Missing locale

might have wiped it with earlier commits..
Check token validity on $_POST

I omitted the first check last time. I thought the verify token is
async since the page was buffered only at footer, but that was not the
case.

Since the open form was executed after the $_POST execution (in most
admin scripts, except Infusion) the fusion-null declaration was delayed
and did not protect the $_POST execution. It was a step too late.

To fix this, we must load verify token @ maincore here where defender
sniff_token (current commit fix is done at this level where 1st verify
token initiated with 0 post time so not to affect the sessions at all.)

// note 2: after sniff token is off, we shut down notice immediately

if (isset($_POST[‘button_name’])) {
// protection by FUSION_NULL if sniff_token() discovered something bad.
}

// verify token will run here one more time and validate again.
echo openform();