From 3f29078fb938be66a0eb43bf50819c5f15e6d606 Mon Sep 17 00:00:00 2001
From: Jo-Philipp Wich <jow@openwrt.org>
Date: Wed, 7 Oct 2015 12:24:51 +0200
Subject: luci-base: protect simpleforms with CSRF tokens

Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
---
 modules/luci-base/luasrc/view/cbi/simpleform.htm | 1 +
 1 file changed, 1 insertion(+)

(limited to 'modules/luci-base/luasrc/view')

diff --git a/modules/luci-base/luasrc/view/cbi/simpleform.htm b/modules/luci-base/luasrc/view/cbi/simpleform.htm
index 437a07a8b..78f5c5a54 100644
--- a/modules/luci-base/luasrc/view/cbi/simpleform.htm
+++ b/modules/luci-base/luasrc/view/cbi/simpleform.htm
@@ -2,6 +2,7 @@
 <form method="post" enctype="multipart/form-data" action="<%=REQUEST_URI%>">
 	<div>
 		<script type="text/javascript" src="<%=resource%>/cbi.js"></script>
+		<input type="hidden" name="token" value="<%=token%>" />
 		<input type="hidden" name="cbi.submit" value="1" />
 	</div>
 <% end %>
-- 
cgit v1.2.3