From 527e82fcac9bbdc002c516e4375a5ac6ad4b6be3 Mon Sep 17 00:00:00 2001
From: vgreb <vgreb@users.noreply.github.com>
Date: Mon, 27 Jul 2026 19:06:00 +0200
Subject: [PATCH] On en stoke/restaure plus le token CSRF dans le localStorage

---
 htdocs/js/tickets.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/htdocs/js/tickets.js b/htdocs/js/tickets.js
index 9ed06e84a..9e041f2a1 100644
--- a/htdocs/js/tickets.js
+++ b/htdocs/js/tickets.js
@@ -526,6 +526,9 @@ $(document).ready(function() {
                 if (storedTickets !== null) {
                     const tickets = JSON.parse(storedTickets);
                     for (const field in tickets) {
+                        // Ne jamais restaurer le token CSRF : sinon on écrase celui,
+                        // valide, généré par le serveur pour la session en cours.
+                        if (field.endsWith('[_token]')) continue;
                         const value = tickets[field];
                         if (value !== '') {
                             $(`input[type!=radio][name="${field}"],select[name="${field}"],textarea[name="${field}"]`).val(value);
@@ -631,6 +634,8 @@ $(document).ready(function() {
                 const data = {};
 
                 for (const [key, value] of formData.entries()) {
+                    // Ne jamais persister le token CSRF en localStorage.
+                    if (key.endsWith('[_token]')) continue;
                     data[key] = value;
                 }