Config.Shared.Views._DeviceGroupDocumentBulkGenerate, Model)
 <div class="actionBar">
     @if (Model.CanDecommission)
     {
         <button id="DeviceProfile_Decommission" class="button">Decommission All Devices</button>
         <div id="DeviceProfile_Decommission_Dialog" class="dialog" title="Profile Device Decommission">
-            @using (Html.BeginForm(MVC.API.Device.DeviceProfileDecommission(Model.DeviceProfile.Id), FormMethod.Post))
+            @using (Html.BeginForm(MVC.API.Device.DeviceProfileDecommission(Model.DeviceProfile.Id)))
             {
                 @Html.AntiForgeryToken()
                 <div class="clearfix" style="margin-bottom: 10px;">
@@ -1067,7 +1051,44 @@
     }
     @if (canDelete)
     {
-        @Html.ActionLinkButton("Delete", MVC.API.DeviceProfile.Delete(Model.DeviceProfile.Id, true), "buttonDelete")
+        <button id="buttonDelete" type="button" class="button">Delete</button>
+        <div id="dialogConfirmDelete" class="dialog" title="Delete this Device Profile?">
+            @using (Html.BeginForm(MVC.API.DeviceProfile.Delete(Model.DeviceProfile.Id, true)))
+            {
+                @Html.AntiForgeryToken()
+            }
+            <p>
+                <i class="fa fa-exclamation-triangle fa-lg warning"></i>
+                This item will be permanently deleted and cannot be recovered. Are you sure?
+            </p>
+        </div>
+        <script type="text/javascript">
+            $(function () {
+                let dialog = null;
+                $('#buttonDelete').on('click', function () {
+                    if (!dialog) {
+                        dialog = $("#dialogConfirmDelete").dialog({
+                            resizable: false,
+                            width: 300,
+                            modal: true,
+                            autoOpen: false,
+                            buttons: {
+                                "Delete": function () {
+                                    $(this)
+                                        .dialog("option", "buttons", null)
+                                        .find('form').trigger('submit');
+                                },
+                                Cancel: function () {
+                                    $(this).dialog("close");
+                                }
+                            }
+                        });
+                    }
+
+                    dialog.dialog('open');
+                });
+            });
+        </script>
     }
     @if (Authorization.Has(Claims.Device.Actions.Export))
     {

Disco.Web/Areas/Config/Views/DeviceProfile/Show.generated.cs

@@ -1825,7 +1825,7 @@ WriteLiteral(">\r\n                        </div>\r\n");
             #line hidden
             
             #line 571 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
-                         using (Html.BeginForm(MVC.API.DeviceProfile.UpdateOrganisationalUnit(Model.DeviceProfile.Id, redirect: true), FormMethod.Post))
+                         using (Html.BeginForm(MVC.API.DeviceProfile.UpdateOrganisationalUnit(Model.DeviceProfile.Id, redirect: true)))
                         {
                             
             
@@ -2230,38 +2230,45 @@ WriteLiteral(" type=\"text/javascript\"");
 
 WriteLiteral(@">
                         $(function () {
-                            var $container = $('#DeviceProfile_CertificateProviders');
+                            const $container = $('#DeviceProfile_CertificateProviders');
 
                             $container.on('change', 'input', function () {
-                                var $ajaxLoading = $('#DeviceProfile_CertificateProviders_loading').show();
+                                const $ajaxLoading = $('#DeviceProfile_CertificateProviders_loading').show();
 
-                                var data = {
-                                    CertificateProviders: $('input:checked', $container).map(function () { return $(this).val() }).get().join(',')
-                                };
-                                $.getJSON('");
+                                const body = new FormData();
+                                body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                                body.append('certificateProviders', $container.find('input:checked',).map(function () { return $(this).val() }).get().join(','));
+
+                                fetch('");
 
             
-            #line 765 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
-                                       Write(Url.Action(MVC.API.DeviceProfile.UpdateCertificateProviders(Model.DeviceProfile.Id)));
+            #line 766 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+                                   Write(Url.Action(MVC.API.DeviceProfile.UpdateCertificateProviders(Model.DeviceProfile.Id)));
 
             
             #line default
             #line hidden
-WriteLiteral(@"', data, function (response, result) {
-                                    if (result != 'success' || response != 'OK') {
-                                        alert('Unable to change property ""CertificateProviders"":\n' + response);
-                                        $ajaxLoading.hide();
-                                    } else {
+WriteLiteral(@"', {
+                                    method: 'POST',
+                                    body: body
+                                }).then(r => {
+                                    if (r.ok) {
                                         $ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
+                                    } else {
+                                        alert('Unable to change property ""CertificateProviders"":\n' + r.statusText);
+                                        $ajaxLoading.hide();
                                     }
-                                })
-                            })
+                                }).catch(e => {
+                                    alert('Unable to change property ""CertificateProviders"":\n' + e);
+                                    $ajaxLoading.hide();
+                                });
+                            });
                         });
                     </script>
 ");
 
             
-            #line 776 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 783 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                 }
 
             
@@ -2270,7 +2277,7 @@ WriteLiteral(@"', data, function (response, result) {
 WriteLiteral("                ");
 
             
-            #line 777 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 784 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                  if (canConfig && Model.CertificateProviders.Count > 0)
                 {
 
@@ -2288,33 +2295,40 @@ WriteLiteral(@">
                             $container.on('change', 'input', function () {
                                 var $ajaxLoading = $('#DeviceProfile_CertificateProviders_loading').show();
 
-                                var data = {
-                                    CertificateAuthorityProviders: $('input:checked', $container).map(function () { return $(this).val() }).get().join(',')
-                                };
-                                $.getJSON('");
+                                const body = new FormData();
+                                body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                                body.append('certificateAuthorityProviders', $container.find('input:checked',).map(function () { return $(this).val() }).get().join(','));
+
+                                fetch('");
 
             
-            #line 789 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
-                                       Write(Url.Action(MVC.API.DeviceProfile.UpdateCertificateAuthorityProviders(Model.DeviceProfile.Id)));
+            #line 797 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+                                   Write(Url.Action(MVC.API.DeviceProfile.UpdateCertificateAuthorityProviders(Model.DeviceProfile.Id)));
 
             
             #line default
             #line hidden
-WriteLiteral(@"', data, function (response, result) {
-                                    if (result != 'success' || response != 'OK') {
-                                        alert('Unable to change property ""CertificateAuthorityProviders"":\n' + response);
-                                        $ajaxLoading.hide();
-                                    } else {
+WriteLiteral(@"', {
+                                    method: 'POST',
+                                    body: body
+                                }).then(r => {
+                                    if (r.ok) {
                                         $ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
+                                    } else {
+                                        alert('Unable to change property ""CertificateAuthorityProviders"":\n' + r.statusText);
+                                        $ajaxLoading.hide();
                                     }
-                                })
-                            })
+                                }).catch(e => {
+                                    alert('Unable to change property ""CertificateAuthorityProviders"":\n' + e);
+                                    $ajaxLoading.hide();
+                                });
+                            });
                         });
                     </script>
 ");
 
             
-            #line 800 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 814 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                 }
 
             
@@ -2324,13 +2338,13 @@ WriteLiteral("            </th>\r\n            <td>\r\n                <h4>Devic
 "tes</h4>\r\n");
 
             
-            #line 804 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 818 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                 
             
             #line default
             #line hidden
             
-            #line 804 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 818 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                  if (canConfig && Model.CertificateProviders.Count > 0)
                 {
                     
@@ -2338,14 +2352,14 @@ WriteLiteral("            </th>\r\n            <td>\r\n                <h4>Devic
             #line default
             #line hidden
             
-            #line 806 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 820 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                Write(CommonHelpers.CheckBoxList("DeviceProfile_CertificateProviders", "DeviceProfile_CertificateProviders", Model.CertificateProviders.ToSelectListItems(Model.DeviceProfile.GetCertificateProviders())));
 
             
             #line default
             #line hidden
             
-            #line 806 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 820 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                                                                                                                                                                                                                         
                 }
                 else
@@ -2365,7 +2379,7 @@ WriteLiteral(" class=\"smallMessage\"");
 WriteLiteral(">&lt;None Allocated&gt;</span>\r\n");
 
             
-            #line 815 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 829 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                     }
                     else
                     {
@@ -2376,13 +2390,13 @@ WriteLiteral(">&lt;None Allocated&gt;</span>\r\n");
 WriteLiteral("                        <ul>\r\n");
 
             
-            #line 819 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 833 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                             
             
             #line default
             #line hidden
             
-            #line 819 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 833 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                              foreach (var certificateProvider in certificateProviders)
                             {
 
@@ -2392,7 +2406,7 @@ WriteLiteral("                        <ul>\r\n");
 WriteLiteral("                                <li>");
 
             
-            #line 821 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 835 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                                Write(certificateProvider.Name);
 
             
@@ -2401,7 +2415,7 @@ WriteLiteral("                                <li>");
 WriteLiteral("</li>\r\n");
 
             
-            #line 822 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 836 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                             }
 
             
@@ -2410,7 +2424,7 @@ WriteLiteral("</li>\r\n");
 WriteLiteral("                        </ul>\r\n");
 
             
-            #line 824 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 838 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                     }
                 }
 
@@ -2424,13 +2438,13 @@ WriteLiteral(" style=\"margin-top: 4px;\"");
 WriteLiteral(">Authority Certificates</h4>\r\n");
 
             
-            #line 827 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 841 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                 
             
             #line default
             #line hidden
             
-            #line 827 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 841 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                  if (canConfig && Model.CertificateAuthorityProviders.Count > 0)
                 {
                     
@@ -2438,14 +2452,14 @@ WriteLiteral(">Authority Certificates</h4>\r\n");
             #line default
             #line hidden
             
-            #line 829 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 843 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                Write(CommonHelpers.CheckBoxList("DeviceProfile_CertificateAuthorityProviders", "DeviceProfile_CertificateAuthorityProviders", Model.CertificateAuthorityProviders.ToSelectListItems(Model.DeviceProfile.GetCertificateAuthorityProviders())));
 
             
             #line default
             #line hidden
             
-            #line 829 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 843 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                                                                                                                                                                                                                                                             
                 }
                 else
@@ -2465,7 +2479,7 @@ WriteLiteral(" class=\"smallMessage\"");
 WriteLiteral(">&lt;None Allocated&gt;</span>\r\n");
 
             
-            #line 838 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 852 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                     }
                     else
                     {
@@ -2476,13 +2490,13 @@ WriteLiteral(">&lt;None Allocated&gt;</span>\r\n");
 WriteLiteral("                        <ul>\r\n");
 
             
-            #line 842 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 856 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                             
             
             #line default
             #line hidden
             
-            #line 842 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 856 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                              foreach (var certificateProvider in certificateProviders)
                             {
 
@@ -2492,7 +2506,7 @@ WriteLiteral("                        <ul>\r\n");
 WriteLiteral("                                <li>");
 
             
-            #line 844 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 858 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                                Write(certificateProvider.Name);
 
             
@@ -2501,7 +2515,7 @@ WriteLiteral("                                <li>");
 WriteLiteral("</li>\r\n");
 
             
-            #line 845 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 859 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                             }
 
             
@@ -2510,7 +2524,7 @@ WriteLiteral("</li>\r\n");
 WriteLiteral("                        </ul>\r\n");
 
             
-            #line 847 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 861 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                     }
                 }
 
@@ -2520,7 +2534,7 @@ WriteLiteral("                        </ul>\r\n");
 WriteLiteral("                ");
 
             
-            #line 849 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 863 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                  if (canViewPlugins)
                 {
 
@@ -2541,21 +2555,21 @@ WriteLiteral(" class=\"fa fa-info-circle\"");
 
 WriteLiteral("></i>View the <a");
 
-WriteAttribute("href", Tuple.Create(" href=\"", 48824), Tuple.Create("\"", 48874)
+WriteAttribute("href", Tuple.Create(" href=\"", 49620), Tuple.Create("\"", 49670)
             
-            #line 853 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
-, Tuple.Create(Tuple.Create("", 48831), Tuple.Create<System.Object, System.Int32>(Url.Action(MVC.Config.Plugins.Install())
+            #line 867 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+, Tuple.Create(Tuple.Create("", 49627), Tuple.Create<System.Object, System.Int32>(Url.Action(MVC.Config.Plugins.Install())
             
             #line default
             #line hidden
-, 48831), false)
+, 49627), false)
 );
 
 WriteLiteral(">Plugin Catalogue</a> to discover and install certificate provider plugins.\r\n    " +
 "                    </p>\r\n                    </div>\r\n");
 
             
-            #line 856 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 870 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                 }
 
             
@@ -2565,13 +2579,13 @@ WriteLiteral("            </td>\r\n        </tr>\r\n        <tr>\r\n
 " Provision Wireless Profiles:\r\n");
 
             
-            #line 862 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 876 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                 
             
             #line default
             #line hidden
             
-            #line 862 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 876 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                  if (canConfig && Model.WirelessProfileProviders.Count > 0)
                 {
 
@@ -2581,20 +2595,20 @@ WriteLiteral("            </td>\r\n        </tr>\r\n        <tr>\r\n
 WriteLiteral("                    <br />\r\n");
 
             
-            #line 865 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 879 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                     
             
             #line default
             #line hidden
             
-            #line 865 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 879 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                Write(AjaxHelpers.AjaxLoader("DeviceProfile_WirelessProfileProviders"));
 
             
             #line default
             #line hidden
             
-            #line 865 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 879 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                                                                                      
 
             
@@ -2611,33 +2625,40 @@ WriteLiteral(@">
                             $container.on('change', 'input', function () {
                                 var $ajaxLoading = $('#DeviceProfile_WirelessProfileProviders_loading').show();
 
-                                var data = {
-                                    WirelessProfileProviders: $('input:checked', $container).map(function () { return $(this).val() }).get().join(',')
-                                };
-                                $.getJSON('");
+                                const body = new FormData();
+                                body.append('__RequestVerificationToken', document.body.dataset.antiforgery);
+                                body.append('wirelessProfileProviders', $container.find('input:checked',).map(function () { return $(this).val() }).get().join(','));
+
+                                fetch('");
 
             
-            #line 876 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
-                                       Write(Url.Action(MVC.API.DeviceProfile.UpdateWirelessProfileProviders(Model.DeviceProfile.Id)));
+            #line 891 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+                                   Write(Url.Action(MVC.API.DeviceProfile.UpdateWirelessProfileProviders(Model.DeviceProfile.Id)));
 
             
             #line default
             #line hidden
-WriteLiteral(@"', data, function (response, result) {
-                                    if (result != 'success' || response != 'OK') {
-                                        alert('Unable to change property ""WirelessProfileProviders"":\n' + response);
-                                        $ajaxLoading.hide();
-                                    } else {
+WriteLiteral(@"', {
+                                    method: 'POST',
+                                    body: body
+                                }).then(r => {
+                                    if (r.ok) {
                                         $ajaxLoading.hide().next('.ajaxOk').show().delay('fast').fadeOut('slow');
+                                    } else {
+                                        alert('Unable to change property ""WirelessProfileProviders"":\n' + r.statusText);
+                                        $ajaxLoading.hide();
                                     }
-                                })
-                            })
+                                }).catch(e => {
+                                    alert('Unable to change property ""WirelessProfileProviders"":\n' + e);
+                                    $ajaxLoading.hide();
+                                });
+                            });
                         });
                     </script>
 ");
 
             
-            #line 887 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 908 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                 }
 
             
@@ -2646,13 +2667,13 @@ WriteLiteral(@"', data, function (response, result) {
 WriteLiteral("            </th>\r\n            <td>\r\n");
 
             
-            #line 890 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 911 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                 
             
             #line default
             #line hidden
             
-            #line 890 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 911 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                  if (canConfig && Model.WirelessProfileProviders.Count > 0)
                 {
                     
@@ -2660,14 +2681,14 @@ WriteLiteral("            </th>\r\n            <td>\r\n");
             #line default
             #line hidden
             
-            #line 892 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 913 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                Write(CommonHelpers.CheckBoxList("DeviceProfile_WirelessProfileProviders", "DeviceProfile_WirelessProfileProviders", Model.WirelessProfileProviders.ToSelectListItems(Model.DeviceProfile.GetWirelessProfileProviders())));
 
             
             #line default
             #line hidden
             
-            #line 892 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 913 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                                                                                                                                                                                                                                         
                 }
                 else
@@ -2687,7 +2708,7 @@ WriteLiteral(" class=\"smallMessage\"");
 WriteLiteral(">&lt;None Allocated&gt;</span>\r\n");
 
             
-            #line 901 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 922 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                     }
                     else
                     {
@@ -2698,13 +2719,13 @@ WriteLiteral(">&lt;None Allocated&gt;</span>\r\n");
 WriteLiteral("                        <ul>\r\n");
 
             
-            #line 905 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 926 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                             
             
             #line default
             #line hidden
             
-            #line 905 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 926 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                              foreach (var wirelessProfileProvider in wirelessProfileProviders)
                             {
 
@@ -2714,7 +2735,7 @@ WriteLiteral("                        <ul>\r\n");
 WriteLiteral("                                <li>");
 
             
-            #line 907 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 928 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                                Write(wirelessProfileProvider.Name);
 
             
@@ -2723,7 +2744,7 @@ WriteLiteral("                                <li>");
 WriteLiteral("</li>\r\n");
 
             
-            #line 908 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 929 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                             }
 
             
@@ -2732,7 +2753,7 @@ WriteLiteral("</li>\r\n");
 WriteLiteral("                        </ul>\r\n");
 
             
-            #line 910 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 931 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                     }
                 }
 
@@ -2742,7 +2763,7 @@ WriteLiteral("                        </ul>\r\n");
 WriteLiteral("                ");
 
             
-            #line 912 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 933 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                  if (canViewPlugins)
                 {
 
@@ -2763,21 +2784,21 @@ WriteLiteral(" class=\"fa fa-info-circle\"");
 
 WriteLiteral("></i>View the <a");
 
-WriteAttribute("href", Tuple.Create(" href=\"", 52078), Tuple.Create("\"", 52128)
+WriteAttribute("href", Tuple.Create(" href=\"", 53278), Tuple.Create("\"", 53328)
             
-            #line 916 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
-, Tuple.Create(Tuple.Create("", 52085), Tuple.Create<System.Object, System.Int32>(Url.Action(MVC.Config.Plugins.Install())
+            #line 937 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+, Tuple.Create(Tuple.Create("", 53285), Tuple.Create<System.Object, System.Int32>(Url.Action(MVC.Config.Plugins.Install())
             
             #line default
             #line hidden
-, 52085), false)
+, 53285), false)
 );
 
 WriteLiteral(">Plugin Catalogue</a> to discover and install wireless profile provider plugins.\r" +
 "\n                        </p>\r\n                    </div>\r\n");
 
             
-            #line 919 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 940 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                 }
 
             
@@ -2786,13 +2807,13 @@ WriteLiteral(">Plugin Catalogue</a> to discover and install wireless profile pro
 WriteLiteral("            </td>\r\n        </tr>\r\n");
 
             
-            #line 922 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 943 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
         
             
             #line default
             #line hidden
             
-            #line 922 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 943 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
          if (hideAdvanced)
         {
 
@@ -2826,7 +2847,7 @@ WriteLiteral(@">Show Advanced Options</button>
 ");
 
             
-            #line 938 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 959 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
         }
 
             
@@ -2842,7 +2863,7 @@ WriteLiteral(">\r\n            <th>\r\n                Linked Groups:\r\n
 WriteLiteral("                    ");
 
             
-            #line 945 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 966 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                Write(Html.Partial(MVC.Config.Shared.Views.LinkedGroupInstance, new LinkedGroupModel()
                {
                    CanConfigure = canConfig,
@@ -2860,7 +2881,7 @@ WriteLiteral("\r\n");
 WriteLiteral("                    ");
 
             
-            #line 953 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 974 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                Write(Html.Partial(MVC.Config.Shared.Views.LinkedGroupInstance, new LinkedGroupModel()
                {
                    CanConfigure = canConfig,
@@ -2876,13 +2897,13 @@ WriteLiteral("                    ");
 WriteLiteral("\r\n");
 
             
-            #line 961 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 982 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                     
             
             #line default
             #line hidden
             
-            #line 961 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 982 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                      if (canConfig)
                     {
                         
@@ -2890,14 +2911,14 @@ WriteLiteral("\r\n");
             #line default
             #line hidden
             
-            #line 963 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 984 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                    Write(Html.Partial(MVC.Config.Shared.Views.LinkedGroupShared));
 
             
             #line default
             #line hidden
             
-            #line 963 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 984 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                                                                                 
                     }
 
@@ -2907,69 +2928,7 @@ WriteLiteral("\r\n");
 WriteLiteral("                </div>\r\n            </td>\r\n        </tr>\r\n    </table>\r\n</div>\r\n");
 
             
-            #line 970 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
- if (canDelete)
-{
-
-            
-            #line default
-            #line hidden
-WriteLiteral("    <div");
-
-WriteLiteral(" id=\"dialogConfirmDelete\"");
-
-WriteLiteral(" title=\"Delete this Device Profile?\"");
-
-WriteLiteral(">\r\n        <p>\r\n            <i");
-
-WriteLiteral(" class=\"fa fa-exclamation-triangle fa-lg warning\"");
-
-WriteLiteral("></i>\r\n            This item will be permanently deleted and cannot be recovered." +
-" Are you sure?\r\n        </p>\r\n    </div>\r\n");
-
-WriteLiteral("    <script");
-
-WriteLiteral(" type=\"text/javascript\"");
-
-WriteLiteral(@">
-        $(function () {
-
-            var button = $('#buttonDelete');
-            var buttonLink = button.attr('href');
-            button.attr('href', '#');
-            button.click(function () {
-                $(""#dialogConfirmDelete"").dialog('open');
-            });
-
-            $(""#dialogConfirmDelete"").dialog({
-                resizable: false,
-                height: 140,
-                modal: true,
-                autoOpen: false,
-                buttons: {
-                    ""Delete"": function () {
-                        $(this).dialog('disable');
-                        window.location.href = buttonLink;
-                    },
-                    Cancel: function () {
-                        $(this).dialog(""close"");
-                    }
-                }
-            });
-
-        });
-    </script>
-");
-
-            
-            #line 1006 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
-}
-
-            
-            #line default
-            #line hidden
-            
-            #line 1007 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 991 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
 Write(Html.Partial(MVC.Config.Shared.Views._DeviceGroupDocumentBulkGenerate, Model));
 
             
@@ -2982,13 +2941,13 @@ WriteLiteral(" class=\"actionBar\"");
 WriteLiteral(">\r\n");
 
             
-            #line 1009 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 993 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
     
             
             #line default
             #line hidden
             
-            #line 1009 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 993 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
      if (Model.CanDecommission)
     {
 
@@ -3014,28 +2973,28 @@ WriteLiteral(" title=\"Profile Device Decommission\"");
 WriteLiteral(">\r\n");
 
             
-            #line 1013 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 997 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
             
             
             #line default
             #line hidden
             
-            #line 1013 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
-             using (Html.BeginForm(MVC.API.Device.DeviceProfileDecommission(Model.DeviceProfile.Id), FormMethod.Post))
+            #line 997 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+             using (Html.BeginForm(MVC.API.Device.DeviceProfileDecommission(Model.DeviceProfile.Id)))
             {
                 
             
             #line default
             #line hidden
             
-            #line 1015 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 999 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
            Write(Html.AntiForgeryToken());
 
             
             #line default
             #line hidden
             
-            #line 1015 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 999 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                                         
 
             
@@ -3060,13 +3019,13 @@ WriteLiteral(" class=\"none\"");
 WriteLiteral(">\r\n");
 
             
-            #line 1021 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1005 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                         
             
             #line default
             #line hidden
             
-            #line 1021 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1005 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                          foreach (DecommissionReasons decommissionReason in Enum.GetValues(typeof(DecommissionReasons)).Cast<DecommissionReasons>().OrderBy(r => r.ToString()))
                         {
 
@@ -3077,33 +3036,33 @@ WriteLiteral("                            <li>\r\n
 
 WriteLiteral(" type=\"radio\"");
 
-WriteAttribute("id", Tuple.Create(" id=\"", 56977), Tuple.Create("\"", 57049)
-, Tuple.Create(Tuple.Create("", 56982), Tuple.Create("DeviceProfile_Decommission_Dialog_Reason_", 56982), true)
+WriteAttribute("id", Tuple.Create(" id=\"", 56980), Tuple.Create("\"", 57052)
+, Tuple.Create(Tuple.Create("", 56985), Tuple.Create("DeviceProfile_Decommission_Dialog_Reason_", 56985), true)
             
-            #line 1024 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
-                 , Tuple.Create(Tuple.Create("", 57023), Tuple.Create<System.Object, System.Int32>((int)decommissionReason
+            #line 1008 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+                 , Tuple.Create(Tuple.Create("", 57026), Tuple.Create<System.Object, System.Int32>((int)decommissionReason
             
             #line default
             #line hidden
-, 57023), false)
+, 57026), false)
 );
 
 WriteLiteral("\r\n                                       name=\"decommissionReason\"");
 
-WriteAttribute("value", Tuple.Create(" value=\"", 57116), Tuple.Create("\"", 57150)
+WriteAttribute("value", Tuple.Create(" value=\"", 57119), Tuple.Create("\"", 57153)
             
-            #line 1025 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
-, Tuple.Create(Tuple.Create("", 57124), Tuple.Create<System.Object, System.Int32>((int)decommissionReason
+            #line 1009 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+, Tuple.Create(Tuple.Create("", 57127), Tuple.Create<System.Object, System.Int32>((int)decommissionReason
             
             #line default
             #line hidden
-, 57124), false)
+, 57127), false)
 );
 
 WriteLiteral(" ");
 
             
-            #line 1025 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1009 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                                                                                                 Write((decommissionReason == DecommissionReasons.EndOfLife) ? "checked=\"checked\"" : string.Empty);
 
             
@@ -3111,21 +3070,21 @@ WriteLiteral(" ");
             #line hidden
 WriteLiteral(" />\r\n                                <label");
 
-WriteAttribute("for", Tuple.Create(" for=\"", 57290), Tuple.Create("\"", 57363)
-, Tuple.Create(Tuple.Create("", 57296), Tuple.Create("DeviceProfile_Decommission_Dialog_Reason_", 57296), true)
+WriteAttribute("for", Tuple.Create(" for=\"", 57293), Tuple.Create("\"", 57366)
+, Tuple.Create(Tuple.Create("", 57299), Tuple.Create("DeviceProfile_Decommission_Dialog_Reason_", 57299), true)
             
-            #line 1026 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
-     , Tuple.Create(Tuple.Create("", 57337), Tuple.Create<System.Object, System.Int32>((int)decommissionReason
+            #line 1010 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+     , Tuple.Create(Tuple.Create("", 57340), Tuple.Create<System.Object, System.Int32>((int)decommissionReason
             
             #line default
             #line hidden
-, 57337), false)
+, 57340), false)
 );
 
 WriteLiteral(">");
 
             
-            #line 1026 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1010 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                                                                                                              Write(decommissionReason.ReasonMessage());
 
             
@@ -3134,7 +3093,7 @@ WriteLiteral(">");
 WriteLiteral("</label>\r\n                            </li>\r\n");
 
             
-            #line 1028 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1012 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                         }
 
             
@@ -3153,7 +3112,7 @@ WriteLiteral(" />\r\n                        Unassign devices users\r\n
 "\r\n                </div>\r\n");
 
             
-            #line 1036 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1020 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
             }
 
             
@@ -3197,7 +3156,7 @@ WriteLiteral(@">
 ");
 
             
-            #line 1067 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1051 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
     }
 
             
@@ -3206,23 +3165,104 @@ WriteLiteral(@">
 WriteLiteral("    ");
 
             
-            #line 1068 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1052 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
      if (canDelete)
     {
-        
+
+            
+            #line default
+            #line hidden
+WriteLiteral("        <button");
+
+WriteLiteral(" id=\"buttonDelete\"");
+
+WriteLiteral(" type=\"button\"");
+
+WriteLiteral(" class=\"button\"");
+
+WriteLiteral(">Delete</button>\r\n");
+
+WriteLiteral("        <div");
+
+WriteLiteral(" id=\"dialogConfirmDelete\"");
+
+WriteLiteral(" class=\"dialog\"");
+
+WriteLiteral(" title=\"Delete this Device Profile?\"");
+
+WriteLiteral(">\r\n");
+
+            
+            #line 1056 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            
             
             #line default
             #line hidden
             
-            #line 1070 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
-   Write(Html.ActionLinkButton("Delete", MVC.API.DeviceProfile.Delete(Model.DeviceProfile.Id, true), "buttonDelete"));
+            #line 1056 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+             using (Html.BeginForm(MVC.API.DeviceProfile.Delete(Model.DeviceProfile.Id, true)))
+            {
+                
+            
+            #line default
+            #line hidden
+            
+            #line 1058 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+           Write(Html.AntiForgeryToken());
 
             
             #line default
             #line hidden
             
-            #line 1070 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
-                                                                                                                    
+            #line 1058 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+                                        
+            }
+
+            
+            #line default
+            #line hidden
+WriteLiteral("            <p>\r\n                <i");
+
+WriteLiteral(" class=\"fa fa-exclamation-triangle fa-lg warning\"");
+
+WriteLiteral("></i>\r\n                This item will be permanently deleted and cannot be recove" +
+"red. Are you sure?\r\n            </p>\r\n        </div>\r\n");
+
+WriteLiteral("        <script");
+
+WriteLiteral(" type=\"text/javascript\"");
+
+WriteLiteral(@">
+            $(function () {
+                let dialog = null;
+                $('#buttonDelete').on('click', function () {
+                    if (!dialog) {
+                        dialog = $(""#dialogConfirmDelete"").dialog({
+                            resizable: false,
+                            width: 300,
+                            modal: true,
+                            autoOpen: false,
+                            buttons: {
+                                ""Delete"": function () {
+                                    $(this)
+                                        .dialog(""option"", ""buttons"", null)
+                                        .find('form').trigger('submit');
+                                },
+                                Cancel: function () {
+                                    $(this).dialog(""close"");
+                                }
+                            }
+                        });
+                    }
+
+                    dialog.dialog('open');
+                });
+            });
+        </script>
+");
+
+            
+            #line 1092 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
     }
 
             
@@ -3231,7 +3271,7 @@ WriteLiteral("    ");
 WriteLiteral("    ");
 
             
-            #line 1072 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1093 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
      if (Authorization.Has(Claims.Device.Actions.Export))
     {
         
@@ -3239,14 +3279,14 @@ WriteLiteral("    ");
             #line default
             #line hidden
             
-            #line 1074 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1095 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
    Write(Html.ActionLinkButton("Export Devices", MVC.Device.Export(null, Disco.Models.Services.Devices.DeviceExportTypes.Profile, Model.DeviceProfile.Id)));
 
             
             #line default
             #line hidden
             
-            #line 1074 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1095 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                                                                                                                                                           
     }
 
@@ -3256,7 +3296,7 @@ WriteLiteral("    ");
 WriteLiteral("    ");
 
             
-            #line 1076 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1097 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
      if (Authorization.Has(Claims.Device.Search) && Model.DeviceCount > 0)
     {
         
@@ -3264,14 +3304,14 @@ WriteLiteral("    ");
             #line default
             #line hidden
             
-            #line 1078 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1099 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
    Write(Html.ActionLinkButton(string.Format("View {0} Device{1}", Model.DeviceCount, (Model.DeviceCount != 1 ? "s" : null)), MVC.Search.Query(Model.DeviceProfile.Id.ToString(), "DeviceProfile")));
 
             
             #line default
             #line hidden
             
-            #line 1078 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
+            #line 1099 "..\..\Areas\Config\Views\DeviceProfile\Show.cshtml"
                                                                                                                                                                                                    
     }
 

Disco.Web/Areas/Config/Views/DocumentTemplate/BulkGenerate.cshtml

@@ -8,7 +8,7 @@
 }
 <div id="DocumentTemplate_BulkGenerate">
     <div class="actions">
-        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerate(Model.DocumentTemplate.Id), FormMethod.Post))
+        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerate(Model.DocumentTemplate.Id)))
         {
             if (Model.TemplatePageCount > 1 && Model.TemplatePageCount % 2 != 0)
             {
@@ -79,7 +79,7 @@
             <div class="example3 code">user6;smi0099;@(ActiveDirectory.Context.PrimaryDomain.NetBiosName)\rsmith;Domain Admins</div>
         </div>
     </div>
-    @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddUsers(), FormMethod.Post))
+    @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddUsers()))
     {
         <div class="field-validation-valid" data-valmsg-replace="true" data-valmsg-for="userIds"></div>
         <textarea id="inputBulkGenerateDataIds" name="userIds" data-val="true" data-val-required="Identifiers are required" required></textarea>
@@ -93,7 +93,7 @@
             Add all members of a group (including recursive members) to the bulk generation.
         </div>
     </div>
-    @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddGroupMembers(), FormMethod.Post))
+    @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddGroupMembers()))
     {
         <table class="input">
             <tbody>
@@ -119,7 +119,7 @@
                 Add all users associated with the flag to the bulk generation.
             </div>
         </div>
-        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddUserFlag(), FormMethod.Post))
+        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddUserFlag()))
         {
             <input name="flagId" type="hidden" required />
             <div class="dialog-item-picker">
@@ -144,7 +144,7 @@
                 Add all users associated with a device in the selected profile to the bulk generation.
             </div>
         </div>
-        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddDeviceProfile(), FormMethod.Post))
+        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddDeviceProfile()))
         {
             <input name="deviceProfileId" type="hidden" required />
             <div class="dialog-item-picker">
@@ -168,7 +168,7 @@
                 Add all users associated with a device in the selected batch to the bulk generation.
             </div>
         </div>
-        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddDeviceBatch(), FormMethod.Post))
+        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddDeviceBatch()))
         {
             <input name="deviceBatchId" type="hidden" required />
             <div class="dialog-item-picker">
@@ -192,7 +192,7 @@
                 Add all users associated with an attachment of the selected document template to the bulk generation.
             </div>
         </div>
-        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddDocumentAttachment(), FormMethod.Post))
+        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddDocumentAttachment()))
         {
             <input name="documentTemplateId" type="hidden" required />
             <div class="dialog-item-picker">
@@ -220,7 +220,7 @@
                 Add all users with a matching user detail to the bulk generation.
             </div>
         </div>
-        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddUserDetail(), FormMethod.Post))
+        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddUserDetail()))
         {
             <input name="key" type="hidden" required />
             <input name="value" type="hidden" />
@@ -236,7 +236,7 @@
 
             @Html.AntiForgeryToken()
         }
-        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateGetUserDetailValues(), FormMethod.Post))
+        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateGetUserDetailValues()))
         {
             <input name="key" type="hidden" required />
 

Disco.Web/Areas/Config/Views/DocumentTemplate/BulkGenerate.generated.cs

@@ -78,7 +78,7 @@ WriteLiteral(">\r\n");
             #line hidden
             
             #line 11 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerate(Model.DocumentTemplate.Id), FormMethod.Post))
+         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerate(Model.DocumentTemplate.Id)))
         {
             if (Model.TemplatePageCount > 1 && Model.TemplatePageCount % 2 != 0)
             {
@@ -314,17 +314,17 @@ WriteLiteral(" id=\"DocumentTemplate_BulkGenerate_Dialog_AddUsers\"");
 
 WriteLiteral(" class=\"dialog dialog-bulk-generate\"");
 
-WriteAttribute("title", Tuple.Create(" title=\"", 2917), Tuple.Create("\"", 2973)
+WriteAttribute("title", Tuple.Create(" title=\"", 2900), Tuple.Create("\"", 2956)
             
             #line 62 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-                    , Tuple.Create(Tuple.Create("", 2925), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
+                    , Tuple.Create(Tuple.Create("", 2908), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
             
             #line default
             #line hidden
-, 2925), false)
-, Tuple.Create(Tuple.Create("", 2962), Tuple.Create(":", 2962), true)
-, Tuple.Create(Tuple.Create(" ", 2963), Tuple.Create("Add", 2964), true)
-, Tuple.Create(Tuple.Create(" ", 2967), Tuple.Create("Users", 2968), true)
+, 2908), false)
+, Tuple.Create(Tuple.Create("", 2945), Tuple.Create(":", 2945), true)
+, Tuple.Create(Tuple.Create(" ", 2946), Tuple.Create("Add", 2947), true)
+, Tuple.Create(Tuple.Create(" ", 2950), Tuple.Create("Users", 2951), true)
 );
 
 WriteLiteral(">\r\n    <div");
@@ -396,7 +396,7 @@ WriteLiteral("\\rsmith;Domain Admins</div>\r\n        </div>\r\n    </div>\r\n")
             #line hidden
             
             #line 82 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-     using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddUsers(), FormMethod.Post))
+     using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddUsers()))
     {
 
             
@@ -451,18 +451,18 @@ WriteLiteral(" id=\"DocumentTemplate_BulkGenerate_Dialog_AddGroupMembers\"");
 
 WriteLiteral(" class=\"dialog dialog-bulk-generate\"");
 
-WriteAttribute("title", Tuple.Create(" title=\"", 4437), Tuple.Create("\"", 4501)
+WriteAttribute("title", Tuple.Create(" title=\"", 4403), Tuple.Create("\"", 4467)
             
             #line 90 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-                           , Tuple.Create(Tuple.Create("", 4445), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
+                           , Tuple.Create(Tuple.Create("", 4411), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
             
             #line default
             #line hidden
-, 4445), false)
-, Tuple.Create(Tuple.Create("", 4482), Tuple.Create(":", 4482), true)
-, Tuple.Create(Tuple.Create(" ", 4483), Tuple.Create("Add", 4484), true)
-, Tuple.Create(Tuple.Create(" ", 4487), Tuple.Create("Group", 4488), true)
-, Tuple.Create(Tuple.Create(" ", 4493), Tuple.Create("Members", 4494), true)
+, 4411), false)
+, Tuple.Create(Tuple.Create("", 4448), Tuple.Create(":", 4448), true)
+, Tuple.Create(Tuple.Create(" ", 4449), Tuple.Create("Add", 4450), true)
+, Tuple.Create(Tuple.Create(" ", 4453), Tuple.Create("Group", 4454), true)
+, Tuple.Create(Tuple.Create(" ", 4459), Tuple.Create("Members", 4460), true)
 );
 
 WriteLiteral(">\r\n    <div");
@@ -480,7 +480,7 @@ WriteLiteral(">\r\n        <div>\r\n            Add all members of a group (incl
             #line hidden
             
             #line 96 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-     using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddGroupMembers(), FormMethod.Post))
+     using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddGroupMembers()))
     {
 
             
@@ -555,19 +555,19 @@ WriteLiteral(" id=\"DocumentTemplate_BulkGenerate_Dialog_AddUserFlag\"");
 
 WriteLiteral(" class=\"dialog dialog-bulk-generate\"");
 
-WriteAttribute("title", Tuple.Create(" title=\"", 5539), Tuple.Create("\"", 5611)
+WriteAttribute("title", Tuple.Create(" title=\"", 5488), Tuple.Create("\"", 5560)
             
             #line 116 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-                           , Tuple.Create(Tuple.Create("", 5547), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
+                           , Tuple.Create(Tuple.Create("", 5496), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
             
             #line default
             #line hidden
-, 5547), false)
-, Tuple.Create(Tuple.Create("", 5584), Tuple.Create(":", 5584), true)
-, Tuple.Create(Tuple.Create(" ", 5585), Tuple.Create("Add", 5586), true)
-, Tuple.Create(Tuple.Create(" ", 5589), Tuple.Create("User", 5590), true)
-, Tuple.Create(Tuple.Create(" ", 5594), Tuple.Create("Flag", 5595), true)
-, Tuple.Create(Tuple.Create(" ", 5599), Tuple.Create("Assignments", 5600), true)
+, 5496), false)
+, Tuple.Create(Tuple.Create("", 5533), Tuple.Create(":", 5533), true)
+, Tuple.Create(Tuple.Create(" ", 5534), Tuple.Create("Add", 5535), true)
+, Tuple.Create(Tuple.Create(" ", 5538), Tuple.Create("User", 5539), true)
+, Tuple.Create(Tuple.Create(" ", 5543), Tuple.Create("Flag", 5544), true)
+, Tuple.Create(Tuple.Create(" ", 5548), Tuple.Create("Assignments", 5549), true)
 );
 
 WriteLiteral(">\r\n        <div");
@@ -585,7 +585,7 @@ WriteLiteral(">\r\n            <div>\r\n                Add all users associated
             #line hidden
             
             #line 122 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddUserFlag(), FormMethod.Post))
+         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddUserFlag()))
         {
 
             
@@ -621,15 +621,15 @@ WriteLiteral(">\r\n");
             #line hidden
 WriteLiteral("                    <div");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 6097), Tuple.Create("\"", 6148)
-, Tuple.Create(Tuple.Create("", 6105), Tuple.Create("item", 6105), true)
+WriteAttribute("class", Tuple.Create(" class=\"", 6029), Tuple.Create("\"", 6080)
+, Tuple.Create(Tuple.Create("", 6037), Tuple.Create("item", 6037), true)
             
             #line 128 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-, Tuple.Create(Tuple.Create(" ", 6109), Tuple.Create<System.Object, System.Int32>(flag.Count == 0 ? "disabled" : null
+, Tuple.Create(Tuple.Create(" ", 6041), Tuple.Create<System.Object, System.Int32>(flag.Count == 0 ? "disabled" : null
             
             #line default
             #line hidden
-, 6110), false)
+, 6042), false)
 );
 
 WriteLiteral(" data-userflagid=\"");
@@ -645,26 +645,26 @@ WriteLiteral("\"");
 
 WriteLiteral(">\r\n                        <i");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 6210), Tuple.Create("\"", 6279)
-, Tuple.Create(Tuple.Create("", 6218), Tuple.Create("fa", 6218), true)
-, Tuple.Create(Tuple.Create(" ", 6220), Tuple.Create("fa-", 6221), true)
+WriteAttribute("class", Tuple.Create(" class=\"", 6142), Tuple.Create("\"", 6211)
+, Tuple.Create(Tuple.Create("", 6150), Tuple.Create("fa", 6150), true)
+, Tuple.Create(Tuple.Create(" ", 6152), Tuple.Create("fa-", 6153), true)
             
             #line 129 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-, Tuple.Create(Tuple.Create("", 6224), Tuple.Create<System.Object, System.Int32>(flag.Item.Icon
+, Tuple.Create(Tuple.Create("", 6156), Tuple.Create<System.Object, System.Int32>(flag.Item.Icon
             
             #line default
             #line hidden
-, 6224), false)
-, Tuple.Create(Tuple.Create(" ", 6241), Tuple.Create("fa-fw", 6242), true)
-, Tuple.Create(Tuple.Create(" ", 6247), Tuple.Create("fa-lg", 6248), true)
-, Tuple.Create(Tuple.Create(" ", 6253), Tuple.Create("d-", 6254), true)
+, 6156), false)
+, Tuple.Create(Tuple.Create(" ", 6173), Tuple.Create("fa-fw", 6174), true)
+, Tuple.Create(Tuple.Create(" ", 6179), Tuple.Create("fa-lg", 6180), true)
+, Tuple.Create(Tuple.Create(" ", 6185), Tuple.Create("d-", 6186), true)
             
             #line 129 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-, Tuple.Create(Tuple.Create("", 6256), Tuple.Create<System.Object, System.Int32>(flag.Item.IconColour
+, Tuple.Create(Tuple.Create("", 6188), Tuple.Create<System.Object, System.Int32>(flag.Item.IconColour
             
             #line default
             #line hidden
-, 6256), false)
+, 6188), false)
 );
 
 WriteLiteral("></i>");
@@ -752,21 +752,21 @@ WriteLiteral(" id=\"DocumentTemplate_BulkGenerate_Dialog_AddDeviceProfile\"");
 
 WriteLiteral(" class=\"dialog dialog-bulk-generate\"");
 
-WriteAttribute("title", Tuple.Create(" title=\"", 6673), Tuple.Create("\"", 6755)
+WriteAttribute("title", Tuple.Create(" title=\"", 6605), Tuple.Create("\"", 6687)
             
             #line 141 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-                                , Tuple.Create(Tuple.Create("", 6681), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
+                                , Tuple.Create(Tuple.Create("", 6613), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
             
             #line default
             #line hidden
-, 6681), false)
-, Tuple.Create(Tuple.Create("", 6718), Tuple.Create(":", 6718), true)
-, Tuple.Create(Tuple.Create(" ", 6719), Tuple.Create("Add", 6720), true)
-, Tuple.Create(Tuple.Create(" ", 6723), Tuple.Create("User", 6724), true)
-, Tuple.Create(Tuple.Create(" ", 6728), Tuple.Create("by", 6729), true)
-, Tuple.Create(Tuple.Create(" ", 6731), Tuple.Create("Assigned", 6732), true)
-, Tuple.Create(Tuple.Create(" ", 6740), Tuple.Create("Device", 6741), true)
-, Tuple.Create(Tuple.Create(" ", 6747), Tuple.Create("Profile", 6748), true)
+, 6613), false)
+, Tuple.Create(Tuple.Create("", 6650), Tuple.Create(":", 6650), true)
+, Tuple.Create(Tuple.Create(" ", 6651), Tuple.Create("Add", 6652), true)
+, Tuple.Create(Tuple.Create(" ", 6655), Tuple.Create("User", 6656), true)
+, Tuple.Create(Tuple.Create(" ", 6660), Tuple.Create("by", 6661), true)
+, Tuple.Create(Tuple.Create(" ", 6663), Tuple.Create("Assigned", 6664), true)
+, Tuple.Create(Tuple.Create(" ", 6672), Tuple.Create("Device", 6673), true)
+, Tuple.Create(Tuple.Create(" ", 6679), Tuple.Create("Profile", 6680), true)
 );
 
 WriteLiteral(">\r\n        <div");
@@ -785,7 +785,7 @@ WriteLiteral(">\r\n            <div>\r\n                Add all users associated
             #line hidden
             
             #line 147 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddDeviceProfile(), FormMethod.Post))
+         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddDeviceProfile()))
         {
 
             
@@ -821,15 +821,15 @@ WriteLiteral(">\r\n");
             #line hidden
 WriteLiteral("                    <div");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 7287), Tuple.Create("\"", 7341)
-, Tuple.Create(Tuple.Create("", 7295), Tuple.Create("item", 7295), true)
+WriteAttribute("class", Tuple.Create(" class=\"", 7202), Tuple.Create("\"", 7256)
+, Tuple.Create(Tuple.Create("", 7210), Tuple.Create("item", 7210), true)
             
             #line 153 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-, Tuple.Create(Tuple.Create(" ", 7299), Tuple.Create<System.Object, System.Int32>(profile.Count == 0 ? "disabled" : null
+, Tuple.Create(Tuple.Create(" ", 7214), Tuple.Create<System.Object, System.Int32>(profile.Count == 0 ? "disabled" : null
             
             #line default
             #line hidden
-, 7300), false)
+, 7215), false)
 );
 
 WriteLiteral(" data-id=\"");
@@ -931,21 +931,21 @@ WriteLiteral(" id=\"DocumentTemplate_BulkGenerate_Dialog_AddDeviceBatch\"");
 
 WriteLiteral(" class=\"dialog dialog-bulk-generate\"");
 
-WriteAttribute("title", Tuple.Create(" title=\"", 7825), Tuple.Create("\"", 7905)
+WriteAttribute("title", Tuple.Create(" title=\"", 7740), Tuple.Create("\"", 7820)
             
             #line 165 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-                              , Tuple.Create(Tuple.Create("", 7833), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
+                              , Tuple.Create(Tuple.Create("", 7748), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
             
             #line default
             #line hidden
-, 7833), false)
-, Tuple.Create(Tuple.Create("", 7870), Tuple.Create(":", 7870), true)
-, Tuple.Create(Tuple.Create(" ", 7871), Tuple.Create("Add", 7872), true)
-, Tuple.Create(Tuple.Create(" ", 7875), Tuple.Create("User", 7876), true)
-, Tuple.Create(Tuple.Create(" ", 7880), Tuple.Create("by", 7881), true)
-, Tuple.Create(Tuple.Create(" ", 7883), Tuple.Create("Assigned", 7884), true)
-, Tuple.Create(Tuple.Create(" ", 7892), Tuple.Create("Device", 7893), true)
-, Tuple.Create(Tuple.Create(" ", 7899), Tuple.Create("Batch", 7900), true)
+, 7748), false)
+, Tuple.Create(Tuple.Create("", 7785), Tuple.Create(":", 7785), true)
+, Tuple.Create(Tuple.Create(" ", 7786), Tuple.Create("Add", 7787), true)
+, Tuple.Create(Tuple.Create(" ", 7790), Tuple.Create("User", 7791), true)
+, Tuple.Create(Tuple.Create(" ", 7795), Tuple.Create("by", 7796), true)
+, Tuple.Create(Tuple.Create(" ", 7798), Tuple.Create("Assigned", 7799), true)
+, Tuple.Create(Tuple.Create(" ", 7807), Tuple.Create("Device", 7808), true)
+, Tuple.Create(Tuple.Create(" ", 7814), Tuple.Create("Batch", 7815), true)
 );
 
 WriteLiteral(">\r\n        <div");
@@ -963,7 +963,7 @@ WriteLiteral(">\r\n            <div>\r\n                Add all users associated
             #line hidden
             
             #line 171 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddDeviceBatch(), FormMethod.Post))
+         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddDeviceBatch()))
         {
 
             
@@ -999,15 +999,15 @@ WriteLiteral(">\r\n");
             #line hidden
 WriteLiteral("                    <div");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 8428), Tuple.Create("\"", 8480)
-, Tuple.Create(Tuple.Create("", 8436), Tuple.Create("item", 8436), true)
+WriteAttribute("class", Tuple.Create(" class=\"", 8326), Tuple.Create("\"", 8378)
+, Tuple.Create(Tuple.Create("", 8334), Tuple.Create("item", 8334), true)
             
             #line 177 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-, Tuple.Create(Tuple.Create(" ", 8440), Tuple.Create<System.Object, System.Int32>(batch.Count == 0 ? "disabled" : null
+, Tuple.Create(Tuple.Create(" ", 8338), Tuple.Create<System.Object, System.Int32>(batch.Count == 0 ? "disabled" : null
             
             #line default
             #line hidden
-, 8441), false)
+, 8339), false)
 );
 
 WriteLiteral(" data-id=\"");
@@ -1109,21 +1109,21 @@ WriteLiteral(" id=\"DocumentTemplate_BulkGenerate_Dialog_AddDocumentAttachment\"
 
 WriteLiteral(" class=\"dialog dialog-bulk-generate\"");
 
-WriteAttribute("title", Tuple.Create(" title=\"", 8967), Tuple.Create("\"", 9047)
+WriteAttribute("title", Tuple.Create(" title=\"", 8865), Tuple.Create("\"", 8945)
             
             #line 189 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-                                     , Tuple.Create(Tuple.Create("", 8975), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
+                                     , Tuple.Create(Tuple.Create("", 8873), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
             
             #line default
             #line hidden
-, 8975), false)
-, Tuple.Create(Tuple.Create("", 9012), Tuple.Create(":", 9012), true)
-, Tuple.Create(Tuple.Create(" ", 9013), Tuple.Create("Add", 9014), true)
-, Tuple.Create(Tuple.Create(" ", 9017), Tuple.Create("User", 9018), true)
-, Tuple.Create(Tuple.Create(" ", 9022), Tuple.Create("by", 9023), true)
-, Tuple.Create(Tuple.Create(" ", 9025), Tuple.Create("Assigned", 9026), true)
-, Tuple.Create(Tuple.Create(" ", 9034), Tuple.Create("Device", 9035), true)
-, Tuple.Create(Tuple.Create(" ", 9041), Tuple.Create("Batch", 9042), true)
+, 8873), false)
+, Tuple.Create(Tuple.Create("", 8910), Tuple.Create(":", 8910), true)
+, Tuple.Create(Tuple.Create(" ", 8911), Tuple.Create("Add", 8912), true)
+, Tuple.Create(Tuple.Create(" ", 8915), Tuple.Create("User", 8916), true)
+, Tuple.Create(Tuple.Create(" ", 8920), Tuple.Create("by", 8921), true)
+, Tuple.Create(Tuple.Create(" ", 8923), Tuple.Create("Assigned", 8924), true)
+, Tuple.Create(Tuple.Create(" ", 8932), Tuple.Create("Device", 8933), true)
+, Tuple.Create(Tuple.Create(" ", 8939), Tuple.Create("Batch", 8940), true)
 );
 
 WriteLiteral(">\r\n        <div");
@@ -1142,7 +1142,7 @@ WriteLiteral(">\r\n            <div>\r\n                Add all users associated
             #line hidden
             
             #line 195 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddDocumentAttachment(), FormMethod.Post))
+         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddDocumentAttachment()))
         {
 
             
@@ -1178,15 +1178,15 @@ WriteLiteral(">\r\n");
             #line hidden
 WriteLiteral("                    <div");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 9606), Tuple.Create("\"", 9661)
-, Tuple.Create(Tuple.Create("", 9614), Tuple.Create("item", 9614), true)
+WriteAttribute("class", Tuple.Create(" class=\"", 9487), Tuple.Create("\"", 9542)
+, Tuple.Create(Tuple.Create("", 9495), Tuple.Create("item", 9495), true)
             
             #line 201 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-, Tuple.Create(Tuple.Create(" ", 9618), Tuple.Create<System.Object, System.Int32>(template.Count == 0 ? "disabled" : null
+, Tuple.Create(Tuple.Create(" ", 9499), Tuple.Create<System.Object, System.Int32>(template.Count == 0 ? "disabled" : null
             
             #line default
             #line hidden
-, 9619), false)
+, 9500), false)
 );
 
 WriteLiteral(" data-id=\"");
@@ -1316,19 +1316,19 @@ WriteLiteral(" id=\"DocumentTemplate_BulkGenerate_Dialog_AddUserDetail\"");
 
 WriteLiteral(" class=\"dialog dialog-bulk-generate\"");
 
-WriteAttribute("title", Tuple.Create(" title=\"", 10517), Tuple.Create("\"", 10582)
+WriteAttribute("title", Tuple.Create(" title=\"", 10398), Tuple.Create("\"", 10463)
             
             #line 217 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-                            , Tuple.Create(Tuple.Create("", 10525), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
+                            , Tuple.Create(Tuple.Create("", 10406), Tuple.Create<System.Object, System.Int32>(Model.DocumentTemplate.Description
             
             #line default
             #line hidden
-, 10525), false)
-, Tuple.Create(Tuple.Create("", 10562), Tuple.Create(":", 10562), true)
-, Tuple.Create(Tuple.Create(" ", 10563), Tuple.Create("Add", 10564), true)
-, Tuple.Create(Tuple.Create(" ", 10567), Tuple.Create("User", 10568), true)
-, Tuple.Create(Tuple.Create(" ", 10572), Tuple.Create("by", 10573), true)
-, Tuple.Create(Tuple.Create(" ", 10575), Tuple.Create("Detail", 10576), true)
+, 10406), false)
+, Tuple.Create(Tuple.Create("", 10443), Tuple.Create(":", 10443), true)
+, Tuple.Create(Tuple.Create(" ", 10444), Tuple.Create("Add", 10445), true)
+, Tuple.Create(Tuple.Create(" ", 10448), Tuple.Create("User", 10449), true)
+, Tuple.Create(Tuple.Create(" ", 10453), Tuple.Create("by", 10454), true)
+, Tuple.Create(Tuple.Create(" ", 10456), Tuple.Create("Detail", 10457), true)
 );
 
 WriteLiteral(">\r\n        <div");
@@ -1346,7 +1346,7 @@ WriteLiteral(">\r\n            <div>\r\n                Add all users with a mat
             #line hidden
             
             #line 223 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddUserDetail(), FormMethod.Post))
+         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateAddUserDetail()))
         {
 
             
@@ -1401,15 +1401,15 @@ WriteLiteral(">\r\n");
             #line hidden
 WriteLiteral("                    <div");
 
-WriteAttribute("class", Tuple.Create(" class=\"", 11216), Tuple.Create("\"", 11266)
-, Tuple.Create(Tuple.Create("", 11224), Tuple.Create("item", 11224), true)
+WriteAttribute("class", Tuple.Create(" class=\"", 11080), Tuple.Create("\"", 11130)
+, Tuple.Create(Tuple.Create("", 11088), Tuple.Create("item", 11088), true)
             
             #line 231 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-, Tuple.Create(Tuple.Create(" ", 11228), Tuple.Create<System.Object, System.Int32>(key.Count == 0 ? "disabled" : null
+, Tuple.Create(Tuple.Create(" ", 11092), Tuple.Create<System.Object, System.Int32>(key.Count == 0 ? "disabled" : null
             
             #line default
             #line hidden
-, 11229), false)
+, 11093), false)
 );
 
 WriteLiteral(" data-id=\"");
@@ -1491,7 +1491,7 @@ WriteLiteral("        ");
 
             
             #line 239 "..\..\Areas\Config\Views\DocumentTemplate\BulkGenerate.cshtml"
-         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateGetUserDetailValues(), FormMethod.Post))
+         using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerateGetUserDetailValues()))
         {
 
             

Disco.Web/Areas/Config/Views/DocumentTemplate/Create.cshtml

@@ -1,25 +1,28 @@
 @model Disco.Web.Areas.Config.Models.DocumentTemplate.CreateModel
 @{
     Authorization.RequireAll(Claims.Config.DocumentTemplate.Create, Claims.Config.DocumentTemplate.Configure);
-    
+
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Document Templates", MVC.Config.DocumentTemplate.Index(null), "Create");
 }
 @using (Html.BeginForm(MVC.Config.DocumentTemplate.Create(), FormMethod.Post, new { enctype = "multipart/form-data" }))
-{ 
+{
+    @Html.AntiForgeryToken()
     <div class="form" style="width: 650px">
         <table>
             <tr>
                 <th>
                     Id:
                 </th>
-                <td>@Html.TextBoxFor(model => model.DocumentTemplate.Id)<br />@Html.ValidationMessageFor(model => model.DocumentTemplate.Id)
+                <td>
+                    @Html.TextBoxFor(model => model.Id)<br />@Html.ValidationMessageFor(model => model.Id)
                 </td>
             </tr>
             <tr>
                 <th>
                     Description:
                 </th>
-                <td>@Html.TextBoxFor(model => model.DocumentTemplate.Description)<br />@Html.ValidationMessageFor(model => model.DocumentTemplate.Description)
+                <td>
+                    @Html.TextBoxFor(model => model.Description)<br />@Html.ValidationMessageFor(model => model.Description)
                 </td>
             </tr>
             <tr>
@@ -27,7 +30,7 @@
                     Scope:
                 </th>
                 <td>
-                    @Html.DropDownListFor(model => model.DocumentTemplate.Scope, Model.Scopes.ToSelectListItems(null))
+                    @Html.DropDownListFor(model => model.Scope, Model.Scopes.ToSelectListItems(null))
                 </td>
             </tr>
             <tr>
@@ -52,12 +55,13 @@
                     <th class="name">
                         @jt.Description<br />
                         Sub Types<br />
-                    @CommonHelpers.CheckboxBulkSelect(string.Format("CheckboxBulkSelect_{0}", jt.Id))
+                        @CommonHelpers.CheckboxBulkSelect(string.Format("CheckboxBulkSelect_{0}", jt.Id))
                     </th>
                     <td class="value">
                         @CommonHelpers.CheckBoxList("SubTypes", Model.JobSubTypes.Where(jst => jst.JobTypeId == jt.Id).ToList().ToSelectListItems(Model.SubTypes), 2)
                     </td>
-                </tr>   
+                </tr>
+
             }
         </table>
         <p class="actions">
@@ -68,7 +72,7 @@
         $(function () {
             $('#Name').focus().select();
 
-            var $scope = $('#DocumentTemplate_Scope');
+            var $scope = $('#Scope');
             var $trJobTypes = $('#trJobTypes');
             var $jobTypes = $trJobTypes.find('input[type="checkbox"]');
             $scope.change(scopeChange);
@@ -89,10 +93,10 @@
             function jobTypesChange() {
                 $('.jobSubTypes').hide();
                 $jobTypes.filter(':checked').each(function () {
-                    $('#trJobSubType' + $(this).val()).show();    
+                    $('#trJobSubType' + $(this).val()).show();
                 });
             }
 
         });
     </script>
-}
+}

Disco.Web/Areas/Config/Views/DocumentTemplate/Create.generated.cs

@@ -47,7 +47,7 @@ namespace Disco.Web.Areas.Config.Views.DocumentTemplate
             #line 2 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
   
     Authorization.RequireAll(Claims.Config.DocumentTemplate.Create, Claims.Config.DocumentTemplate.Configure);
-    
+
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Document Templates", MVC.Config.DocumentTemplate.Index(null), "Create");
 
             
@@ -58,7 +58,21 @@ WriteLiteral("\r\n");
             
             #line 7 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
  using (Html.BeginForm(MVC.Config.DocumentTemplate.Create(), FormMethod.Post, new { enctype = "multipart/form-data" }))
-{ 
+{
+    
+            
+            #line default
+            #line hidden
+            
+            #line 9 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+Write(Html.AntiForgeryToken());
+
+            
+            #line default
+            #line hidden
+            
+            #line 9 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+                            
 
             
             #line default
@@ -70,11 +84,13 @@ WriteLiteral(" class=\"form\"");
 WriteLiteral(" style=\"width: 650px\"");
 
 WriteLiteral(">\r\n        <table>\r\n            <tr>\r\n                <th>\r\n                    I" +
-"d:\r\n                </th>\r\n                <td>");
+"d:\r\n                </th>\r\n                <td>\r\n");
+
+WriteLiteral("                    ");
 
             
-            #line 15 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
-               Write(Html.TextBoxFor(model => model.DocumentTemplate.Id));
+            #line 17 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+               Write(Html.TextBoxFor(model => model.Id));
 
             
             #line default
@@ -82,19 +98,21 @@ WriteLiteral(">\r\n        <table>\r\n            <tr>\r\n                <th>\r
 WriteLiteral("<br />");
 
             
-            #line 15 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
-                                                                         Write(Html.ValidationMessageFor(model => model.DocumentTemplate.Id));
+            #line 17 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+                                                        Write(Html.ValidationMessageFor(model => model.Id));
 
             
             #line default
             #line hidden
 WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>\r\n                <th" +
 ">\r\n                    Description:\r\n                </th>\r\n                <td>" +
-"");
+"\r\n");
+
+WriteLiteral("                    ");
 
             
-            #line 22 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
-               Write(Html.TextBoxFor(model => model.DocumentTemplate.Description));
+            #line 25 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+               Write(Html.TextBoxFor(model => model.Description));
 
             
             #line default
@@ -102,8 +120,8 @@ WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>
 WriteLiteral("<br />");
 
             
-            #line 22 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
-                                                                                  Write(Html.ValidationMessageFor(model => model.DocumentTemplate.Description));
+            #line 25 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+                                                                 Write(Html.ValidationMessageFor(model => model.Description));
 
             
             #line default
@@ -114,8 +132,8 @@ WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>
 WriteLiteral("                    ");
 
             
-            #line 30 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
-               Write(Html.DropDownListFor(model => model.DocumentTemplate.Scope, Model.Scopes.ToSelectListItems(null)));
+            #line 33 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+               Write(Html.DropDownListFor(model => model.Scope, Model.Scopes.ToSelectListItems(null)));
 
             
             #line default
@@ -133,7 +151,7 @@ WriteLiteral(" accept=\".pdf\"");
 WriteLiteral(" /><br />");
 
             
-            #line 38 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+            #line 41 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
                                                                         Write(Html.ValidationMessage("Template"));
 
             
@@ -156,7 +174,7 @@ WriteLiteral(">\r\n");
 WriteLiteral("                    ");
 
             
-            #line 46 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+            #line 49 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
                Write(CommonHelpers.CheckBoxList("Types", Model.JobTypes.ToSelectListItems(Model.Types), 2));
 
             
@@ -165,13 +183,13 @@ WriteLiteral("                    ");
 WriteLiteral("\r\n                </td>\r\n            </tr>\r\n");
 
             
-            #line 49 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+            #line 52 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
             
             
             #line default
             #line hidden
             
-            #line 49 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+            #line 52 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
              foreach (var jt in Model.JobTypes)
             {
 
@@ -180,15 +198,15 @@ WriteLiteral("\r\n                </td>\r\n            </tr>\r\n");
             #line hidden
 WriteLiteral("                <tr");
 
-WriteAttribute("id", Tuple.Create(" id=\"", 2046), Tuple.Create("\"", 2071)
-, Tuple.Create(Tuple.Create("", 2051), Tuple.Create("trJobSubType", 2051), true)
+WriteAttribute("id", Tuple.Create(" id=\"", 2030), Tuple.Create("\"", 2055)
+, Tuple.Create(Tuple.Create("", 2035), Tuple.Create("trJobSubType", 2035), true)
             
-            #line 51 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
-, Tuple.Create(Tuple.Create("", 2063), Tuple.Create<System.Object, System.Int32>(jt.Id
+            #line 54 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+, Tuple.Create(Tuple.Create("", 2047), Tuple.Create<System.Object, System.Int32>(jt.Id
             
             #line default
             #line hidden
-, 2063), false)
+, 2047), false)
 );
 
 WriteLiteral(" class=\"jobSubTypes\"");
@@ -202,7 +220,7 @@ WriteLiteral(">\r\n");
 WriteLiteral("                        ");
 
             
-            #line 53 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+            #line 56 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
                    Write(jt.Description);
 
             
@@ -210,11 +228,11 @@ WriteLiteral("                        ");
             #line hidden
 WriteLiteral("<br />\r\n                        Sub Types<br />\r\n");
 
-WriteLiteral("                    ");
+WriteLiteral("                        ");
 
             
-            #line 55 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
-               Write(CommonHelpers.CheckboxBulkSelect(string.Format("CheckboxBulkSelect_{0}", jt.Id)));
+            #line 58 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+                   Write(CommonHelpers.CheckboxBulkSelect(string.Format("CheckboxBulkSelect_{0}", jt.Id)));
 
             
             #line default
@@ -228,16 +246,17 @@ WriteLiteral(">\r\n");
 WriteLiteral("                        ");
 
             
-            #line 58 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+            #line 61 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
                    Write(CommonHelpers.CheckBoxList("SubTypes", Model.JobSubTypes.Where(jst => jst.JobTypeId == jt.Id).ToList().ToSelectListItems(Model.SubTypes), 2));
 
             
             #line default
             #line hidden
-WriteLiteral("\r\n                    </td>\r\n                </tr>   \r\n");
+WriteLiteral("\r\n                    </td>\r\n                </tr>\r\n");
 
             
-            #line 61 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+            #line 64 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+
             }
 
             
@@ -265,7 +284,7 @@ WriteLiteral(@">
         $(function () {
             $('#Name').focus().select();
 
-            var $scope = $('#DocumentTemplate_Scope');
+            var $scope = $('#Scope');
             var $trJobTypes = $('#trJobTypes');
             var $jobTypes = $trJobTypes.find('input[type=""checkbox""]');
             $scope.change(scopeChange);
@@ -286,7 +305,7 @@ WriteLiteral(@">
             function jobTypesChange() {
                 $('.jobSubTypes').hide();
                 $jobTypes.filter(':checked').each(function () {
-                    $('#trJobSubType' + $(this).val()).show();    
+                    $('#trJobSubType' + $(this).val()).show();
                 });
             }
 
@@ -295,8 +314,9 @@ WriteLiteral(@">
 ");
 
             
-            #line 98 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
+            #line 102 "..\..\Areas\Config\Views\DocumentTemplate\Create.cshtml"
 }
+
             
             #line default
             #line hidden

Disco.Web/Areas/Config/Views/DocumentTemplate/CreatePackage.cshtml

@@ -1,25 +1,28 @@
 @model Disco.Web.Areas.Config.Models.DocumentTemplate.CreatePackageModel
 @{
     Authorization.RequireAll(Claims.Config.DocumentTemplate.Create, Claims.Config.DocumentTemplate.Configure);
-    
+
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Document Templates", MVC.Config.DocumentTemplate.Index(null), "Create Package");
 }
 @using (Html.BeginForm(MVC.Config.DocumentTemplate.CreatePackage()))
-{ 
+{
+    @Html.AntiForgeryToken()
     <div class="form" style="width: 650px">
         <table>
             <tr>
                 <th>
                     Id:
                 </th>
-                <td>@Html.TextBoxFor(model => model.Package.Id)<br />@Html.ValidationMessageFor(model => model.Package.Id)
+                <td>
+                    @Html.TextBoxFor(model => model.Id)<br />@Html.ValidationMessageFor(model => model.Id)
                 </td>
             </tr>
             <tr>
                 <th>
                     Description:
                 </th>
-                <td>@Html.TextBoxFor(model => model.Package.Description)<br />@Html.ValidationMessageFor(model => model.Package.Description)
+                <td>
+                    @Html.TextBoxFor(model => model.Description)<br />@Html.ValidationMessageFor(model => model.Description)
                 </td>
             </tr>
             <tr>
@@ -27,7 +30,7 @@
                     Scope:
                 </th>
                 <td>
-                    @Html.DropDownListFor(model => model.Package.Scope, Model.Scopes.ToSelectListItems(null))
+                    @Html.DropDownListFor(model => model.Scope, Model.Scopes.ToSelectListItems(null))
                 </td>
             </tr>
         </table>

Disco.Web/Areas/Config/Views/DocumentTemplate/CreatePackage.generated.cs

@@ -47,7 +47,7 @@ namespace Disco.Web.Areas.Config.Views.DocumentTemplate
             #line 2 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
   
     Authorization.RequireAll(Claims.Config.DocumentTemplate.Create, Claims.Config.DocumentTemplate.Configure);
-    
+
     ViewBag.Title = Html.ToBreadcrumb("Configuration", MVC.Config.Config.Index(), "Document Templates", MVC.Config.DocumentTemplate.Index(null), "Create Package");
 
             
@@ -58,7 +58,21 @@ WriteLiteral("\r\n");
             
             #line 7 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
  using (Html.BeginForm(MVC.Config.DocumentTemplate.CreatePackage()))
-{ 
+{
+    
+            
+            #line default
+            #line hidden
+            
+            #line 9 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
+Write(Html.AntiForgeryToken());
+
+            
+            #line default
+            #line hidden
+            
+            #line 9 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
+                            
 
             
             #line default
@@ -70,11 +84,13 @@ WriteLiteral(" class=\"form\"");
 WriteLiteral(" style=\"width: 650px\"");
 
 WriteLiteral(">\r\n        <table>\r\n            <tr>\r\n                <th>\r\n                    I" +
-"d:\r\n                </th>\r\n                <td>");
+"d:\r\n                </th>\r\n                <td>\r\n");
+
+WriteLiteral("                    ");
 
             
-            #line 15 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
-               Write(Html.TextBoxFor(model => model.Package.Id));
+            #line 17 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
+               Write(Html.TextBoxFor(model => model.Id));
 
             
             #line default
@@ -82,19 +98,21 @@ WriteLiteral(">\r\n        <table>\r\n            <tr>\r\n                <th>\r
 WriteLiteral("<br />");
 
             
-            #line 15 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
-                                                                Write(Html.ValidationMessageFor(model => model.Package.Id));
+            #line 17 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
+                                                        Write(Html.ValidationMessageFor(model => model.Id));
 
             
             #line default
             #line hidden
 WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>\r\n                <th" +
 ">\r\n                    Description:\r\n                </th>\r\n                <td>" +
-"");
+"\r\n");
+
+WriteLiteral("                    ");
 
             
-            #line 22 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
-               Write(Html.TextBoxFor(model => model.Package.Description));
+            #line 25 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
+               Write(Html.TextBoxFor(model => model.Description));
 
             
             #line default
@@ -102,8 +120,8 @@ WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>
 WriteLiteral("<br />");
 
             
-            #line 22 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
-                                                                         Write(Html.ValidationMessageFor(model => model.Package.Description));
+            #line 25 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
+                                                                 Write(Html.ValidationMessageFor(model => model.Description));
 
             
             #line default
@@ -114,8 +132,8 @@ WriteLiteral("\r\n                </td>\r\n            </tr>\r\n            <tr>
 WriteLiteral("                    ");
 
             
-            #line 30 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
-               Write(Html.DropDownListFor(model => model.Package.Scope, Model.Scopes.ToSelectListItems(null)));
+            #line 33 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
+               Write(Html.DropDownListFor(model => model.Scope, Model.Scopes.ToSelectListItems(null)));
 
             
             #line default
@@ -135,7 +153,7 @@ WriteLiteral(" value=\"Create\"");
 WriteLiteral(" />\r\n        </p>\r\n    </div>\r\n");
 
             
-            #line 38 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
+            #line 41 "..\..\Areas\Config\Views\DocumentTemplate\CreatePackage.cshtml"
 }
             
             #line default

Disco.Web/Areas/Config/Views/DocumentTemplate/ImportStatus.cshtml

@@ -9,7 +9,6 @@
     Documents Imported Today
 </h2>
 <div id="importStatus">
-    @Html.AntiForgeryToken()
     <div id="noSessions" data-bind="visible: noSessions">
         <h3>No imported documents today</h3>
     </div>
@@ -285,7 +284,7 @@
                 End: null,
                 ModuleId: 40,
                 Take: 2000,
-                '__RequestVerificationToken': host.find('input[name="__RequestVerificationToken"]').val()
+                '__RequestVerificationToken': document.body.dataset.antiforgery
             };
             $.ajax({
                 url: '@(Url.Action(MVC.API.Logging.RetrieveEvents()))',

Disco.Web/Areas/Config/Views/DocumentTemplate/ImportStatus.generated.cs

@@ -59,18 +59,7 @@ WriteLiteral("\r\n<h2>\r\n    Documents Imported Today\r\n</h2>\r\n<div");
 
 WriteLiteral(" id=\"importStatus\"");
 
-WriteLiteral(">\r\n");
-
-WriteLiteral("    ");
-
-            
-            #line 12 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
-Write(Html.AntiForgeryToken());
-
-            
-            #line default
-            #line hidden
-WriteLiteral("\r\n    <div");
+WriteLiteral(">\r\n    <div");
 
 WriteLiteral(" id=\"noSessions\"");
 
@@ -289,7 +278,7 @@ WriteLiteral(">\r\n    $(function () {\r\n        var vm;\r\n        var host =
 "var urlDeviceShow = \'");
 
             
-            #line 107 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
+            #line 106 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
                          Write(Url.Action(MVC.Device.Show()));
 
             
@@ -298,7 +287,7 @@ WriteLiteral(">\r\n    $(function () {\r\n        var vm;\r\n        var host =
 WriteLiteral("/\'\r\n        var urlJobShow = \'");
 
             
-            #line 108 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
+            #line 107 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
                       Write(Url.Action(MVC.Job.Show()));
 
             
@@ -307,7 +296,7 @@ WriteLiteral("/\'\r\n        var urlJobShow = \'");
 WriteLiteral("/\'\r\n        var urlUserShow = \'");
 
             
-            #line 109 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
+            #line 108 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
                        Write(Url.Action(MVC.User.Show()));
 
             
@@ -316,7 +305,7 @@ WriteLiteral("/\'\r\n        var urlUserShow = \'");
 WriteLiteral("/\'\r\n        var urlPageThumbnail = \'");
 
             
-            #line 110 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
+            #line 109 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
                             Write(Url.Action(MVC.API.DocumentTemplate.ImporterThumbnail()));
 
             
@@ -325,7 +314,7 @@ WriteLiteral("/\'\r\n        var urlPageThumbnail = \'");
 WriteLiteral("/\'\r\n        var urlDocumentTemplate = \'");
 
             
-            #line 111 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
+            #line 110 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
                                Write(Url.Action(MVC.Config.DocumentTemplate.Index()));
 
             
@@ -334,7 +323,7 @@ WriteLiteral("/\'\r\n        var urlDocumentTemplate = \'");
 WriteLiteral("/\';\r\n        var urlManuallyAssign = \'");
 
             
-            #line 112 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
+            #line 111 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
                              Write(Url.Action(MVC.Config.DocumentTemplate.UndetectedPages()));
 
             
@@ -442,11 +431,11 @@ WriteLiteral("\';\r\n        var isLive = false;\r\n\r\n        function pageVie
 "ar loadData = {\r\n                Format: \"json\",\r\n                Start: d.getFu" +
 "llYear() + \'-\' + (d.getMonth() + 1) + \'-\' + d.getDate(),\r\n                End: n" +
 "ull,\r\n                ModuleId: 40,\r\n                Take: 2000,\r\n              " +
-"  \'__RequestVerificationToken\': host.find(\'input[name=\"__RequestVerificationToke" +
-"n\"]\').val()\r\n            };\r\n            $.ajax({\r\n                url: \'");
+"  \'__RequestVerificationToken\': document.body.dataset.antiforgery\r\n            }" +
+";\r\n            $.ajax({\r\n                url: \'");
 
             
-            #line 291 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
+            #line 290 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
                   Write(Url.Action(MVC.API.Logging.RetrieveEvents()));
 
             
@@ -478,7 +467,7 @@ WriteLiteral(@"',
             $.connection.hub.qs = { LogModules: '");
 
             
-            #line 314 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
+            #line 313 "..\..\Areas\Config\Views\DocumentTemplate\ImportStatus.cshtml"
                                              Write(Disco.Services.Documents.DocumentsLog.Current.LiveLogGroupName);
 
             

Disco.Web/Areas/Config/Views/DocumentTemplate/Show.cshtml

@@ -152,6 +152,7 @@
                             <div id="Config_DocumentTemplates_Scope_Dialog" title="Change Document Template Scope" class="dialog">
                                 @using (Html.BeginForm(MVC.API.DocumentTemplate.UpdateScope(Model.DocumentTemplate.Id, redirect: true)))
                                 {
+                                    @Html.AntiForgeryToken()
                                     <div class="input">
                                         <label for="Config_DocumentTemplates_Scope_Scope">Scope: </label>
                                         <select id="Config_DocumentTemplates_Scope_Scope" name="Scope">
@@ -178,10 +179,9 @@
                             </div>
                             <script type="text/javascript">
                                 $(function () {
-                                    var dialog;
-
-                                    function showDialog() {
-                                        if (dialog == null) {
+                                    let dialog = null;
+                                    $('#Config_DocumentTemplates_Scope_Button').on('click', function () {
+                                        if (!dialog) {
                                             dialog = $('#Config_DocumentTemplates_Scope_Dialog').dialog({
                                                 width: 400,
                                                 resizable: false,
@@ -189,23 +189,19 @@
                                                 autoOpen: false,
                                                 buttons: {
                                                     'Save Changes': function () {
-                                                        dialog.dialog('option', 'buttons', null);
-                                                        dialog.dialog('disable');
-                                                        $('#Config_DocumentTemplates_Scope_Scope').closest('form').submit();
+                                                        $(this)
+                                                            .dialog('option', 'buttons', null)
+                                                            .find('form').submit();
                                                     },
                                                     'Cancel': function () {
-                                                        dialog.dialog('close');
+                                                        $(this).dialog('close');
                                                     }
                                                 }
                                             });
                                         }
 
                                         dialog.dialog('open');
-
-                                        return false;
-                                    }
-
-                                    $('#Config_DocumentTemplates_Scope_Button').click(showDialog);
+                                    });
                                 });
                             </script>
                         }
@@ -250,6 +246,7 @@
                                     <div id="Config_DocumentTemplates_JobSubTypes_Update_Dialog" class="dialog" title="Job Type Filter">
                                         @using (Html.BeginForm(MVC.API.DocumentTemplate.UpdateJobSubTypes(Model.DocumentTemplate.Id, null, true)))
                                         {
+                                            @Html.AntiForgeryToken()
                                             var selectedTypes = Model.DocumentTemplate.JobSubTypes.Select(jst => jst.JobType).Distinct().ToList();
                                             foreach (var jt in Model.JobTypes)
                                             {
@@ -266,10 +263,9 @@
                                         }
                                     </div>
                                     <script>
-                                        (function () {
-                                            var dialog;
-
-                                            function showDialog() {
+                                        $(function () {
+                                            let dialog = null;
+                                            $('#Config_DocumentTemplates_JobSubTypes_Update').on('click', function () {
                                                 if (!dialog) {
                                                     dialog = $('#Config_DocumentTemplates_JobSubTypes_Update_Dialog').dialog({
                                                         resizable: false,
@@ -278,8 +274,19 @@
                                                         width: 750,
                                                         height: 580,
                                                         buttons: {
-                                                            "Save Changes": saveChanges,
-                                                            Cancel: cancel
+                                                            "Save Changes": function () {
+                                                                var form = dialog.find('form');
+                                                                $('input.jobType:unchecked').each(function () {
+                                                                    $('#SubTypes_' + $(this).val()).find('input').prop('checked', false);
+                                                                });
+                                                                form.trigger('submit');
+                                                                dialog.dialog("option", "buttons", null);
+                                                            },
+                                                            Cancel: function () {
+                                                                dialog.dialog("option", "buttons", null);
+                                                                // refresh Page
+                                                                window.location.reload(true);
+                                                            }
                                                         }
                                                     });
 
@@ -296,36 +303,8 @@
                                                 }
 
                                                 dialog.dialog('open');
-
-                                                return false;
-                                            }
-
-                                            function cancel() {
-                                                dialog.dialog("disable");
-                                                dialog.dialog("option", "buttons", null);
-
-                                                // Refresh Page
-                                                window.location.reload(true);
-                                            }
-
-                                            function saveChanges() {
-                                                var form = dialog.find('form');
-
-                                                $('input.jobType:unchecked').each(function () {
-                                                    $('#SubTypes_' + $(this).val()).find('input').prop('checked', false);
-                                                });
-
-                                                form.submit();
-
-                                                dialog.dialog("disable");
-                                                dialog.dialog("option", "buttons", null);
-                                            }
-
-                                            $(function () {
-                                                $('#Config_DocumentTemplates_JobSubTypes_Update').click(showDialog);
                                             });
-
-                                        })();
+                                        });
                                     </script>
                                 }
                             </div>
@@ -413,6 +392,7 @@
                                         <div>
                                             @using (Html.BeginForm(MVC.API.DocumentTemplate.Template(Model.DocumentTemplate.Id, true, null), FormMethod.Post, new { enctype = "multipart/form-data" }))
                                             {
+                                                @Html.AntiForgeryToken()
                                                 <input type="file" name="Template" id="Config_DocumentTemplates_TemplatePdf_Template" accept=".pdf" style="width: 250px;" />
                                             }
                                         </div>
@@ -737,7 +717,7 @@
                                 @Html.Hidden("ruleId", "")
                             }
                             <a id="DocumentTemplate_OnImportUserFlagRules_AddButton" href="#" class="button small">Add User Flag Rule</a>
-                            <div id="DocumentTemplate_OnImportUserFlagRules_AddDialog" class="hiddenDialog" title="On Import User Flag Rule: @(Model.DocumentTemplate.Id)">
+                            <div id="DocumentTemplate_OnImportUserFlagRules_AddDialog" class="dialog" title="On Import User Flag Rule: @(Model.DocumentTemplate.Id)">
                                 <div class="brief">
                                     @switch (Model.DocumentTemplate.Scope)
                                     {
@@ -758,7 +738,7 @@
                                             break;
                                     }
                                 </div>
-                                @using (Html.BeginForm(MVC.API.DocumentTemplate.AddOnImportUserFlagRule(Model.DocumentTemplate.Id), FormMethod.Post))
+                                @using (Html.BeginForm(MVC.API.DocumentTemplate.AddOnImportUserFlagRule(Model.DocumentTemplate.Id)))
                                 {
                                     @Html.AntiForgeryToken()
                                     <div class="distribute-evenly">
@@ -878,7 +858,7 @@
                                                             rulesTable.find('tbody').append(row);
 
                                                             rulesTable.find('tbody').find('tr').first().addClass('hidden');
-                                                            
+
                                                             dialog.dialog("close");
                                                         })
                                                         .catch(e => {
@@ -997,6 +977,10 @@
             </div>
         </div>
         <div id="dialogConfirmDelete" title="Delete this Document Template?" class="dialog">
+            @using (Html.BeginForm(MVC.API.DocumentTemplate.Delete(Model.DocumentTemplate.Id, true)))
+            {
+                @Html.AntiForgeryToken()
+            }
             <p>
                 <i class="fa fa-exclamation-triangle fa-lg warning"></i>This item will be permanently deleted and cannot be recovered.<br />
                 <em>
@@ -1008,31 +992,28 @@
         </div>
         <script type="text/javascript">
             $(function () {
-                var button = $('#buttonDelete');
-                var buttonDialog = $("#dialogConfirmDelete");
-                var buttonLink = button.attr('href');
-                button.attr('href', '#');
+                const button = $('#buttonDelete');
+                let buttonDialog = null;
                 button.click(function () {
-                    buttonDialog.dialog('open');
-                    return false;
-                });
-                buttonDialog.dialog({
-                    resizable: false,
-                    modal: true,
-                    autoOpen: false,
-                    buttons: {
-                        "Delete": function () {
-                            $this = $(this);
-                            $this.dialog('disable');
-                            $this.dialog("option", "buttons", null);
-                            window.location.href = buttonLink;
-                        },
-                        Cancel: function () {
-                            $(this).dialog("close");
-                        }
+                    if (!buttonDialog) {
+                        buttonDialog = $("#dialogConfirmDelete").dialog({
+                            resizable: false,
+                            modal: true,
+                            autoOpen: false,
+                            buttons: {
+                                "Delete": function () {
+                                    $(this)
+                                        .dialog("option", "buttons", null)
+                                        .find('form').trigger('submit');
+                                },
+                                Cancel: function () {
+                                    $(this).dialog("close");
+                                }
+                            }
+                        });
                     }
+                    buttonDialog.dialog('open');
                 });
-
             });
         </script>
         <div class="actionBar">
@@ -1065,7 +1046,7 @@
                 else
                 {
                     <a id="buttonBulkGenerate" href="#" class="button">Bulk Generate</a>
-                    <div id="dialogBulkGenerate" class="hiddenDialog dialog-bulk-generate" title="Bulk Generate: @(Model.DocumentTemplate.Id)">
+                    <div id="dialogBulkGenerate" class="dialog dialog-bulk-generate" title="Bulk Generate: @(Model.DocumentTemplate.Id)">
                         <div class="brief">
                             @switch (Model.DocumentTemplate.Scope)
                             {
@@ -1101,8 +1082,9 @@
                                     break;
                             }
                         </div>
-                        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerate(Model.DocumentTemplate.Id), FormMethod.Post))
+                        @using (Html.BeginForm(MVC.API.DocumentTemplate.BulkGenerate(Model.DocumentTemplate.Id)))
                         {
+                            @Html.AntiForgeryToken()
                             <div class="field-validation-valid" data-valmsg-replace="true" data-valmsg-for="DataIds"></div>
                             <textarea id="inputBulkGenerateDataIds" name="DataIds" data-val="true" data-val-required="Identifiers are required"></textarea>
                             if (Model.TemplatePageCount > 1 && Model.TemplatePageCount % 2 != 0)
@@ -1127,8 +1109,7 @@
                                         width: 460,
                                         buttons: {
                                             "Bulk Generate": function () {
-                                                dialog.find('form').submit();
-                                                dialog.dialog("disable");
+                                                $(this).find('form').trigger('submit');
                                             },
                                             Close: function () {
                                                 $(this).dialog("close");
@@ -1148,13 +1129,13 @@
             }
             @if (Authorization.Has(Claims.Config.DocumentTemplate.Delete))
             {
-                @Html.ActionLinkButton("Delete", MVC.API.DocumentTemplate.Delete(Model.DocumentTemplate.Id, true), "buttonDelete")
+                <button id="buttonDelete" type="button" class="button">Delete</button>
             }
         </div>
-        @if (!string.IsNullOrWhiteSpace(Model.BulkGenerateDownloadId))
+        @if (Model.BulkGenerateDownloadId.HasValue)
         {
             <div id="Config_DocumentTemplates_Show_DownloadBulk_Dialog" class="dialog" title="Download Bulk Documents">
-                <a href="@Url.Action(MVC.API.DocumentTemplate.BulkGenerateDownload(Model.BulkGenerateDownloadId, Model.BulkGenerateDownloadFilename))" class="button"><i class="fa fa-download fa-lg"></i>Download Bulk Documents</a>
+                <a href="@Url.Action(MVC.API.DocumentTemplate.BulkGenerateDownload(Model.BulkGenerateDownloadId.Value, Model.BulkGenerateDownloadFilename))" class="button"><i class="fa fa-download fa-lg"></i>Download Bulk Documents</a>
             </div>
             <script>
                 $(function () {