Fix CSRF verification compatibility with plugins

app/Exceptions/Handler.php

@@ -58,7 +58,10 @@ class Handler extends ExceptionHandler
         }
 
         if ($e instanceof TokenMismatchException) {
-            return json(trans('errors.http.csrf-token-mismatch'), 1);
+            if (request()->ajax()) {
+                return json(trans('errors.http.csrf-token-mismatch'), 1);
+            }
+            abort(403, trans('errors.http.csrf-token-mismatch'));
         }
 
         if ($e instanceof PrettyPageException) {

app/Http/Kernel.php

@@ -31,7 +31,6 @@ class Kernel extends HttpKernel
             \Illuminate\View\Middleware\ShareErrorsFromSession::class,
             \App\Http\Middleware\AfterSessionBooted::class,
             \App\Http\Middleware\DetectLanguagePrefer::class,
-            \App\Http\Middleware\VerifyCsrfToken::class,
         ],
 
         'static' => [],
@@ -45,6 +44,7 @@ class Kernel extends HttpKernel
      * @var array
      */
     protected $routeMiddleware = [
+        'csrf'        => \App\Http\Middleware\VerifyCsrfToken::class,
         'auth'        => \App\Http\Middleware\CheckAuthenticated::class,
         'verified'    => \App\Http\Middleware\CheckUserVerified::class,
         'guest'       => \App\Http\Middleware\RedirectIfAuthenticated::class,

app/Http/Middleware/VerifyCsrfToken.php

@@ -12,6 +12,6 @@ class VerifyCsrfToken extends BaseVerifier
      * @var array
      */
     protected $except = [
-        'setup/*'
+        //
     ];
 }

app/Providers/RouteServiceProvider.php

@@ -59,7 +59,7 @@ class RouteServiceProvider extends ServiceProvider
     protected function mapWebRoutes(Router $router)
     {
         $router->group([
-            'middleware' => ['web', CheckSessionUserValid::class],
+            'middleware' => ['web', CheckSessionUserValid::class, 'csrf'],
             'namespace' => $this->namespace,
         ], function ($router) {
             require base_path('routes/web.php');