csrf-correction

test_tube_scanner/scanner/static/scanner/js/replay.js

@@ -171,7 +171,7 @@ class ReplayManager {
         const ok = confirm(`Télécharger le fichier ?\n\n${filename}`);
         if (!ok) return false;
 
-        fetch(this.video_endpoint, {
+        csrfFetch(this.video_endpoint, {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({

test_tube_scanner/scanner/templates/scanner/images.html

@@ -101,7 +101,7 @@
         function download_all_images(sid) {
             const ok = confirm(export_msg +' '+ export_msg_long);
             if (!ok) return false;
- 	        fetch(image_endpoint, {
+ 	        csrfFetch(image_endpoint, {
 	            method: 'POST',
 	            headers: { 'Content-Type': 'application/json' },
 	            body: JSON.stringify({

test_tube_scanner/scanner/templates/scanner/replay.html

@@ -86,8 +86,8 @@
 
     function download_all_videos(sid) {
         const ok = confirm(export_msg);
-        if (!ok) return false;    
-        fetch(image_endpoint, {
+        if (!ok) return false;
+        csrfFetch(image_endpoint, {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({

test_tube_scanner/scanner/views.py

@@ -6,7 +6,6 @@ from django.shortcuts import render #, redirect
 from django.http import JsonResponse, FileResponse
 from django.utils.translation import gettext_lazy as _
 from django.views.decorators.http import require_GET, require_POST
-from django.views.decorators.csrf import csrf_exempt
 from django.contrib.auth.decorators import login_required, user_passes_test
 from django.conf import settings
 from django.utils import timezone
@@ -252,7 +251,6 @@ def export_medias(request):
 
 
 @require_POST
-@csrf_exempt
 def download_api(request):
     data = json.loads(request.body.decode() or "{}")
     try:
@@ -314,7 +312,6 @@ def replay_view(request):
 
 
 @require_POST
-@csrf_exempt
 def export_api(request):
     data = json.loads(request.body.decode() or "{}")
     session_id = data.get("sid")