From daf4865c290c58b66f73507a0ae1ec41987ad840 Mon Sep 17 00:00:00 2001
From: Alex Tselegidis <alextselegidis@gmail.com>
Date: Wed, 27 May 2015 23:32:26 +0200
Subject: [PATCH] CSRF protection for cancel appointment use case

---
 src/application/views/appointments/book.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/application/views/appointments/book.php b/src/application/views/appointments/book.php
index ca719f58..0223c7db 100644
--- a/src/application/views/appointments/book.php
+++ b/src/application/views/appointments/book.php
@@ -137,6 +137,7 @@
                                     <form id="cancel-appointment-form" method="post"
                                             action="' . $this->config->item('base_url') 
                                             . '/index.php/appointments/cancel/' . $appointment_data['hash'] . '">
+                                        <input type="hidden" name="csrfToken" value="' . $this->security->get_csrf_hash() . '" />
                                         <textarea name="cancel_reason" style="display:none"></textarea>
                                         <button id="cancel-appointment" class="btn btn-inverse">' .
                                                 $this->lang->line('cancel') . '</button>