From 721dfc64e95140c48726738770cd22b71ac36702 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Buclin?= <LpSolit@gmail.com>
Date: Sat, 22 Jan 2011 18:15:42 +0100
Subject: Bug 621109: Column changing lacks CSRF protection r=dkl a=mkanat

---
 template/en/default/list/change-columns.html.tmpl | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'template/en/default/list')

diff --git a/template/en/default/list/change-columns.html.tmpl b/template/en/default/list/change-columns.html.tmpl
index 77deb503c..b13055c38 100644
--- a/template/en/default/list/change-columns.html.tmpl
+++ b/template/en/default/list/change-columns.html.tmpl
@@ -121,11 +121,16 @@
     <p>
       <input type="hidden" name="saved_search"
              value="[% saved_search.id FILTER html%]" >
+      <input type="hidden" name="token"
+             value="[% issue_hash_token([saved_search.id, saved_search.name]) FILTER html %]">
       <input type="checkbox" id="save_columns_for_search" checked="checked" 
              name="save_columns_for_search" value="1">
       <label for="save_columns_for_search">Save this column list only 
         for search '[% saved_search.name FILTER html %]'</label>
     </p>
+  [% ELSE %]
+    <input type="hidden" name="token"
+           value="[% issue_hash_token(['default-list']) FILTER html %]">
   [% END %]
 
   <p>
-- 
cgit v1.2.1