diff options
| author | Michael Foster <savetheinternet@tinyboard.org> | 2013-09-23 16:48:56 +1000 |
|---|---|---|
| committer | Michael Foster <savetheinternet@tinyboard.org> | 2013-09-23 16:48:56 +1000 |
| commit | c8062fbf767100a46e32a81ed34d8d8eaf5c45e7 (patch) | |
| tree | 6f0507630491207006aab332d907e84eb169d723 /templates/mod/news.html | |
| parent | 00f4da3b82afda892906578ec1bd3c766fe0cd45 (diff) | |
CSRF more mod pages
Diffstat (limited to 'templates/mod/news.html')
| -rw-r--r-- | templates/mod/news.html | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/templates/mod/news.html b/templates/mod/news.html index b0335e0a..510d60ce 100644 --- a/templates/mod/news.html +++ b/templates/mod/news.html @@ -2,6 +2,7 @@ <fieldset> <legend>{% trans 'New post' %}</legend> <form style="margin:0" action="" method="post"> + <input type="hidden" name="token" value="{{ token }}"> <table> <tr> <th> @@ -39,7 +40,7 @@ <div class="ban"> {% if mod|hasPermission(config.mod.news_delete) %} <span style="float:right;padding:2px"> - <a class="unimportant" href="?/news/delete/{{ post.id }}">[{% trans 'delete' %}]</a> + <a class="unimportant" href="?/news/delete/{{ post.id }}/{{ post.delete_token }}">[{% trans 'delete' %}]</a> </span> {% endif %} <h2 id="{{ post.id }}"> |