diff options
| author | Michael Foster <savetheinternet@tinyboard.org> | 2013-09-23 16:48:56 +1000 |
|---|---|---|
| committer | Michael Foster <savetheinternet@tinyboard.org> | 2013-09-23 16:48:56 +1000 |
| commit | c8062fbf767100a46e32a81ed34d8d8eaf5c45e7 (patch) | |
| tree | 6f0507630491207006aab332d907e84eb169d723 /templates/mod/users.html | |
| parent | 00f4da3b82afda892906578ec1bd3c766fe0cd45 (diff) | |
CSRF more mod pages
Diffstat (limited to 'templates/mod/users.html')
| -rw-r--r-- | templates/mod/users.html | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/templates/mod/users.html b/templates/mod/users.html index b4c666e1..6f42ce2a 100644 --- a/templates/mod/users.html +++ b/templates/mod/users.html @@ -48,10 +48,10 @@ {% endif %} <td> {% if mod|hasPermission(config.mod.promoteusers) and user.type < constant(config.mod.groups[0:-1]|last) %} - <a style="float:left;text-decoration:none" href="?/users/{{ user.id }}/promote" title="{% trans 'Promote' %}">▲</a> + <a style="float:left;text-decoration:none" href="?/users/{{ user.id }}/promote/{{ user.promote_token }}" title="{% trans 'Promote' %}">▲</a> {% endif %} {% if mod|hasPermission(config.mod.promoteusers) and user.type > constant(config.mod.groups|first) %} - <a style="float:left;text-decoration:none" href="?/users/{{ user.id }}/demote" title="{% trans 'Demote' %}"{% if mod.id == user.id %} onclick="return confirm('{% trans 'Are you sure you want to demote yourself?' %}')"{% endif %}>▼</a> + <a style="float:left;text-decoration:none" href="?/users/{{ user.id }}/demote/{{ user.demote_token }}" title="{% trans 'Demote' %}"{% if mod.id == user.id %} onclick="return confirm('{% trans 'Are you sure you want to demote yourself?' %}')"{% endif %}>▼</a> {% endif %} {% if mod|hasPermission(config.mod.modlog) %} <a class="unimportant" style="margin-left:5px;float:right" href="?/log:{{ user.username|e }}">[{% trans 'log' %}]</a> |