Nearly all <FORM> blocks now contain a hidden input

[citadel.git] / webcit / listsub.c

diff --git a/webcit/listsub.c b/webcit/listsub.c
index cadf60b4884c93c5e58df29ae1fd64742fc5f2bf..2000c3c181a7bc18890e8a66bdef9eaab422ba5b 100644 (file)
--- a/webcit/listsub.c
+++ b/webcit/listsub.c
@@ -168,9 +168,9 @@ void do_listsub(void)
         * Any other (invalid) command causes the form to be displayed
         */
        else {
-FORM:          wprintf("<FORM METHOD=\"POST\" action=\"listsub\">\n"
-                       "<TABLE BORDER=0>\n"
-               );
+FORM:          wprintf("<FORM METHOD=\"POST\" action=\"listsub\">\n");
+               wprintf("<input type=\"hidden\" name=\"nonce\" value=\"%ld\">\n", WC->nonce);
+               wprintf("<TABLE BORDER=0>\n");
 
                wprintf("<TR><TD>Name of list</TD><TD>"
                        "<SELECT NAME=\"room\" SIZE=1>\n");