From b8d0d6d16a29074eeee8e184579e04bb6cb4d59f Mon Sep 17 00:00:00 2001
From: Markus Graf <info@markusgraf.ch>
Date: Thu, 16 Oct 2025 15:30:45 +0200
Subject: [PATCH] Fix CSRF token missing in submission and login forms
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add CSRF token hidden input fields to:
- Submission form (submission/form.html)
- Login form (auth/login.html)

Also fix broken link in login page that referenced submission.form
without required product_slug parameter. Changed to link to index page.

Bug found during manual testing when submitting feedback resulted in
"Bad Request - The CSRF token is missing" error.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 app/templates/auth/login.html      | 4 +++-
 app/templates/submission/form.html | 2 ++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/app/templates/auth/login.html b/app/templates/auth/login.html
index ef52a3f..f7ad333 100644
--- a/app/templates/auth/login.html
+++ b/app/templates/auth/login.html
@@ -6,6 +6,8 @@
 <h1>Login</h1>
 
 <form method="POST">
+    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+
     <div class="form-group">
         <label for="username">Username</label>
         <input type="text" id="username" name="username" required autofocus>
@@ -20,6 +22,6 @@
 </form>
 
 <p style="margin-top: 20px;">
-    <a href="{{ url_for('submission.form') }}">Return to feedback submission</a>
+    <a href="{{ url_for('index') }}">Return to home page</a>
 </p>
 {% endblock %}
diff --git a/app/templates/submission/form.html b/app/templates/submission/form.html
index c425426..c600bcc 100644
--- a/app/templates/submission/form.html
+++ b/app/templates/submission/form.html
@@ -9,6 +9,8 @@
 <p>We value your feedback. Please share your thoughts, report issues, or suggest improvements below.</p>
 
 <form method="POST" enctype="multipart/form-data">
+    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
+
     <div class="form-group">
         <label for="feedback_text">Your Feedback</label>
         <textarea id="feedback_text" name="feedback_text"