diff --git a/static/js/app.js b/static/js/app.js index ffff318..fd9d993 100644 --- a/static/js/app.js +++ b/static/js/app.js @@ -198,10 +198,12 @@ function getCsrfToken() { } /* ── Auto-inject CSRF token into every static POST form ─────── */ -document.addEventListener('DOMContentLoaded', () => { +/* Called immediately — app.js is at the end of so all */ +/* forms are already in the DOM when this executes. */ +(function injectCsrf() { const token = getCsrfToken(); if (!token) return; - document.querySelectorAll('form').forEach(form => { + document.querySelectorAll('form').forEach(function(form) { if ((form.getAttribute('method') || '').toLowerCase() !== 'post') return; if (form.querySelector('input[name="csrf_token"]')) return; const input = document.createElement('input'); @@ -210,7 +212,7 @@ document.addEventListener('DOMContentLoaded', () => { input.value = token; form.appendChild(input); }); -}); +}()); /* ── Generic fetch-based form submit (JSON response) ───────── */ async function submitJson(url, data, method = 'POST') { diff --git a/templates/login.html b/templates/login.html index 859364c..9fcae15 100644 --- a/templates/login.html +++ b/templates/login.html @@ -20,6 +20,7 @@ {% endif %}
+