Update team visibility and refresh premium UI styling

api/news.php

@@ -8,6 +8,11 @@ require_once 'config.php';
 $method = $_SERVER['REQUEST_METHOD'];
 $id = $_GET['id'] ?? null;
 
+// CSRF protection for write operations
+if ($method !== 'GET') {
+    requireSameOriginRequest();
+}
+
 switch ($method) {
     case 'GET':
         if ($id) {

api/pages.php

@@ -11,6 +11,11 @@ $method = $_SERVER['REQUEST_METHOD'];
 $id = $_GET['id'] ?? null;
 $type = $_GET['type'] ?? null; // 'global' for global sections
 
+// CSRF protection for write operations
+if ($method !== 'GET') {
+    requireSameOriginRequest();
+}
+
 switch ($method) {
     case 'GET':
         if ($type === 'global') {

api/portfolio.php

@@ -8,6 +8,11 @@ require_once 'config.php';
 $method = $_SERVER['REQUEST_METHOD'];
 $id = $_GET['id'] ?? null;
 
+// CSRF protection for write operations
+if ($method !== 'GET') {
+    requireSameOriginRequest();
+}
+
 switch ($method) {
     case 'GET':
         if ($id) {

api/services.php

@@ -8,6 +8,11 @@ require_once 'config.php';
 $method = $_SERVER['REQUEST_METHOD'];
 $id = $_GET['id'] ?? null;
 
+// CSRF protection for write operations
+if ($method !== 'GET') {
+    requireSameOriginRequest();
+}
+
 switch ($method) {
     case 'GET':
         if ($id) {

api/team.php

@@ -8,6 +8,11 @@ require_once 'config.php';
 $method = $_SERVER['REQUEST_METHOD'];
 $id = $_GET['id'] ?? null;
 
+// CSRF protection for write operations
+if ($method !== 'GET') {
+    requireSameOriginRequest();
+}
+
 switch ($method) {
     case 'GET':
         if ($id) {

api/testimonials.php

@@ -8,6 +8,11 @@ require_once 'config.php';
 $method = $_SERVER['REQUEST_METHOD'];
 $id = $_GET['id'] ?? null;
 
+// CSRF protection for write operations
+if ($method !== 'GET') {
+    requireSameOriginRequest();
+}
+
 switch ($method) {
     case 'GET':
         if ($id) {