From ad1e3aef99b806d7f4a5bd18aa0c8cc6102f62e6 Mon Sep 17 00:00:00 2001
From: David Lawrence <dlawrence@mozilla.com>
Date: Mon, 24 Jan 2011 14:35:31 -0500
Subject: Bug 621105 - [SECURITY] Voting lacks CSRF protection
 r=mkanat,a=LpSolit

---
 extensions/Voting/template/en/default/voting/delete-all.html.tmpl | 1 +
 1 file changed, 1 insertion(+)

(limited to 'extensions/Voting/template/en/default/voting/delete-all.html.tmpl')

diff --git a/extensions/Voting/template/en/default/voting/delete-all.html.tmpl b/extensions/Voting/template/en/default/voting/delete-all.html.tmpl
index 82ddc3596..f0d3b7e13 100644
--- a/extensions/Voting/template/en/default/voting/delete-all.html.tmpl
+++ b/extensions/Voting/template/en/default/voting/delete-all.html.tmpl
@@ -35,6 +35,7 @@
 
 <form action="page.cgi?id=voting/user.html" method="post">
     <input type="hidden" name="action" value="vote">
+    <input type="hidden" name="token" value="[% issue_hash_token(['vote']) FILTER html %]">
   <p>
     <input type="radio" name="delete_all_votes" value="1">
     Yes, delete all my votes
-- 
cgit v1.2.3-24-g4f1b