Bjoern Welker
e062a1e836
- Add Flask-WTF dependency for CSRF protection - Initialize CSRFProtect in app.py - Add CSRF tokens to all POST forms in templates - Exempt /order JSON API endpoint (uses API key instead) This protects against Cross-Site Request Forgery attacks on all admin and user management operations. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
48 lines
1.8 KiB
HTML
Executable File
48 lines
1.8 KiB
HTML
Executable File
{% extends "base.html" %}
|
||
{% block content %}
|
||
<div class="card form-card">
|
||
<h2>{{ "Artikel bearbeiten" if item else "Neuen Artikel anlegen" }}</h2>
|
||
<form method="post" enctype="multipart/form-data">
|
||
<input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
|
||
<div class="form-grid">
|
||
<label>
|
||
Artikel
|
||
<input type="text" name="artikel" required value="{{ item.artikel if item else '' }}" />
|
||
</label>
|
||
<label>
|
||
Größe
|
||
<input type="text" name="groesse" required value="{{ item.groesse if item else '' }}" />
|
||
</label>
|
||
<label>
|
||
Preis (EUR)
|
||
<input type="number" name="preis" step="0.01" min="0" value="{{ item.preis if item else 0 }}" />
|
||
</label>
|
||
<label>
|
||
Bild‑URL (optional)
|
||
<input type="text" name="bild_url" placeholder="/images/artikel.jpg" value="{{ item.bild_url if item else '' }}" />
|
||
</label>
|
||
<label>
|
||
Bild hochladen (optional)
|
||
<input type="file" name="bild_file" accept="image/*" />
|
||
</label>
|
||
<label>
|
||
Soll
|
||
<input type="number" name="soll" min="0" value="{{ item.soll if item else 0 }}" />
|
||
</label>
|
||
<label>
|
||
Bestand
|
||
<input type="number" name="gezaehlt" min="0" value="{{ item.gezaehlt if item else 0 }}" />
|
||
</label>
|
||
<label>
|
||
Verkäufe
|
||
<input type="number" name="verkaeufe" min="0" value="{{ item.verkaeufe if item else 0 }}" />
|
||
</label>
|
||
</div>
|
||
<div class="form-actions">
|
||
<button class="btn btn-accent" type="submit">Speichern</button>
|
||
<a class="btn ghost" href="{{ url_for('bp.index') }}">Abbrechen</a>
|
||
</div>
|
||
</form>
|
||
</div>
|
||
{% endblock %}
|