fix(schedule): add csrf

src/Handler/Schedule.hs

@@ -39,8 +39,8 @@ postScheduleR = do
       ScheduleOffsetNone -> ScheduleOffsetNone
       offset             -> currentScheduleOffset `addOffset` offset
 
-    scheduleOptionsForm :: MForm (HandlerFor UniWorX) (FormResult ScheduleOptions, Widget)
-    scheduleOptionsForm = do
+    scheduleOptionsForm :: Html -> MForm (HandlerFor UniWorX) (FormResult ScheduleOptions, Widget)
+    scheduleOptionsForm csrf = do
       (viewRess, viewWidgets) <- fmap unzip . for (universeF :: [ScheduleView]) $ \sView ->
         mreq (buttonField sView) ("" { fsName  = Just $ toPathPiece GetScheduleView
                                      , fsAttrs = if sView == currentScheduleView then [("disabled","")] else mempty
@@ -87,7 +87,7 @@ postScheduleR = do
       
       return (scheduleResult, optionsWidget)
 
-  ((optionsRes, optionsWidget), optionsEnctype) <- runFormGet $ const scheduleOptionsForm
+  ((optionsRes, optionsWidget), optionsEnctype) <- runFormGet scheduleOptionsForm
 
   let
     schedule = case optionsRes of

templates/schedule/options.hamlet

@@ -1,5 +1,7 @@
 $newline never
 
+#{csrf}
+
 $forall vWgt <- viewWidgets
   ^{fvWidget vWgt}