fixed CSRF in admin enabled/disable. thanks Nerendra Bhati

2016-05-04 09:11:55 -05:00
parent 735d79c211
commit 4bd002aee9
5 changed files with 14 additions and 9 deletions
@@ -56,7 +56,7 @@
        {{pass}}
          </ul>
        </div>
-        {{=button_enable(URL('enable',args=a), a) if a!='admin' else ''}}
+        {{=button_enable(URL('enable',args=a, hmac_key=session.hmac_key), a) if a!='admin' else ''}}
      </td>
    </tr>
    {{pass}}