From 6df487bd931289ffc5f1efc569d6ed4e2132e3f7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=98=D0=B3=D0=BE=D1=80=D1=8C=20=D0=9D=D0=B0=D0=B4=D0=B5?=
 =?UTF-8?q?=D0=B8=D0=BD?= <igor_26reg@mail.ru>
Date: Fri, 28 Nov 2025 07:52:11 +0300
Subject: [PATCH] =?UTF-8?q?Fix:=20=D0=B8=D1=81=D0=BF=D1=80=D0=B0=D0=B2?=
 =?UTF-8?q?=D0=BB=D0=B5=D0=BD=D0=B0=20=D0=BE=D1=88=D0=B8=D0=B1=D0=BA=D0=B0?=
 =?UTF-8?q?=20403=20=D0=BF=D1=80=D0=B8=20=D0=B7=D0=B0=D0=B3=D1=80=D1=83?=
 =?UTF-8?q?=D0=B7=D0=BA=D0=B5=20=D1=84=D0=B0=D0=B9=D0=BB=D0=BE=D0=B2=20?=
 =?UTF-8?q?=D0=B2=20=D1=87=D0=B0=D1=82?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Добавлен декоратор @ensure_csrf_cookie в API view
- Изменён способ получения CSRF токена: теперь берётся из cookie через getCookie()
- Добавлена функция getCookie() в chat_detail.html

Причина ошибки: CSRF токен брался из формы вместо cookie при AJAX запросе
---
 backend/api/v1/communications/views.py        |  2 ++
 .../templates/communications/chat_detail.html | 20 ++++++++++++++++++-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/backend/api/v1/communications/views.py b/backend/api/v1/communications/views.py
index 2a7757d2..13f09a2e 100644
--- a/backend/api/v1/communications/views.py
+++ b/backend/api/v1/communications/views.py
@@ -5,6 +5,7 @@ from django.contrib.auth.decorators import login_required
 from django.db import transaction
 from django.http import JsonResponse
 from django.shortcuts import get_object_or_404
+from django.views.decorators.csrf import ensure_csrf_cookie
 from django.views.decorators.http import require_POST
 
 from communications.models import (
@@ -17,6 +18,7 @@ from communications.models import (
 
 @login_required
 @require_POST
+@ensure_csrf_cookie
 def upload_message_with_attachments(request):
     """Отправка сообщения с вложениями"""
     chat_id = request.POST.get('chat_id')
diff --git a/backend/templates/communications/chat_detail.html b/backend/templates/communications/chat_detail.html
index 04f2f4b7..de1a0acf 100644
--- a/backend/templates/communications/chat_detail.html
+++ b/backend/templates/communications/chat_detail.html
@@ -220,6 +220,22 @@
 </div>
 
 <script>
+// Функция для получения CSRF токена из cookie
+function getCookie(name) {
+  let cookieValue = null;
+  if (document.cookie && document.cookie !== '') {
+    const cookies = document.cookie.split(';');
+    for (let i = 0; i < cookies.length; i++) {
+      const cookie = cookies[i].trim();
+      if (cookie.substring(0, name.length + 1) === (name + '=')) {
+        cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
+        break;
+      }
+    }
+  }
+  return cookieValue;
+}
+
 // Обработка вложений
 document.addEventListener('DOMContentLoaded', function() {
   const attachDocument = document.getElementById('attachDocument');
@@ -343,12 +359,14 @@ document.addEventListener('DOMContentLoaded', function() {
       
       formData.append('chat_id', '{{ chat.id }}');
       
+      const csrftoken = getCookie('csrftoken');
+      
       try {
         const response = await fetch('/api/v1/communications/upload-message/', {
           method: 'POST',
           body: formData,
           headers: {
-            'X-CSRFToken': document.querySelector('[name=csrfmiddlewaretoken]').value
+            'X-CSRFToken': csrftoken
           }
         });