[object Object]

← back to Rentv

rentv: load /csrf.js on both select-to-live galleries so session-authed admins' Make-live POST attaches the CSRF token (was 403) (TK-10356)

cf11e8c77c0be51f11a5f90aeaa81947561975d4 · 2026-08-07 15:21:34 -0700 · Steve

Files touched

Diff

commit cf11e8c77c0be51f11a5f90aeaa81947561975d4
Author: Steve <steve@designerwallcoverings.com>
Date:   Fri Aug 7 15:21:34 2026 -0700

    rentv: load /csrf.js on both select-to-live galleries so session-authed admins' Make-live POST attaches the CSRF token (was 403) (TK-10356)
---
 public/admin/index.html    | 1 +
 public/versions/index.html | 1 +
 2 files changed, 2 insertions(+)

diff --git a/public/admin/index.html b/public/admin/index.html
index ed847409..d5d1578f 100644
--- a/public/admin/index.html
+++ b/public/admin/index.html
@@ -45,6 +45,7 @@ a{color:inherit;text-decoration:none}.wrap{max-width:1240px;margin:0 auto;paddin
   <div class="vc" data-key="minimal"><div class="tag">Admin</div><h3>Minimal</h3><p>Quiet single-column stat sheet. No chrome, just the numbers.</p><div class="card-foot"><a class="go" href="/admin/minimal">Open →</a><span class="live-badge">LIVE</span><button class="make-live-btn" onclick="makeLive('minimal',this)">Make live</button></div></div>
   <div class="vc" data-key="command"><div class="tag">Admin</div><h3>Command Center</h3><p>Multi-panel grid — every surface (subs, feed, video, market) at once.</p><div class="card-foot"><a class="go" href="/admin/command">Open →</a><span class="live-badge">LIVE</span><button class="make-live-btn" onclick="makeLive('command',this)">Make live</button></div></div>
 </div></div>
+<script src="/csrf.js"></script><!-- attaches X-CSRF-Token to the Make-live POST for session-authed admins (else 403) -->
 <script>
 function setLiveBadge(key) {
   document.querySelectorAll('#gallery .vc').forEach(function(card) {
diff --git a/public/versions/index.html b/public/versions/index.html
index 4201f64d..6ed1ca1e 100644
--- a/public/versions/index.html
+++ b/public/versions/index.html
@@ -92,6 +92,7 @@
   <button class="reset-btn" id="resetBtn" onclick="resetDefault(this)">Reset to default front page</button>
 </div>
 </div>
+<script src="/csrf.js"></script><!-- attaches X-CSRF-Token to the Preview-live/Reset POSTs for session-authed admins (else 403) -->
 <script>
 function setLiveBadge(key) {
   document.querySelectorAll('#gallery .vc').forEach(function(card) {

← d70fac6d Fix consulting slideshow: resolve deliverable at /consulting  ·  back to Rentv  ·  auto-data-snapshot: 2026-08-07T15:23:55 (8 data files) — dat f8c739da →