From: Alexander Smirnov <fredeom@mail.ru>
Date: Tue, 7 May 2024 10:42:48 +0000 (+0300)
Subject: shipment shipment form csrf
X-Git-Tag: 1.1~46^2
X-Git-Url: https://gitweb.erp-flowers.ru/?a=commitdiff_plain;h=06d9cf78be3279a784c88ba4150778a86364d654;p=erp24_rep%2Fyii-erp24%2F.git

shipment shipment form csrf
---

diff --git a/erp24/modul/shipment/functionsShipment.php b/erp24/modul/shipment/functionsShipment.php
index 681a9341..52095026 100644
--- a/erp24/modul/shipment/functionsShipment.php
+++ b/erp24/modul/shipment/functionsShipment.php
@@ -291,14 +291,15 @@ function showOrderStoresPanel(){
 global $db, $related_order_id, $status_order_id, $status_edit_dostup, $orderCityId, $store_orders_status_description, $storesArray, $store_id, $whereInProductsId, $store_orders_statuses, $statuses_stores_show,$whereGuid,$act,$orderId,$group_id;  
 
 
-echo'<form method=post action="/shipment/'.$act.'/?id='.$orderId.'">
-<table><td>Статус:</td><td><span class="tag">'. ($store_orders_statuses[$status_order_id] ?? '') .' </span> </td>';
+echo'<form method=post action="/shipment/'.$act.'/?id='.$orderId.'">';
+echo '<input type="hidden" name="_csrf" value="' . Yii::$app->request->getCsrfToken() . '" />';
+echo '<table><td>Статус:</td><td><span class="tag">'. ($store_orders_statuses[$status_order_id] ?? '') .' </span> </td>';
  
  
 if(!empty($status_edit_dostup[$status_order_id][$group_id])) { 
 echo'<td>можно изменять на</td><td> <select class="form-control" name=status_new>';
 foreach($status_edit_dostup[$status_order_id][$group_id] as $v) {
- echo '<option value="'.$v.'">'.$store_orders_statuses[$v].'</option> ';   
+ echo '<option value="'.$v.'"' . (($_POST["status_new"] ?? 0) == $v ? 'selected' : '') . '>'.$store_orders_statuses[$v].'</option> ';
     
 }
 echo'</select></td><td>