05/24 Fix bugs

templates/bid_tracker.html

@@ -299,6 +299,7 @@ function renderDetail(data) {
     ? '<button class="btn btn-secondary btn-sm" onclick="openEditModal(' + b.id + ')">✎ Edit</button>'
     + '<form method="post" action="/bids/' + b.id + '/delete" style="display:inline"'
     + ' onsubmit="return confirm(\'Delete \\\'' + esc(b.title) + '\\\'?\')">'
+    + '<input type="hidden" name="csrf_token" value="' + getCsrfToken() + '">'
     + '<button class="btn btn-danger btn-sm" type="submit">✕ Delete</button></form>'
     : '';
 
@@ -352,7 +353,7 @@ function postUpdate(bidId) {
   var fd = new FormData();
   fd.append('content', content);
 
-  fetch('/bids/' + bidId + '/updates/json', { method: 'POST', body: fd, credentials: 'same-origin' })
+  fetch('/bids/' + bidId + '/updates/json', { method: 'POST', body: fd, credentials: 'same-origin', headers: {'X-CSRFToken': getCsrfToken()} })
     .then(function(r) { return r.json(); })
     .then(function(d) {
       if (d.error) { alert(d.error); return; }
@@ -371,7 +372,7 @@ function postUpdate(bidId) {
 function deleteUpdate(updateId, bidId) {
   if (!confirm('Delete this update?')) return;
   var fd = new FormData();
-  fetch('/bids/updates/' + updateId + '/delete/json', { method: 'POST', body: fd, credentials: 'same-origin' })
+  fetch('/bids/updates/' + updateId + '/delete/json', { method: 'POST', body: fd, credentials: 'same-origin', headers: {'X-CSRFToken': getCsrfToken()} })
     .then(function(r) { return r.json(); })
     .then(function(d) {
       if (d.error) { alert(d.error); return; }