silverstripe / silverstripe-asset-admin

        // CSRF check

        $token = SecurityToken::inst();

        if (empty($vars[$token->getName()]) || !$token->check($vars[$token->getName()])) {

            return new SS_HTTPResponse(null, 400);

        }

        if (!isset($vars['ids']) || !$vars['ids']) {

            return (new SS_HTTPResponse(json_encode(['status' => 'error']), 400))

        // CSRF check

        $token = SecurityToken::inst();

        if (empty($data[$token->getName()]) || !$token->check($data[$token->getName()])) {

            return new SS_HTTPResponse(null, 400);

        }

        // check canAddChildren permissions

        if (!empty($data['ParentID']) && is_numeric($data['ParentID'])) {

        // CSRF check

        $token = SecurityToken::inst();

        if (empty($data[$token->getName()]) || !$token->check($data[$token->getName()])) {

            return new SS_HTTPResponse(null, 400);

        }

        // check addchildren permissions

        if (!empty($data['ParentID']) && is_numeric($data['ParentID'])) {