pfSense

The services_wol.php page allows a wakeall request to be submitted via GET and via POST, but it should only use POST for consistency and so that it has proper CSRF protection.

There are two sets of buttons on the page which allow the user to take this action, but they unnecessarily use different methods to submit the request. The first button uses GET, the second uses POST but does so with a dedicated bit of JavaScript. Neither method is the current proper approach.

If the link is changed as follows it will use POST and have a confirmation dialog:

<a href="services_wol.php?wakeall=true" role="button" class="btn btn-primary do-confirm" usepost>

The same method can be used for both buttons, the extra JavaScript block can then be removed.