From 85a920b49acbcdb20ec03d73e77fc84f30048166 Mon Sep 17 00:00:00 2001
From: Vladimir Tomashevskiy <mirivlad@gmail.com>
Date: Sun, 8 Feb 2026 15:20:36 +0000
Subject: [PATCH] Fix CSRF token validation for consecutive AJAX requests

- Add CSRF token to all AJAX requests
- Fix addSubtask, toggleSubtask, deleteSubtask to include CSRF
---
 app/Modules/Tasks/Views/tasks/show.twig | 37 +++++++++++++++++++++++--
 1 file changed, 35 insertions(+), 2 deletions(-)

diff --git a/app/Modules/Tasks/Views/tasks/show.twig b/app/Modules/Tasks/Views/tasks/show.twig
index c99970a..1665163 100644
--- a/app/Modules/Tasks/Views/tasks/show.twig
+++ b/app/Modules/Tasks/Views/tasks/show.twig
@@ -227,6 +227,27 @@
 {% block scripts %}
 {{ parent() }}
 <script>
+function updateCsrfToken() {
+    // Обновляем CSRF токен в форме подзадач
+    fetch('/')
+        .then(response => response.text())
+        .then(html => {
+            const parser = new DOMParser();
+            const doc = parser.parseFromString(html, 'text/html');
+            const newToken = doc.querySelector('input[name="<?= csrf_token() ?>"]');
+            const newHash = doc.querySelector('input[name="<?= csrf_hash() ?>"]');
+            
+            if (newToken && newHash) {
+                document.querySelectorAll('.subtask-form input[name="<?= csrf_token() ?>"]').forEach(input => {
+                    input.value = newToken.value;
+                });
+                document.querySelectorAll('.subtask-form input[name="<?= csrf_hash() ?>"]').forEach(input => {
+                    input.value = newHash.value;
+                });
+            }
+        });
+}
+
 function addSubtask(event, taskId) {
     event.preventDefault();
     const form = event.target;
@@ -290,11 +311,17 @@ function updateSubtasksCount() {
 }
 
 function toggleSubtask(taskId, subtaskId) {
+    // Получаем актуальный CSRF токен из формы
+    const csrfToken = document.querySelector('input[name="<?= csrf_token() ?>"]').value;
+    const csrfHash = document.querySelector('input[name="<?= csrf_hash() ?>"]').value;
+
     fetch(`/tasks/${taskId}/subtasks/${subtaskId}/toggle`, {
         method: 'POST',
         headers: {
             'X-Requested-With': 'XMLHttpRequest',
-        }
+            'Content-Type': 'application/x-www-form-urlencoded',
+        },
+        body: `<?= csrf_token() ?>=${csrfToken}&<?= csrf_hash() ?>=${csrfHash}`
     })
     .then(response => response.json())
     .then(data => {
@@ -315,11 +342,17 @@ function toggleSubtask(taskId, subtaskId) {
 function deleteSubtask(taskId, subtaskId) {
     if (!confirm('Удалить подзадачу?')) return;
 
+    // Получаем актуальный CSRF токен из формы
+    const csrfToken = document.querySelector('input[name="<?= csrf_token() ?>"]').value;
+    const csrfHash = document.querySelector('input[name="<?= csrf_hash() ?>"]').value;
+
     fetch(`/tasks/${taskId}/subtasks/${subtaskId}/delete`, {
         method: 'POST',
         headers: {
             'X-Requested-With': 'XMLHttpRequest',
-        }
+            'Content-Type': 'application/x-www-form-urlencoded',
+        },
+        body: `<?= csrf_token() ?>=${csrfToken}&<?= csrf_hash() ?>=${csrfHash}`
     })
     .then(response => response.json())
     .then(data => {