From 77778da0f80ab6d4b196f775c57af4109559df13 Mon Sep 17 00:00:00 2001
From: Reinier Balt <lrbalt@gmail.com>
Date: Thu, 2 Jan 2014 16:45:37 +0100
Subject: [PATCH] fix #1450 by adding CSRF-token to the mobile forms

---
 app/views/todos/show.m.erb | 34 ++++++++++++++++++++--------------
 1 file changed, 20 insertions(+), 14 deletions(-)

diff --git a/app/views/todos/show.m.erb b/app/views/todos/show.m.erb
index 30275735..3a29573d 100644
--- a/app/views/todos/show.m.erb
+++ b/app/views/todos/show.m.erb
@@ -4,36 +4,42 @@
 <h2><Actions><%= t('common.actions') %></h2>
 
 <form method="get" action="<%= edit_todo_path(@todo, :format => :m)%>">
-<button><%=t('todos.edit_action')%></button>
-<input type="hidden" name="_method" value="put" />
+	<button><%=t('todos.edit_action')%></button>
+	<input type="hidden" name="_method" value="put" />
 </form>
 
 <form method="post" action="<%=toggle_star_todo_path(@todo, :format=>:m)%>">
-<button><%=t('todos.star_action')%></button>
-<input type="hidden" name="_method" value="put" />
+	<button><%=t('todos.star_action')%></button>
+	<input type="hidden" name="_method" value="put" />
+	<%= token_tag %>
 </form>
 
 <form method="post" action="<%=toggle_check_todo_path(@todo, :format=>:m)%>">
-<button><%= t('todos.mark_complete')%></button>
-<input type="hidden" name="_method" value="put" />
+	<button><%= t('todos.mark_complete')%></button>
+	<input type="hidden" name="_method" value="put" />
+	<%= token_tag %>
 </form>
 
 <form method="post" action="<%=defer_todo_path(@todo, :format=>:m, :days => 1)%>">
-<button><%=t('todos.defer_x_days', :count => 1)%></button>
-<input type="hidden" name="_method" value="put" />
+	<button><%=t('todos.defer_x_days', :count => 1)%></button>
+	<input type="hidden" name="_method" value="put" />
+	<%= token_tag %>
 </form>
 
 <form method="post" action="<%=defer_todo_path(@todo, :format=>:m, :days => 2)%>">
-<button><%=t('todos.defer_x_days', :count => 2)%></button>
-<input type="hidden" name="_method" value="put" />
+	<button><%=t('todos.defer_x_days', :count => 2)%></button>
+	<input type="hidden" name="_method" value="put" />
+	<%= token_tag %>
 </form>
 
 <form method="post" action="<%=defer_todo_path(@todo, :format=>:m, :days => 3)%>">
-<button><%=t('todos.defer_x_days', :count => 3)%></button>
-<input type="hidden" name="_method" value="put" />
+	<button><%=t('todos.defer_x_days', :count => 3)%></button>
+	<input type="hidden" name="_method" value="put" />
+	<%= token_tag %>
 </form>
 
 <form method="post" action="<%=defer_todo_path(@todo, :format=>:m, :days => 7)%>">
-<button><%=t('todos.defer_x_days', :count => 7)%></button>
-<input type="hidden" name="_method" value="put" />
+	<button><%=t('todos.defer_x_days', :count => 7)%></button>
+	<input type="hidden" name="_method" value="put" />
+	<%= token_tag %>
 </form>