From 445ef6d1481745cd4e7af7e671f534a25d4495dc Mon Sep 17 00:00:00 2001
From: Frédéric Guillot <fred@kanboard.net>
Date: Wed, 28 May 2014 15:14:52 -0400
Subject: Add CSRF protections

---
 app/Templates/file_remove.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'app/Templates/file_remove.php')

diff --git a/app/Templates/file_remove.php b/app/Templates/file_remove.php
index 1d26c15e..af77591c 100644
--- a/app/Templates/file_remove.php
+++ b/app/Templates/file_remove.php
@@ -8,7 +8,7 @@
     </p>
 
     <div class="form-actions">
-        <a href="?controller=file&amp;action=remove&amp;task_id=<?= $task['id'] ?>&amp;file_id=<?= $file['id'] ?>" class="btn btn-red"><?= t('Yes') ?></a>
+        <a href="?controller=file&amp;action=remove&amp;task_id=<?= $task['id'] ?>&amp;file_id=<?= $file['id'].Helper\param_csrf() ?>" class="btn btn-red"><?= t('Yes') ?></a>
         <?= t('or') ?> <a href="?controller=task&amp;action=show&amp;task_id=<?= $task['id'] ?>"><?= t('cancel') ?></a>
     </div>
 </div>
\ No newline at end of file
-- 
cgit v1.2.3