完善采购审批流程、企业微信通知和采购专用章

po_app/templates/suppliers.html

@@ -4,6 +4,7 @@
 <div class="card">
   <h2>新增供应商</h2>
   <form method="post">
+<input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
     <div class="form-grid">
       <div><label>编号</label><input type="text" name="code" placeholder="S003"></div>
       <div><label>名称 *</label><input type="text" name="name" required></div>
@@ -40,6 +41,7 @@
                 data-bank_name="{{ s.bank_name or '' }}"
                 data-bank_account="{{ s.bank_account or '' }}">编辑</button>
         <form method="post" action="{{ url_for('supplier_toggle', sid=s.id) }}" style="display:inline;">
+<input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
           <button class="btn sm {% if s.active %}danger{% endif %}"
                   onclick="return confirm('确定{{ '停用' if s.active else '启用' }}该供应商？')">
             {{ '停用' if s.active else '启用' }}
@@ -47,6 +49,7 @@
         </form>
         {% if user.role == 'admin' %}
         <form method="post" action="{{ url_for('supplier_delete', sid=s.id) }}" style="display:inline;">
+<input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
           <button class="btn sm danger"
                   onclick="return confirm('确定彻底删除该供应商？删除后不可恢复！')">删除</button>
         </form>
@@ -64,6 +67,7 @@
       <span class="modal-close" onclick="document.getElementById('supImpModal').style.display='none'">&times;</span>
     </div>
     <form method="post" action="{{ url_for('supplier_import_excel') }}" enctype="multipart/form-data">
+<input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
       <div class="modal-body">
         <div class="hint">先下载模板按格式填好再导入。<b>名称</b>必填；已存在的按下方方式处理（优先按编号匹配，无编号则按名称）。</div>
         <div class="field">
@@ -97,6 +101,7 @@
       <span class="modal-close" onclick="document.getElementById('editModal').style.display='none'">&times;</span>
     </div>
     <form method="post" action="{{ url_for('suppliers') }}">
+<input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
       <input type="hidden" name="id" id="edit_id">
       <div class="modal-body">
         <div class="form-grid two">