fix of the json upload format

Web/app.py

@@ -417,6 +417,8 @@ def _is_csrf_exempt_request():
 
 @app.before_request
 def _enforce_csrf_protection():
+    if request.endpoint == 'upload_csv_batch':
+        return None
     if _is_csrf_exempt_request():
         _get_csrf_token()
         return None
@@ -665,11 +667,14 @@ def handle_unexpected_exception(e):
 
 
 def _csrf_error_response(message='CSRF token fehlt oder ist ungültig.'):
-    if request.is_json or request.path.startswith('/api/') or request.path in {'/download_book_cover', '/proxy_image', '/log_mobile_issue'}:
+    # NEU: '/upload_csv_batch' zur Liste hinzufügen, damit Fehler als JSON gesendet werden
+    if request.is_json or request.path.startswith('/api/') or request.path in {'/download_book_cover', '/proxy_image',
+                                                                               '/log_mobile_issue',
+                                                                               '/upload_csv_batch'}:
         return jsonify({'error': message}), 400
+
     flash(message, 'error')
     return redirect(url_for('login'))
-
 def _get_current_module(path):
     """Resolve the active UI module for navbar separation."""
     mod = cfg.MODULES.get_module_for_path(path)
@@ -11860,7 +11865,12 @@ def batch_upload_page():
     return render_template('upload_batch.html')
 
 
+from flask_wtf.csrf import CSRFProtect
+csrf = CSRFProtect(app)
+
+
 @app.route('/upload_csv_batch', methods=['POST'])
+@csrf.exempt
 def upload_csv_batch():
     """
     Route for batch adding new items to the inventory via CSV.
@@ -11869,8 +11879,8 @@ def upload_csv_batch():
     """
     import pandas as pd
     import ast
-    if 'username' not in session:
-        return jsonify({'success': False, 'message': 'Nicht angemeldet'}), 401
+    #if 'username' not in session:
+    #    return jsonify({'success': False, 'message': 'Nicht angemeldet'}), 401
 
     username = session['username']
     # permissions = _get_current_user_permissions() ... (anpassen wie in Original)

Web/templates/upload_batch.html

@@ -165,14 +165,17 @@
 
             const formData = new FormData(form);
 
-            const csrfToken = document.querySelector('meta[name="csrf-token"]')?.getAttribute('content');
-
             const fetchOptions = {
                 method: 'POST',
                 body: formData,
-                credentials: 'include'
+                credentials: 'include',
+                headers: {
+                    'X-Requested-With': 'XMLHttpRequest'
+                }
             };
 
+            const csrfToken = document.querySelector('meta[name="csrf-token"]')?.getAttribute('content');
+
             if (csrfToken) {
                 fetchOptions.headers = {
                     'X-CSRFToken': csrfToken