From b45817ec651c2be21097d1d50a65ae5c7afaccac Mon Sep 17 00:00:00 2001
From: Matt Pass <matt@mattpass.com>
Date: Fri, 18 Apr 2014 18:10:50 +0100
Subject: [PATCH] headers.php included and csrf POST added

---
 lib/file-control.php | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/file-control.php b/lib/file-control.php
index 32186a1..7e7c6f9 100644
--- a/lib/file-control.php
+++ b/lib/file-control.php
@@ -1,4 +1,7 @@
-<?php include("settings.php");?>
+<?php
+include("headers.php");
+include("settings.php");
+?>
 <script>
 <?php
 // Get the save type if any
@@ -423,6 +426,7 @@ if (action=="load") {
 <form name="saveFile" action="file-control.php?action=save&file=<?php if (isset($file)) {echo $file;}; if (isset($_GET['fileMDT']) && $_GET['fileMDT']!="undefined") {echo "&fileMDT=".numClean($_GET['fileMDT']);};?>" method="POST">
 	<textarea name="contents"></textarea>
 	<input type="hidden" name="newFileName" value="">
+	<input type="hidden" name="csrf" value="<?php echo $_SESSION["csrf"]; ?>">
 </form>
 
 <script>