by primsi: require _csrf_token for dropzonejs.upload route.

dropzonejs.routing.yml

@@ -4,3 +4,4 @@ dropzonejs.upload:
     _controller: '\Drupal\dropzonejs\Controller\UploadController::handleUploads'
   requirements:
     _permission: 'dropzone upload files'
+    _csrf_token: 'TRUE'

src/Element/DropzoneJs.php

@@ -78,7 +78,7 @@ class DropzoneJs extends FormElement {
    */
   public static function preRenderDropzoneJs($element) {
     $element['#attached']['drupalSettings']['dropzonejs'] = [
-      'upload_path' => base_path() . 'dropzonejs/upload',
+      'upload_path' => \Drupal::url('dropzonejs.upload'),
       'instances' => [
         $element['#id'] => [
           'maxFilesize' => $element['#max_filesize'],