From 95530ed5f033393b1662595e9f0634ff7d758a40 Mon Sep 17 00:00:00 2001
From: Yasen Pramatarov <yasen@lindeas.com>
Date: Tue, 15 Apr 2025 18:10:17 +0300
Subject: [PATCH] Adds CSRF to profile edit pages

---
 app/templates/profile-edit.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/app/templates/profile-edit.php b/app/templates/profile-edit.php
index 92cc97b..82fade0 100644
--- a/app/templates/profile-edit.php
+++ b/app/templates/profile-edit.php
@@ -6,6 +6,7 @@
                     <div class="card-body">
 
                         <form method="POST" action="<?= htmlspecialchars($app_root) ?>?page=profile" enctype="multipart/form-data">
+<?php include 'csrf_token.php'; ?>
                             <div class="row">
                                 <p class="border rounded bg-light mb-4"><small>edit the profile fields</small></p>
                                 <div class="col-md-4 avatar-container">
@@ -132,6 +133,7 @@
                                                     <div class="modal-footer">
                                                         <button type="button" class="btn btn-secondary" data-dismiss="modal">Cancel</button>
                                                         <form id="remove-avatar-form" data-action="remove-avatar" method="POST" action="<?= htmlspecialchars($app_root) ?>?page=profile&action=remove&item=avatar">
+<?php include 'csrf_token.php'; ?>
                                                             <button type="button" class="btn btn-danger" id="confirm-delete">Delete Avatar</button>
                                                         </form>
                                                     </div>