From 06d9cf78be3279a784c88ba4150778a86364d654 Mon Sep 17 00:00:00 2001
From: Alexander Smirnov <fredeom@mail.ru>
Date: Tue, 7 May 2024 13:42:48 +0300
Subject: [PATCH] shipment shipment form csrf

---
 erp24/modul/shipment/functionsShipment.php | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/erp24/modul/shipment/functionsShipment.php b/erp24/modul/shipment/functionsShipment.php
index 681a934..5209502 100644
--- a/erp24/modul/shipment/functionsShipment.php
+++ b/erp24/modul/shipment/functionsShipment.php
@@ -291,14 +291,15 @@ function showOrderStoresPanel(){
 global $db, $related_order_id, $status_order_id, $status_edit_dostup, $orderCityId, $store_orders_status_description, $storesArray, $store_id, $whereInProductsId, $store_orders_statuses, $statuses_stores_show,$whereGuid,$act,$orderId,$group_id;  
 
 
-echo'<form method=post action="/shipment/'.$act.'/?id='.$orderId.'">
-<table><td>Статус:</td><td><span class="tag">'. ($store_orders_statuses[$status_order_id] ?? '') .' </span> </td>';
+echo'<form method=post action="/shipment/'.$act.'/?id='.$orderId.'">';
+echo '<input type="hidden" name="_csrf" value="' . Yii::$app->request->getCsrfToken() . '" />';
+echo '<table><td>Статус:</td><td><span class="tag">'. ($store_orders_statuses[$status_order_id] ?? '') .' </span> </td>';
  
  
 if(!empty($status_edit_dostup[$status_order_id][$group_id])) { 
 echo'<td>можно изменять на</td><td> <select class="form-control" name=status_new>';
 foreach($status_edit_dostup[$status_order_id][$group_id] as $v) {
- echo '<option value="'.$v.'">'.$store_orders_statuses[$v].'</option> ';   
+ echo '<option value="'.$v.'"' . (($_POST["status_new"] ?? 0) == $v ? 'selected' : '') . '>'.$store_orders_statuses[$v].'</option> ';
     
 }
 echo'</select></td><td>
-- 
2.39.5