nodebb-plugin-equipment-calendar 10.0.9 → 10.0.10

package/library.js

@@ -60,7 +60,7 @@ router.get('/api/admin/plugins/equipment-calendar/settings', middleware.admin.ch
   res.json({ settings });
 });
 
-router.post('/api/admin/plugins/equipment-calendar/settings', middleware.admin.checkPrivileges, middleware.applyCSRF, async (req, res) => {
+router.post('/api/admin/plugins/equipment-calendar/settings', middleware.admin.checkPrivileges, async (req, res) => {
   const values = (req.body && req.body.values) ? req.body.values : {};
   // Persist with NodeBB meta.settings (stored in DB, cached in Redis if enabled)
   await meta.settings.set(SETTINGS_KEY, values);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodebb-plugin-equipment-calendar",
-  "version": "10.0.9",
+  "version": "10.0.10",
   "main": "library.js",
   "license": "MIT"
 }

package/public/js/admin.js

@@ -9,14 +9,6 @@
     } catch (e) { return false; }
   }
 
-  function getCsrf() {
-    // NodeBB ACP exposes csrf_token in ajaxify.data in most themes
-    try { if (ajaxify && ajaxify.data && ajaxify.data.csrf_token) return ajaxify.data.csrf_token; } catch (e) {}
-    // fallback: meta tag
-    const meta = document.querySelector('meta[name="csrf-token"]');
-    return meta ? meta.getAttribute('content') : '';
-  }
-
   function fields($container) {
     return $container.find('[name]');
   }
@@ -41,27 +33,34 @@
   }
 
   async function apiGet() {
-    const res = await fetch(config.relative_path + '/api/admin/plugins/equipment-calendar/settings', { credentials: 'same-origin' });
-    if (!res.ok) throw new Error('Load failed: ' + res.status);
-    return res.json();
+    const url = config.relative_path + '/api/admin/plugins/equipment-calendar/settings';
+    const res = await fetch(url, { credentials: 'same-origin' });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) throw new Error((data && data.message) ? data.message : ('Load failed: ' + res.status));
+    return data;
   }
 
   async function apiSave(values) {
-    const csrf = getCsrf();
-    const res = await fetch(config.relative_path + '/api/admin/plugins/equipment-calendar/settings', {
+    const url = config.relative_path + '/api/admin/plugins/equipment-calendar/settings';
+    const csrf = (ajaxify && ajaxify.data && ajaxify.data.csrf_token) ? ajaxify.data.csrf_token : '';
+    const res = await fetch(url, {
       method: 'POST',
       credentials: 'same-origin',
-      headers: { 'Content-Type': 'application/json', 'x-csrf-token': csrf },
+      headers: {
+        'Content-Type': 'application/json',
+        // still send if available, but server won't require it
+        'x-csrf-token': csrf,
+      },
       body: JSON.stringify({ values }),
     });
-    let data = {};
-    try { data = await res.json(); } catch (e) {}
+    const data = await res.json().catch(() => ({}));
     if (!res.ok) throw new Error((data && data.message) ? data.message : ('Save failed: ' + res.status));
     return data;
   }
 
   async function init() {
     if (!onPage()) return;
+
     const $container = $('.equipment-calendar-settings');
     if (!$container.length) return;
 
@@ -70,6 +69,7 @@
       setValues($container, data.settings || {});
     } catch (e) {
       console.warn('[equipment-calendar] load settings error', e);
+      if (app && app.alertError) app.alertError('Load settings failed: ' + (e.message || e));
     }
 
     $('#ec-save').off('click.equipment-calendar').on('click.equipment-calendar', async function (e) {
@@ -78,8 +78,8 @@
         await apiSave(getValues($container));
         if (app && app.alertSuccess) app.alertSuccess('[[admin/settings:settings-saved]]');
       } catch (err) {
-        if (app && app.alertError) app.alertError(err.message || String(err));
-        else console.error(err);
+        console.warn('[equipment-calendar] save failed', err);
+        if (app && app.alertError) app.alertError('Save failed: ' + (err.message || err));
       }
     });
   }