Bjoern Welker
e062a1e836
- Add Flask-WTF dependency for CSRF protection - Initialize CSRFProtect in app.py - Add CSRF tokens to all POST forms in templates - Exempt /order JSON API endpoint (uses API key instead) This protects against Cross-Site Request Forgery attacks on all admin and user management operations. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
25 lines
909 B
HTML
Executable File
25 lines
909 B
HTML
Executable File
{% extends "base.html" %}
|
|
{% block content %}
|
|
<div class="card form-card">
|
|
<h2>Ausbuchen: {{ item.artikel }} ({{ item.groesse }})</h2>
|
|
<div class="note">Aktueller Bestand: <strong>{{ item.gezaehlt }}</strong></div>
|
|
<form method="post" onsubmit="return confirm('Wirklich ausbuchen?');">
|
|
<input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
|
|
<div class="form-grid">
|
|
<label>
|
|
Menge
|
|
<input type="number" name="menge" min="1" required />
|
|
</label>
|
|
<label>
|
|
Grund (optional)
|
|
<input type="text" name="grund" placeholder="z. B. Verkauf, Defekt, Muster" />
|
|
</label>
|
|
</div>
|
|
<div class="form-actions">
|
|
<button class="btn btn-accent" type="submit">Ausbuchen</button>
|
|
<a class="btn ghost" href="{{ url_for('bp.index') }}">Abbrechen</a>
|
|
</div>
|
|
</form>
|
|
</div>
|
|
{% endblock %}
|