From e024d52915d80dda084704ba16bd656fef0ae79e Mon Sep 17 00:00:00 2001
From: NguyenND <ngodanguyen@gmail.com>
Date: Sat, 21 Feb 2026 12:40:53 -0500
Subject: [PATCH] Phase 3: fix csrf issue

---
 app/__init__.py                        | 5 +++++
 app/templates/inspections/execute.html | 1 -
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/app/__init__.py b/app/__init__.py
index 3957ddd..ee8222e 100644
--- a/app/__init__.py
+++ b/app/__init__.py
@@ -25,6 +25,11 @@ def create_app(config_name='default'):
     login_manager.login_message      = 'Please log in to access this page.'
     login_manager.login_message_category = 'info'
 
+    # Register csrf_token() as an app-wide Jinja2 global so templates that
+    # render manual forms (no WTForms object) can still inject the CSRF token.
+    from flask_wtf.csrf import generate_csrf
+    app.jinja_env.globals['csrf_token'] = generate_csrf
+
     os.makedirs(app.config['UPLOAD_FOLDER'], exist_ok=True)
 
     from app.routes import auth, dashboard, inspections, templates, reports, facilities
diff --git a/app/templates/inspections/execute.html b/app/templates/inspections/execute.html
index 64abef6..5625d39 100644
--- a/app/templates/inspections/execute.html
+++ b/app/templates/inspections/execute.html
@@ -13,7 +13,6 @@
 {% endblock %}
 {% block content %}
 <form method="post" enctype="multipart/form-data" id="inspectionForm">
-  {{ csrf_token() | safe }}
   <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
 
   {# Sticky toolbar #}