From 839eae81f5129573cacd86ae9cd5a60d0b6c145f Mon Sep 17 00:00:00 2001
From: fomichev <vladimir.fomichev@erp-flowers.ru>
Date: Wed, 22 Apr 2026 11:00:49 +0300
Subject: [PATCH] =?utf8?q?fix:=20=D0=B7=D0=B0=D0=BC=D0=B5=D0=BD=D0=B8?=
 =?utf8?q?=D1=82=D1=8C=20yii.getCsrfToken()=20=D0=BD=D0=B0=20meta[csrf-tok?=
 =?utf8?q?en]=20=D0=B2=D0=BE=20=D0=B2=D1=81=D0=B5=D1=85=20=D0=BC=D0=BE?=
 =?utf8?q?=D0=B4=D1=83=D0=BB=D1=8F=D1=85=20buyer-reference?=
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

yii объект недоступен в контексте внешних JS-файлов. Читаем токен напрямую
из <meta name="csrf-token"> — так же работает во всех браузерах.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 erp24/views/marking/index.php         | 2 +-
 erp24/views/producer/index.php        | 4 ++--
 erp24/web/js/product-mapping/index.js | 7 ++++++-
 erp24/web/js/supplier/index.js        | 7 ++++++-
 4 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/erp24/views/marking/index.php b/erp24/views/marking/index.php
index ee9bbe84..1e438bb3 100644
--- a/erp24/views/marking/index.php
+++ b/erp24/views/marking/index.php
@@ -274,7 +274,7 @@ $js = <<<JS
         \$.ajax({
             url: '{$deleteUrl}?id=' + id,
             type: 'POST',
-            data: {_csrf: yii.getCsrfToken()},
+            data: {_csrf: $('meta[name="csrf-token"]').attr('content')},
             dataType: 'json',
             success: function(resp) {
                 if (resp.success) {
diff --git a/erp24/views/producer/index.php b/erp24/views/producer/index.php
index 1193f566..dfe5d399 100644
--- a/erp24/views/producer/index.php
+++ b/erp24/views/producer/index.php
@@ -283,7 +283,7 @@ $js = <<<JS
         $.ajax({
             url: '{$deleteProducerUrl}?id=' + id,
             type: 'POST',
-            data: {_csrf: yii.getCsrfToken()},
+            data: {_csrf: $('meta[name="csrf-token"]').attr('content')},
             dataType: 'json',
             success: function(resp) {
                 if (resp.success) {
@@ -382,7 +382,7 @@ $js = <<<JS
         $.ajax({
             url: '{$deletePlantationUrl}?id=' + id,
             type: 'POST',
-            data: {_csrf: yii.getCsrfToken()},
+            data: {_csrf: $('meta[name="csrf-token"]').attr('content')},
             dataType: 'json',
             success: function(resp) {
                 if (resp.success) {
diff --git a/erp24/web/js/product-mapping/index.js b/erp24/web/js/product-mapping/index.js
index 3d511aa4..3a53a0c7 100644
--- a/erp24/web/js/product-mapping/index.js
+++ b/erp24/web/js/product-mapping/index.js
@@ -26,6 +26,11 @@
        Helpers
     ─────────────────────────────────────────────── */
 
+    function getCsrf() {
+        var el = document.querySelector('meta[name="csrf-token"]');
+        return el ? el.getAttribute('content') : '';
+    }
+
     function collectFilters() {
         var params = {};
         $('.pm-filter').each(function () {
@@ -262,7 +267,7 @@
             $.ajax({
                 url: state.cfg.urls.delete + '?id=' + id,
                 type: 'POST',
-                data: {_csrf: yii.getCsrfToken()},
+                data: {_csrf: getCsrf()},
                 dataType: 'json',
                 success: function (resp) {
                     if (resp.success) reloadList();
diff --git a/erp24/web/js/supplier/index.js b/erp24/web/js/supplier/index.js
index ff8f6e5d..8a53ba71 100644
--- a/erp24/web/js/supplier/index.js
+++ b/erp24/web/js/supplier/index.js
@@ -17,6 +17,11 @@
     var shouldReload = false;
     var _bsModal = null;
 
+    function getCsrf() {
+        var el = document.querySelector('meta[name="csrf-token"]');
+        return el ? el.getAttribute('content') : '';
+    }
+
     var loaderHtml = '<div class="text-center p-4"><i class="fa fa-spinner fa-spin fa-2x text-secondary"></i></div>';
 
     function getModal() {
@@ -138,7 +143,7 @@
         $.ajax({
             url: urls.delete + '?id=' + id,
             type: 'POST',
-            data: {_csrf: yii.getCsrfToken()},
+            data: {_csrf: getCsrf()},
             dataType: 'json',
             success: function (resp) {
                 console.log('[supplier] деактивация ответ:', resp);
-- 
2.39.5