shipment shipment form csrf

diff --git a/erp24/modul/shipment/functionsShipment.php b/erp24/modul/shipment/functionsShipment.php
index 681a934112224511e01430c94cf03ea48eeb3ad2..520950268e4b33ee09662618cf9db61283ae3d87 100644 (file)
--- a/erp24/modul/shipment/functionsShipment.php
+++ b/erp24/modul/shipment/functionsShipment.php
@@ -291,14 +291,15 @@ function showOrderStoresPanel(){
 global $db, $related_order_id, $status_order_id, $status_edit_dostup, $orderCityId, $store_orders_status_description, $storesArray, $store_id, $whereInProductsId, $store_orders_statuses, $statuses_stores_show,$whereGuid,$act,$orderId,$group_id;  
 
 
-echo'<form method=post action="/shipment/'.$act.'/?id='.$orderId.'">
-<table><td>Статус:</td><td><span class="tag">'. ($store_orders_statuses[$status_order_id] ?? '') .' </span> </td>';
+echo'<form method=post action="/shipment/'.$act.'/?id='.$orderId.'">';
+echo '<input type="hidden" name="_csrf" value="' . Yii::$app->request->getCsrfToken() . '" />';
+echo '<table><td>Статус:</td><td><span class="tag">'. ($store_orders_statuses[$status_order_id] ?? '') .' </span> </td>';
  
  
 if(!empty($status_edit_dostup[$status_order_id][$group_id])) { 
 echo'<td>можно изменять на</td><td> <select class="form-control" name=status_new>';
 foreach($status_edit_dostup[$status_order_id][$group_id] as $v) {
- echo '<option value="'.$v.'">'.$store_orders_statuses[$v].'</option> ';   
+ echo '<option value="'.$v.'"' . (($_POST["status_new"] ?? 0) == $v ? 'selected' : '') . '>'.$store_orders_statuses[$v].'</option> ';
     
 }
 echo'</select></td><td>