Validate application/json on server side

src_assets/common/assets/web/apps.html

@@ -637,9 +637,13 @@
       launchApp(app) {
         if (confirm(this.$t('apps.launch_warning'))) {
           this.actionDisabled = true;
-          fetch("./api/apps/launch?uuid=" + app.uuid, {
+          fetch("./api/apps/launch", {
             credentials: 'include',
+            headers: {
+              'Content-Type': 'application/json'
+            },
             method: 'POST',
+            body: JSON.stringify({ uuid: app.uuid })
           })
           .then(r => r.json())
           .then(r => {
@@ -682,9 +686,13 @@
         );
         if (resp) {
           this.actionDisabled = true;
-          fetch("./api/apps/delete?uuid=" + app.uuid, {
+          fetch("./api/apps/delete", {
             credentials: 'include',
-            method: 'POST'
+            headers: {
+              'Content-Type': 'application/json'
+            },
+            method: 'POST',
+            body: JSON.stringify({ uuid: app.uuid })
           }).then((r) => r.json())
           .then((r) => {
             if (!r.status) {

src_assets/common/assets/web/pin.html

@@ -421,8 +421,13 @@
       requestOTP() {
         if (this.editingHost) return;
 
-        fetch(`./api/otp?passphrase=${this.passphrase}${this.deviceName && `&deviceName=${this.deviceName}` || ''}`, {
-          credentials: 'include'
+        fetch("./api/otp", {
+          credentials: 'include',
+          headers: {
+            'Content-Type': 'application/json'
+          },
+          method: 'POST',
+          body: JSON.stringify({ passphrase: this.passphrase, deviceName: this.deviceName })
         })
         .then(resp => resp.json())
         .then(resp => {