04/28 Fixed some security issues

2026-04-28 16:27:39 -04:00
parent d8b57cde77
commit bfc2f58fe2
38 changed files with 4273 additions and 4067 deletions
@@ -447,10 +447,13 @@ class QRManager {

  // AJAX Helper
  async makeRequest(url, options = {}) {
+    // Read the CSRF token injected by Flask into window.qrConfig
+    const csrfToken = (window.qrConfig && window.qrConfig.csrfToken) || '';
    const defaultOptions = {
      headers: {
        'Content-Type': 'application/json',
-        'X-Requested-With': 'XMLHttpRequest'
+        'X-Requested-With': 'XMLHttpRequest',
+        'X-CSRF-Token': csrfToken
      },
      ...options
    };