From 50c46c4d3a697ef0af80576f6e336c4b92e86398 Mon Sep 17 00:00:00 2001
From: Teymour Aldridge <teymour@reasoning.page>
Date: Thu, 19 Dec 2024 21:20:32 +0100
Subject: [PATCH] Add missing csrf token to "set breaking" button.

---
 tabbycat/templates/ajax/AjaxMixin.vue         | 20 +++----------------
 tabbycat/templates/ajax/CookieMixin.vue       | 20 +++++++++++++++++++
 .../tables/CheckboxTablesContainer.vue        |  7 ++++++-
 3 files changed, 29 insertions(+), 18 deletions(-)
 create mode 100644 tabbycat/templates/ajax/CookieMixin.vue

diff --git a/tabbycat/templates/ajax/AjaxMixin.vue b/tabbycat/templates/ajax/AjaxMixin.vue
index 5bb471ef2e5..c2d32a2c24e 100644
--- a/tabbycat/templates/ajax/AjaxMixin.vue
+++ b/tabbycat/templates/ajax/AjaxMixin.vue
@@ -1,8 +1,9 @@
 <script>
 import ModalErrorMixin from '../errors/ModalErrorMixin.vue'
+import CookieMixin from './CookieMixin.vue'
 
 export default {
-  mixins: [ModalErrorMixin],
+  mixins: [ModalErrorMixin, CookieMixin],
   methods: {
     ajaxSave: function (
       url, payload, message, completeFunction, failFunction,
@@ -10,22 +11,7 @@ export default {
     ) {
       const self = this
       const dataPayload = JSON.stringify(payload)
-      function getCookie (name) {
-        let cookieValue = null
-        if (document.cookie && document.cookie !== '') {
-          const cookies = document.cookie.split(';')
-          for (let i = 0; i < cookies.length; i++) {
-            const cookie = cookies[i].trim()
-            // Does this cookie string begin with the name we want?
-            if (cookie.substring(0, name.length + 1) === (name + '=')) {
-              cookieValue = decodeURIComponent(cookie.substring(name.length + 1))
-              break
-            }
-          }
-        }
-        return cookieValue
-      }
-      const csrftoken = getCookie('csrftoken')
+      const csrftoken = this.getCookie('csrftoken')
       $.ajax({
         type: 'POST',
         url: url,
diff --git a/tabbycat/templates/ajax/CookieMixin.vue b/tabbycat/templates/ajax/CookieMixin.vue
new file mode 100644
index 00000000000..fad60967853
--- /dev/null
+++ b/tabbycat/templates/ajax/CookieMixin.vue
@@ -0,0 +1,20 @@
+<script>
+export default {
+  methods: {
+    getCookie: function (name) {
+      let cookieValue = null
+      if (document.cookie && document.cookie !== '') {
+        const cookies = document.cookie.split(';')
+        for (let i = 0; i < cookies.length; i++) {
+          const cookie = cookies[i].trim()
+          // Does this cookie string begin with the name we want?
+          if (cookie.substring(0, name.length + 1) === (name + '=')) {
+            cookieValue = decodeURIComponent(cookie.substring(name.length + 1))
+          }
+        }
+      }
+      return cookieValue
+    },
+  },
+}
+</script>
diff --git a/tabbycat/templates/tables/CheckboxTablesContainer.vue b/tabbycat/templates/tables/CheckboxTablesContainer.vue
index 8edb72a8793..e299101be62 100644
--- a/tabbycat/templates/tables/CheckboxTablesContainer.vue
+++ b/tabbycat/templates/tables/CheckboxTablesContainer.vue
@@ -28,6 +28,7 @@
           <form v-if="roundInfo.break === 'True' && roundInfo.model === 'participants.Adjudicator'"
                 :action="urls.breakingAdjs" method="post">
             <button class="btn btn-primary" type="submit">
+              <input type="hidden" name="csrfmiddlewaretoken" :value="csrftoken">
               <i data-feather="star"></i> {{ gettext("Set Breaking") }}
             </button>
           </form>
@@ -77,9 +78,10 @@ import _ from 'lodash'
 import AutoSaveCounter from '../../templates/allocations/AutoSaveCounter.vue'
 import TablesContainer from './TablesContainer.vue'
 import AjaxMixin from '../ajax/AjaxMixin.vue'
+import CookieMixin from '../ajax/CookieMixin.vue'
 
 export default {
-  mixins: [AjaxMixin],
+  mixins: [AjaxMixin, CookieMixin],
   components: { AutoSaveCounter, TablesContainer },
   props: {
     tablesData: Array,
@@ -111,6 +113,9 @@ export default {
       })
       return checked
     },
+    csrftoken: function () {
+      return this.getCookie('csrftoken')
+    },
   },
   methods: {
     saveChecks: function (type) {