From 1a04bc5ad568791ffffe28c7e27c392be077f7db Mon Sep 17 00:00:00 2001
From: Frans de Jonge <fransdejonge@gmail.com>
Date: Mon, 19 Sep 2016 17:32:49 +0200
Subject: [PATCH] Add CSRF token; references #1253

---
 xExtension-CustomCSS/configure.phtml  | 1 +
 xExtension-ImageProxy/configure.phtml | 1 +
 2 files changed, 2 insertions(+)

diff --git a/xExtension-CustomCSS/configure.phtml b/xExtension-CustomCSS/configure.phtml
index 4091de4..51b8b46 100644
--- a/xExtension-CustomCSS/configure.phtml
+++ b/xExtension-CustomCSS/configure.phtml
@@ -1,4 +1,5 @@
 <form action="<?php echo _url('extension', 'configure', 'e', urlencode($this->getName())); ?>" method="post">
+	<input type="hidden" name="_csrf" value="<?php echo FreshRSS_Auth::csrfToken(); ?>" />
 	<div class="form-group">
 		<label class="group-name" for="css-rules"><?php echo _t('ext.custom_css.write_css'); ?></label>
 		<div class="group-controls">
diff --git a/xExtension-ImageProxy/configure.phtml b/xExtension-ImageProxy/configure.phtml
index e3c39c5..090c455 100644
--- a/xExtension-ImageProxy/configure.phtml
+++ b/xExtension-ImageProxy/configure.phtml
@@ -1,4 +1,5 @@
 <form action="<?php echo _url('extension', 'configure', 'e', urlencode($this->getName())); ?>" method="post">
+	<input type="hidden" name="_csrf" value="<?php echo FreshRSS_Auth::csrfToken(); ?>" />
 	<div class="form-group">
 		<label class="group-name" for="css-rules"><?php echo _t('ext.imageproxy.proxy_url'); ?></label>
 		<div class="group-controls">