From d9041c3f97422fb377c3e8d20129f4ef8517f833 Mon Sep 17 00:00:00 2001
From: "reed%reedloden.com" <>
Date: Mon, 30 Mar 2009 21:02:33 +0000
Subject: Bug 476603 - "[SECURITY] Editing attachments doesn't have any CSRF
 protection" [p=reed r=LpSolit a=LpSolit]

---
 template/en/default/attachment/edit.html.tmpl | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'template/en/default/attachment')

diff --git a/template/en/default/attachment/edit.html.tmpl b/template/en/default/attachment/edit.html.tmpl
index f461e9e91..95c90871f 100644
--- a/template/en/default/attachment/edit.html.tmpl
+++ b/template/en/default/attachment/edit.html.tmpl
@@ -171,6 +171,9 @@
   <input type="hidden" name="action" value="update">
   <input type="hidden" name="contenttypemethod" value="manual">
   <input type="hidden" name="delta_ts" value="[% attachment.modification_time FILTER html %]">
+  [% IF user.id %]
+    <input type="hidden" name="token" value="[% issue_hash_token([attachment.id, attachment.modification_time]) FILTER html %]">
+  [% END %]
 
   <table class="attachment_info" width="100%">
 
-- 
cgit v1.2.3-24-g4f1b