<ul><li>HomePageManager/js/custom_js.php: Changed var CSRFTOKEN inside if-block to window.CSRFTOKEN assignment — var declarations are hoisted before the typeof check runs, causing SyntaxError when const CSRFTOKEN already declared in update_widgets.php on the same page</li><li>platform/components/toolbar.php line 385: $_REQUEST[action] bare access inside webmod block — changed to $_REQUEST[action] ?? empty string to eliminate Undefined array key warning</li></ul>