Fix CSRF token drift in add_comment and update_ticket endpoints

2026-07-14 23:19:26 -04:00
parent 622cae8bbd
commit 7a537f46bc
2 changed files with 18 additions and 3 deletions
@@ -48,9 +48,14 @@ try {
        if (!CsrfMiddleware::validateToken($csrfToken)) {
            http_response_code(403);
            header('Content-Type: application/json');
-            echo json_encode(['success' => false, 'error' => 'Invalid CSRF token']);
+            echo json_encode([
+                'success' => false, 
+                'error' => 'Invalid CSRF token',
+                'csrf_token' => CsrfMiddleware::getToken()
+            ]);
            exit;
        }
+        $GLOBALS['newCsrfToken'] = CsrfMiddleware::rotateToken();
    }

    $currentUser = $_SESSION['user'];
@@ -279,7 +284,8 @@ try {
                'status'     => $updateData['status'],
                'priority'   => $updateData['priority'],
                'updated_at' => date('Y-m-d H:i:s'),
-                'message'    => 'Ticket updated successfully'
+                'message'    => 'Ticket updated successfully',
+                'csrf_token' => $GLOBALS['newCsrfToken'] ?? null
            ];
        }
    }