From 2db58562f184c9b782aa8d27bcf822917cee0ff9 Mon Sep 17 00:00:00 2001
From: Alex Assistant <alex-assistant@local>
Date: Fri, 20 Feb 2026 14:57:26 +0300
Subject: [PATCH] Fix admin autosave endpoint to explicit admin.php with token

---
 admin.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/admin.php b/admin.php
index fc34de5..2b88375 100644
--- a/admin.php
+++ b/admin.php
@@ -327,7 +327,7 @@ function nextUniqueCodeName(string $base): string
               <td><?php if (!empty($p['before_file_id'])): ?><img class="js-open" data-full="index.php?action=image&file_id=<?= (int)$p['before_file_id'] ?>" src="index.php?action=image&file_id=<?= (int)$p['before_file_id'] ?>" style="cursor:zoom-in;width:100px;height:70px;object-fit:cover;border:1px solid #e5e7eb;border-radius:6px"><?php endif; ?></td>
               <td><?php if (!empty($p['after_file_id'])): ?><img class="js-open" data-full="index.php?action=image&file_id=<?= (int)$p['after_file_id'] ?>" src="index.php?action=image&file_id=<?= (int)$p['after_file_id'] ?>" style="cursor:zoom-in;width:100px;height:70px;object-fit:cover;border:1px solid #e5e7eb;border-radius:6px"><?php endif; ?></td>
               <td>
-                <form class="js-photo-form" method="post" enctype="multipart/form-data" action="?section_id=<?= (int)$activeSectionId ?>&mode=media">
+                <form class="js-photo-form" method="post" enctype="multipart/form-data" action="admin.php?token=<?= urlencode($tokenIncoming) ?>&section_id=<?= (int)$activeSectionId ?>&mode=media">
                   <input type="hidden" name="action" value="photo_update"><input type="hidden" name="ajax" value="1"><input type="hidden" name="token" value="<?= h($tokenIncoming) ?>"><input type="hidden" name="photo_id" value="<?= (int)$p['id'] ?>">
                   <p><input class="in" name="code_name" value="<?= h((string)$p['code_name']) ?>"></p>
                   <p><input class="in" type="number" name="sort_order" value="<?= (int)$p['sort_order'] ?>"></p>