diff options
| author | Frédéric Guillot <fred@kanboard.net> | 2014-05-28 15:14:52 -0400 |
|---|---|---|
| committer | Frédéric Guillot <fred@kanboard.net> | 2014-05-28 15:14:52 -0400 |
| commit | 445ef6d1481745cd4e7af7e671f534a25d4495dc (patch) | |
| tree | 7990903e398d77339587595ef5a07df8464f5a2e /app/Templates/subtask_remove.php | |
| parent | 75ab09e28b22e9a5676ee912482027926e271515 (diff) | |
Add CSRF protections
Diffstat (limited to 'app/Templates/subtask_remove.php')
| -rw-r--r-- | app/Templates/subtask_remove.php | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/app/Templates/subtask_remove.php b/app/Templates/subtask_remove.php index 2862176c..12c99cf1 100644 --- a/app/Templates/subtask_remove.php +++ b/app/Templates/subtask_remove.php @@ -10,7 +10,7 @@ <p><strong><?= Helper\escape($subtask['title']) ?></strong></p> <div class="form-actions"> - <a href="?controller=subtask&action=remove&task_id=<?= $task['id'] ?>&subtask_id=<?= $subtask['id'] ?>" class="btn btn-red"><?= t('Yes') ?></a> + <a href="?controller=subtask&action=remove&task_id=<?= $task['id'] ?>&subtask_id=<?= $subtask['id'].Helper\param_csrf() ?>" class="btn btn-red"><?= t('Yes') ?></a> <?= t('or') ?> <a href="?controller=task&action=show&task_id=<?= $task['id'] ?>#subtasks"><?= t('cancel') ?></a> </div> </div>
\ No newline at end of file |