From f5dd2b9a951a0f068a41ba05550b158b76eff6de Mon Sep 17 00:00:00 2001
From: Diocrafts <pozo.dionisio@gmail.com>
Date: Sat, 7 Mar 2026 19:24:10 +0100
Subject: [PATCH] fix: add CSRF header to video thumbnail PUT requests

The double-submit CSRF middleware blocks all mutating requests
without the X-CSRF-Token header. photos.js was uploading video
thumbnails via PUT without it, causing a flood of 403 errors.

- Add getCsrfHeaders() spread to the fetch headers
- Add credentials: 'same-origin' to ensure cookie is sent
---
 static/js/features/library/photos.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/static/js/features/library/photos.js b/static/js/features/library/photos.js
index c2fe63ea..f8e4fa03 100755
--- a/static/js/features/library/photos.js
+++ b/static/js/features/library/photos.js
@@ -282,12 +282,13 @@ const photosView = {
                 // Upload to server for permanent caching
                 const token = localStorage.getItem('token')
                     || sessionStorage.getItem('token');
-                const headers = { 'Content-Type': blob.type };
+                const headers = { 'Content-Type': blob.type, ...getCsrfHeaders() };
                 if (token) headers['Authorization'] = `Bearer ${token}`;
 
                 fetch(`/api/files/${fileId}/thumbnail/preview`, {
                     method: 'PUT',
                     headers,
+                    credentials: 'same-origin',
                     body: blob,
                 }).then((resp) => {
                     if (resp.ok) {