Fix for the CRSF Token implementation callability

Web/templates/user_del.html

@@ -85,6 +85,7 @@
                         <td>{{ permission_presets.get(user.permission_preset, {}).get('label', user.permission_preset) }}</td>
                         <td class="actions">
                             <form method="POST" action="{{ url_for('delete_user') }}" class="d-inline">
+                                <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
                                 <input type="hidden" name="username" value="{{ user.username }}">
                                 <button type="submit" class="btn btn-danger btn-sm" onclick="return confirm('Sind Sie sicher, dass Sie den Benutzer {{ user.username }} löschen möchten?')">
                                     Löschen
@@ -127,6 +128,7 @@
                 <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
             </div>
             <form method="POST" action="{{ url_for('admin_update_user_permissions') }}">
+                <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
                 <div class="modal-body permissions-modal-body">
                     <input type="hidden" id="perm-username" name="username">
                     <div class="mb-3">
@@ -183,6 +185,7 @@
                 <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
             </div>
             <form method="POST" action="{{ url_for('admin_update_user_name') }}">
+                <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
                 <div class="modal-body">
                     <input type="hidden" id="edit-username" name="username">
                     <div class="mb-3">
@@ -216,6 +219,7 @@
                 <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
             </div>
             <form method="POST" action="{{ url_for('admin_reset_user_password') }}">
+                <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
                 <div class="modal-body">
                     <input type="hidden" id="reset-username" name="username">
                     <div class="mb-3">
@@ -328,7 +332,6 @@
             if (row.style.display !== 'none') {
                 var cells = row.querySelectorAll('td');
                 if (cells.length > 0) {
-                    // Der Benutzername ist in der ersten Spalte (Index 0)
                     visibleUsernames.push(cells[0].textContent.trim());
                 }
             }
@@ -339,19 +342,26 @@
             return;
         }
 
-        // Dynamisches Formular erstellen, um die gefilterten Daten per POST ans Backend zu senden
+        // Dynamisches Formular erstellen
         var form = document.createElement('form');
         form.method = 'POST';
-        form.action = "{{ url_for('export_users_csv') }}"; // Passe dies ggf. an deinen Endpunktnamen an
+        form.action = "{{ url_for('export_users_csv') }}";
 
+        // 1. CSRF-Token als Wert (ohne Klammern) übergeben
+        var csrfInput = document.createElement('input');
+        csrfInput.type = 'hidden';
+        csrfInput.name = 'csrf_token';
+        csrfInput.value = "{{ csrf_token }}";
+        form.appendChild(csrfInput);
+
+        // 2. Gefilterte Benutzernamen hinzufügen
         var input = document.createElement('input');
         input.type = 'hidden';
         input.name = 'usernames';
         input.value = JSON.stringify(visibleUsernames);
-
         form.appendChild(input);
-        document.body.appendChild(form);
 
+        document.body.appendChild(form);
         form.submit();
 
         // Aufräumen