fix view

web/templates/create.html

@@ -263,7 +263,12 @@ console.log('Hello, World!');
                 formData.append('path', uploadPath);
 
                 try {
-                    const resp = await fetch(window.prefix('/upload'), { method: 'POST', body: formData });
+                    const csrf = (document.cookie.match(/(?:^|; )csrf_token=([^;]+)/)||[])[1] ? decodeURIComponent((document.cookie.match(/(?:^|; )csrf_token=([^;]+)/)||[])[1]) : '';
+                    const resp = await fetch(window.prefix('/editor/upload'), {
+                        method: 'POST',
+                        headers: csrf ? { 'X-CSRF-Token': csrf } : {},
+                        body: formData
+                    });
                     const data = await resp.json();
                     if (!resp.ok || !data.success) throw new Error(data.error || 'Upload failed');