From c1278f967e90352506900d243888cd3ac9caee9f Mon Sep 17 00:00:00 2001
From: Jo-Philipp Wich <jow@openwrt.org>
Date: Wed, 21 Oct 2015 00:09:55 +0200
Subject: luci-app-splash: protect admin status call with csrf token

Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
---
 applications/luci-app-splash/luasrc/view/admin_status/splash.htm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'applications/luci-app-splash/luasrc/view/admin_status')

diff --git a/applications/luci-app-splash/luasrc/view/admin_status/splash.htm b/applications/luci-app-splash/luasrc/view/admin_status/splash.htm
index 23982d449c..3415c205d5 100644
--- a/applications/luci-app-splash/luasrc/view/admin_status/splash.htm
+++ b/applications/luci-app-splash/luasrc/view/admin_status/splash.htm
@@ -214,7 +214,7 @@ end
 	<fieldset id="cbi-table-table" class="cbi-section">
 		<legend><%:Active Clients%></legend>
 		<div class="cbi-section-node">
-			<% if is_admin then %><form action="<%=REQUEST_URI%>" method="post"><% end %>
+			<% if is_admin then %><form action="<%=REQUEST_URI%>" method="post"><input type="hidden" name="token" value="<%=token%>" /><% end %>
 			<table class="cbi-section-table">
 				<thead>
 					<tr class="cbi-section-table-titles">
-- 
cgit v1.2.3