Use Grav nonce functionality

classes/controller.php

@@ -86,6 +86,11 @@ class AdminController
      */
     public function execute()
     {
+        if (!Utils::verifyNonce($this->post['admin-nonce'], 'admin-post-blueprints')) {
+            $this->admin->setMessage('Unauthorized', 'error');
+            return false;
+        }
+
         $success = false;
         $method = 'task' . ucfirst($this->task);
         if (method_exists($this, $method)) {

themes/grav/templates/partials/blueprints-new.html.twig

@@ -14,4 +14,7 @@
     <div class="button-bar">
         <button class="button primary">{{ "PLUGIN_ADMIN.CONTINUE"|tu }}</button>
     </div>
+
+    {{ nonce_field('admin-post-blueprints', 'admin-nonce') }}
+
 </form>

themes/grav/templates/partials/blueprints-raw.html.twig

@@ -10,4 +10,7 @@
             </div>
         {% endif %}
     {% endfor %}
+
+    {{ nonce_field('admin-post-blueprints', 'admin-nonce') }}
+
 </form>

themes/grav/templates/partials/blueprints.html.twig

@@ -18,4 +18,6 @@
         {% include 'forms/fields/hidden/hidden.html.twig' %}
     {% endfor %}
     {% endif %}
+
+    {{ nonce_field('admin-post-blueprints', 'admin-nonce') }}
 </form>