g

views/admin.html

@@ -117,18 +117,20 @@
       status.style.color = 'var(--accent)';
 
       try {
+        const csrfToken = window.f0ckSession?.csrf_token || '{{ csrf_token }}';
         const res = await fetch('/admin/settings', {
           method: 'POST',
           headers: {
             'X-Requested-With': 'XMLHttpRequest',
-            'Content-Type': 'application/x-www-form-urlencoded'
+            'Content-Type': 'application/x-www-form-urlencoded',
+            'X-CSRF-Token': csrfToken
           },
           body: new URLSearchParams({
             manual_approval: approvalToggle.checked ? 'on' : 'off',
             ...(registrationToggle ? { registration_open: registrationToggle.checked ? 'on' : 'off' } : {}),
             min_tags: minTagsInput.value,
             trusted_uploads: trustedUploadsInput.value,
-            csrf_token: '{{ csrf_token }}'
+            csrf_token: csrfToken
           }).toString()
         });