From f6aebd8b66232e122f42a4aa25cc0d4c293f2a0d Mon Sep 17 00:00:00 2001
From: Vladimir Tomashevskiy <mirivlad@gmail.com>
Date: Sun, 8 Feb 2026 15:29:25 +0000
Subject: [PATCH] Fix CSRF token syntax in JavaScript

- Use Twig {{ csrf_token() }} and {{ csrf_hash() }} helpers
- Remove invalid PHP syntax from JS
- Add getCsrfData() helper function
---
 app/Modules/Tasks/Views/tasks/show.twig | 42 ++++++++-----------------
 1 file changed, 13 insertions(+), 29 deletions(-)

diff --git a/app/Modules/Tasks/Views/tasks/show.twig b/app/Modules/Tasks/Views/tasks/show.twig
index 1665163..ef0bf6d 100644
--- a/app/Modules/Tasks/Views/tasks/show.twig
+++ b/app/Modules/Tasks/Views/tasks/show.twig
@@ -227,42 +227,30 @@
 {% block scripts %}
 {{ parent() }}
 <script>
-function updateCsrfToken() {
-    // Обновляем CSRF токен в форме подзадач
-    fetch('/')
-        .then(response => response.text())
-        .then(html => {
-            const parser = new DOMParser();
-            const doc = parser.parseFromString(html, 'text/html');
-            const newToken = doc.querySelector('input[name="<?= csrf_token() ?>"]');
-            const newHash = doc.querySelector('input[name="<?= csrf_hash() ?>"]');
-            
-            if (newToken && newHash) {
-                document.querySelectorAll('.subtask-form input[name="<?= csrf_token() ?>"]').forEach(input => {
-                    input.value = newToken.value;
-                });
-                document.querySelectorAll('.subtask-form input[name="<?= csrf_hash() ?>"]').forEach(input => {
-                    input.value = newHash.value;
-                });
-            }
-        });
+function getCsrfData() {
+    return {
+        token: '{{ csrf_token() }}',
+        hash: '{{ csrf_hash() }}'
+    };
 }
 
 function addSubtask(event, taskId) {
     event.preventDefault();
     const form = event.target;
-    const formData = new FormData(form);
     const input = form.querySelector('input[name="title"]');
     const title = input.value.trim();
 
     if (!title) return;
 
+    const csrf = getCsrfData();
+
     fetch(`/tasks/${taskId}/subtasks`, {
         method: 'POST',
         headers: {
             'X-Requested-With': 'XMLHttpRequest',
+            'Content-Type': 'application/x-www-form-urlencoded',
         },
-        body: formData
+        body: `title=${encodeURIComponent(title)}&${csrf.token}=${csrf.hash}`
     })
     .then(response => response.json())
     .then(data => {
@@ -311,9 +299,7 @@ function updateSubtasksCount() {
 }
 
 function toggleSubtask(taskId, subtaskId) {
-    // Получаем актуальный CSRF токен из формы
-    const csrfToken = document.querySelector('input[name="<?= csrf_token() ?>"]').value;
-    const csrfHash = document.querySelector('input[name="<?= csrf_hash() ?>"]').value;
+    const csrf = getCsrfData();
 
     fetch(`/tasks/${taskId}/subtasks/${subtaskId}/toggle`, {
         method: 'POST',
@@ -321,7 +307,7 @@ function toggleSubtask(taskId, subtaskId) {
             'X-Requested-With': 'XMLHttpRequest',
             'Content-Type': 'application/x-www-form-urlencoded',
         },
-        body: `<?= csrf_token() ?>=${csrfToken}&<?= csrf_hash() ?>=${csrfHash}`
+        body: `${csrf.token}=${csrf.hash}`
     })
     .then(response => response.json())
     .then(data => {
@@ -342,9 +328,7 @@ function toggleSubtask(taskId, subtaskId) {
 function deleteSubtask(taskId, subtaskId) {
     if (!confirm('Удалить подзадачу?')) return;
 
-    // Получаем актуальный CSRF токен из формы
-    const csrfToken = document.querySelector('input[name="<?= csrf_token() ?>"]').value;
-    const csrfHash = document.querySelector('input[name="<?= csrf_hash() ?>"]').value;
+    const csrf = getCsrfData();
 
     fetch(`/tasks/${taskId}/subtasks/${subtaskId}/delete`, {
         method: 'POST',
@@ -352,7 +336,7 @@ function deleteSubtask(taskId, subtaskId) {
             'X-Requested-With': 'XMLHttpRequest',
             'Content-Type': 'application/x-www-form-urlencoded',
         },
-        body: `<?= csrf_token() ?>=${csrfToken}&<?= csrf_hash() ?>=${csrfHash}`
+        body: `${csrf.token}=${csrf.hash}`
     })
     .then(response => response.json())
     .then(data => {