Fix: add CSRF token to AJAX post requests

[Simrayz]

Scope and purpose

Fixes bugs identified in #3396.

When enabling CSRF protection in the django middleware, javascript requests also have to send a csrf token. This PR adds instances identified from testing #3396. However, #3444 is left untouched as I'm not able to load the relevant Portadmin pages without crashes9.

• Closes Netmap view changes cannot be saved when CSRF protection is turned on #3437
• Closes (Un)ignoring unrecognized neighbors in Unrecognized Neighbors tools fails when CSRF protection is turned on #3438
• Closes Some dashboard widget operations fail when CSRF protection is turned on #3439
• Closes Bulk alert actions in Status tool fail when CSRF protection is turned on #3441
• Closes PortAdmin cannot save changes when CSRF protection is enabled #3444

Contributor Checklist

• Added a changelog fragment for towncrier
• Added/amended tests for new/changed code
• Added/changed documentation
• Linted/formatted the code with ruff, easiest by using pre-commit
• The first line of the commit message continues the sentence "If applied, this commit will ...", starts with a capital letter, does not end with punctuation and is 50 characters or less long. See https://cbea.ms/git-commit/
• This pull request is based on the correct upstream branch: For a patch/bugfix affecting the latest stable version, it should be based on that version's branch (<major>.<minor>.x). For a new feature or other additions, it should be based on master.
• If applicable: Created new issues if this PR does not fix the issue completely/there is further work to be done
• If this results in changes in the UI: Added screenshots of the before and after
• If this adds a new Python source code file: Added the boilerplate header to that file

[github-actions]

Test results

    27 files      27 suites   44m 56s ⏱️
 2 517 tests  2 517 ✅ 0 💤 0 ❌
18 526 runs  18 526 ✅ 0 💤 0 ❌

Results for commit 4ba8002.

♻️ This comment has been updated with latest results.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.09%. Comparing base (d590f08) to head (4ba8002).
⚠️ Report is 14 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3465      +/-   ##
==========================================
+ Coverage   62.08%   62.09%   +0.01%     
==========================================
  Files         611      611              
  Lines       44865    44865              
  Branches       43       43              
==========================================
+ Hits        27856    27861       +5     
+ Misses      16999    16994       -5     
  Partials       10       10              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[lunkwill42]

Nice solutions over all 👍

However:

1. There are a bunch of needless whitespace changes to HTML templates and JS files here, that make the diff really hard to read. I'm fine with intentional whitespace changes, but they should be made as separate commits.

2. Removing dashboard navlets doesn't actually stick - reloading the dashboard makes them reappear. It seems this inadvertently changes the URL that the delete button posts to...

3. The last commit purports to just add a news fragment/changelog entry, but also makes some unspecified changes to JS files, this should be cleaned up

[lunkwill42]

However, #3444 is left untouched as I'm not able to load the relevant Portadmin pages without crashes9.

I'd be interested in knowing what the crashes you experience look like.

Also, PortAdmin is the reason why I was working on documenting how to properly enable IPv6 in the devcontainer (a work I haven't really completed). Our lab is currently down, and the only switches I have available for testing PortAdmin on are the ones in our Teknobyen offices (testing on production equipment, yikes!). These are all managed over IPv6, so I can't test on them from the devcontainer unless it can properly communicate over IPv6; I also need to be on the office technical VLAN to access them, so I can't do it from home (not even sure VPN will work). We might want to look at this together when we're both in the office.

[johannaengland]

Mostly some questions. Do you have any reference to how you fixed this? So that I can try understanding this better and if something like this comes up again in the future

[johannaengland]

1. I still sometimes get a 403 response when trying to update the netmap view, specifically to the endpoint /netmap/views/5/nodepositions/update/
2. When trying to delete a widget from my dashboard I get a 400 response from the endpoint /navlets/remove-user-navlet/ (all other dashboard things work)
3. In the status tool the bulk actions "Acknowledge" and "Clear" also return a 403 error
4. Please separate reformatting and changes into different commits, that makes reviewing much easier (in that case a rebase is allowed)
5. If we want to add POST requests to the frontend in the future: Add documentation to https://nav.readthedocs.io/en/latest/hacking/javascript.html on how to get the CSRF token
6. Commit messages: If including issue/PR numbers, please add them to the second line

[Simrayz]

@johannaengland I have rebased the PR and done the following changes:

• Removed unrelated formatting from commits
• Changed commit messages to include issue number on a second line

I added documentation to Javascript hacking about how to include CSRF tokens in the template, and how to access them for usage in AJAX requests.

In addition I have fixed the 400 bug in remove-user-navlet, apparently the django view expects form data and not JSON.

However, I was not able to reproduce the 403 errors you reported. Are you logged in with a user that does not have all required permissions? I usually test with an admin user, or a new user with minimal permissions. I tried creating a new user (not part of any groups except the defaults), and it was able to Acknowledge alerts.

[Simrayz]

@johannaengland I've fixed the bug in Unrecognized Neighbors (refresh of page, causing no status message to display), and added a fix for #3444 as well.

[johannaengland]

Functionality is great, now just nitpicking about docs

[johannaengland]

Just a tiny typo fix

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud