Protect topic attribute actions from CSRF

[StudioMaX]

Summary

• keep the original one-click AJAX attribute links and protect them with phpBB link hashes
• require POST and a form key for MCP bulk attribute changes
• add a regression test that verifies a forged GET without a valid hash is ignored

Reproduction

An authorised topic author could change an attribute by visiting viewtopic.php?t=62&attr_id=1; no form key, link hash, or confirmation was required. A page on another origin successfully top-level-navigated an authenticated browser to that URL and changed the topic attribute.

Verification

• PHP and JavaScript syntax checks passed
• a forged GET with an invalid hash left the topic unchanged
• the rendered hashed link retained the original anchor markup and data-ajax callback
• the generated hashed AJAX GET returned the normal QTE JSON response and changed the attribute
• MCP attribute changes remain protected POST submissions

[kaileymsnay]

Thank you for the contribution.

A note on tests - this extension doesn't fully implement functional tests, so the one included in you pull request would never run (see https://github.com/kaileymsnay/qte/blob/master/.github/workflows/tests.yml#L53-L66). This is something I never utilized, but looking to at some point.