From 1fc928eed07c02310bb1c4ba8ea63abd8aed40fa Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 19 Jun 2026 08:05:17 +0000
Subject: [PATCH] fix(Mastercontainer): remove CSRF-unprotected GET
 /api/docker/getwatchtower endpoint

The GET /api/docker/getwatchtower route triggered a state-changing action
(starting the watchtower container) without CSRF protection. This endpoint
is removed since the POST /api/docker/watchtower route already exists and
is properly protected by the CSRF Guard middleware.

Assisted-by: GitHub Copilot:claude-sonnet-4-6
---
 php/public/index.php                              | 1 -
 php/src/Docker/DockerHubManager.php               | 2 +-
 php/src/Docker/GitHubContainerRegistryManager.php | 2 +-
 3 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/php/public/index.php b/php/public/index.php
index 182ef889..601382b9 100644
--- a/php/public/index.php
+++ b/php/public/index.php
@@ -94,7 +94,6 @@ $app->add(new \AIO\Middleware\AuthMiddleware($container->get(\AIO\Auth\AuthManag
 
 // API
 $app->post('/api/docker/watchtower', AIO\Controller\DockerController::class . ':StartWatchtowerContainer');
-$app->get('/api/docker/getwatchtower', AIO\Controller\DockerController::class . ':StartWatchtowerContainer');
 $app->post('/api/docker/start', AIO\Controller\DockerController::class . ':StartContainer');
 $app->post('/api/docker/backup', AIO\Controller\DockerController::class . ':StartBackupContainerBackup');
 $app->post('/api/docker/backup-check', AIO\Controller\DockerController::class . ':StartBackupContainerCheck');
diff --git a/php/src/Docker/DockerHubManager.php b/php/src/Docker/DockerHubManager.php
index a7d35ed7..1f65beab 100644
--- a/php/src/Docker/DockerHubManager.php
+++ b/php/src/Docker/DockerHubManager.php
@@ -31,7 +31,7 @@ readonly class DockerHubManager {
             return $cachedVersion;
         }
 
-        // If one of the links below should ever become outdated, we can still upgrade the mastercontainer via the webinterface manually by opening '/api/docker/getwatchtower'
+        // If one of the links below should ever become outdated, we can still upgrade the mastercontainer via the webinterface manually by posting to '/api/docker/watchtower'
         $name = $this->normalizeImageName($name);
 
         try {
diff --git a/php/src/Docker/GitHubContainerRegistryManager.php b/php/src/Docker/GitHubContainerRegistryManager.php
index cc92f944..6a5e4261 100644
--- a/php/src/Docker/GitHubContainerRegistryManager.php
+++ b/php/src/Docker/GitHubContainerRegistryManager.php
@@ -23,7 +23,7 @@ readonly class GitHubContainerRegistryManager
             return $cachedVersion;
         }
 
-        // If one of the links below should ever become outdated, we can still upgrade the mastercontainer via the webinterface manually by opening '/api/docker/getwatchtower'
+        // If one of the links below should ever become outdated, we can still upgrade the mastercontainer via the webinterface manually by posting to '/api/docker/watchtower'
 
         try {
             $authTokenRequest = $this->guzzleClient->request(