From 445ef6d1481745cd4e7af7e671f534a25d4495dc Mon Sep 17 00:00:00 2001
From: Frédéric Guillot <fred@kanboard.net>
Date: Wed, 28 May 2014 15:14:52 -0400
Subject: Add CSRF protections

---
 app/Templates/subtask_remove.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'app/Templates/subtask_remove.php')

diff --git a/app/Templates/subtask_remove.php b/app/Templates/subtask_remove.php
index 2862176c..12c99cf1 100644
--- a/app/Templates/subtask_remove.php
+++ b/app/Templates/subtask_remove.php
@@ -10,7 +10,7 @@
     <p><strong><?= Helper\escape($subtask['title']) ?></strong></p>
 
     <div class="form-actions">
-        <a href="?controller=subtask&amp;action=remove&amp;task_id=<?= $task['id'] ?>&amp;subtask_id=<?= $subtask['id'] ?>" class="btn btn-red"><?= t('Yes') ?></a>
+        <a href="?controller=subtask&amp;action=remove&amp;task_id=<?= $task['id'] ?>&amp;subtask_id=<?= $subtask['id'].Helper\param_csrf() ?>" class="btn btn-red"><?= t('Yes') ?></a>
         <?= t('or') ?> <a href="?controller=task&amp;action=show&amp;task_id=<?= $task['id'] ?>#subtasks"><?= t('cancel') ?></a>
     </div>
 </div>
\ No newline at end of file
-- 
cgit v1.2.3