Merge pull request #14753 from owncloud/verify-csrf-token-earlier

Verify CSRF token already in update.php and not the EventSource code

core/ajax/update.php

@@ -2,6 +2,8 @@
 set_time_limit(0);
 require_once '../../lib/base.php';
 
+\OCP\JSON::callCheck();
+
 if (OC::checkUpgrade(false)) {
 	// if a user is currently logged in, their session must be ignored to
 	// avoid side effects