From e29a598fa51eea8c88020d390f77c3002dddcd4f Mon Sep 17 00:00:00 2001
From: Hannah Wolfe <erisds@gmail.com>
Date: Thu, 17 Oct 2013 20:36:32 +0100
Subject: [PATCH] CSRF for debug screen

---
 core/server/views/debug.hbs | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/core/server/views/debug.hbs b/core/server/views/debug.hbs
index 841e828aeb..83e50e31f0 100644
--- a/core/server/views/debug.hbs
+++ b/core/server/views/debug.hbs
@@ -16,6 +16,7 @@
         </header>
         <section class="content">
             <form id="settings-export">
+                <input type="hidden" name="_csrf" value="{{csrfToken}}" />
                 <fieldset>
                     <div class="form-group">
                         <label>Export</label>
@@ -25,11 +26,12 @@
                 </fieldset>
             </form>
             <form id="settings-import" method="post" action="/ghost/debug/db/import/" enctype="multipart/form-data">
+                <input type="hidden" name="_csrf" value="{{csrfToken}}" />
                 <fieldset>
                     <div class="form-group">
                         <label>Import</label>
-                        <input type="file" class="button-add" name="importfile"></input>
-                        <input type="submit" class="button-save" value="Import"></input>
+                        <input type="file" class="button-add" name="importfile" />
+                        <input type="submit" class="button-save" value="Import" />
                         <p>Import from another Ghost installation. If you import a user, this will replace the current user & log you out.</p>
                     </div>
                 </fieldset>