From d8d7899a26efd59d075f0e97e4f50c196120b6ed Mon Sep 17 00:00:00 2001 From: Stephan Kerkman Date: Thu, 28 May 2026 10:32:51 +0200 Subject: [PATCH] fix: ensure CSRF cookie is set on plant_add page load species_search.html has no form/csrf_token tag, so the cookie was never set before the species select form was submitted. Co-Authored-By: Claude Sonnet 4.6 --- plants/views/plants.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/plants/views/plants.py b/plants/views/plants.py index 8a2d0aa..6a04355 100644 --- a/plants/views/plants.py +++ b/plants/views/plants.py @@ -1,5 +1,6 @@ from datetime import date from django.shortcuts import render, get_object_or_404, redirect +from django.views.decorators.csrf import ensure_csrf_cookie from django.views.decorators.http import require_POST from plants.models import Plant, Species, PruningLog from plants.forms import PlantForm, PruningLogForm @@ -58,6 +59,7 @@ def log_pruning(request, pk): }) +@ensure_csrf_cookie def plant_add(request): species_id = request.GET.get('species_id') or request.POST.get('species_id') species = None