From 14fcdc6643fa21f14c6f169c391731c523224778 Mon Sep 17 00:00:00 2001
From: Pellaeon Lin <nfsmwlin@gmail.com>
Date: Mon, 31 Aug 2015 16:43:00 +0800
Subject: [PATCH] Update# CSRF check for email field

---
 controller/registercontroller.php | 2 --
 templates/register.php            | 4 +++-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/controller/registercontroller.php b/controller/registercontroller.php
index 6352773..4da0304 100644
--- a/controller/registercontroller.php
+++ b/controller/registercontroller.php
@@ -60,8 +60,6 @@ class RegisterController extends Controller {
 	}
 
 	/**
-	 * @NoAdminRequired
-	 * @NoCSRFRequired
 	 * @PublicPage
 	 */
 	public function validateEmail() {
diff --git a/templates/register.php b/templates/register.php
index 96dfa53..1f97f1b 100644
--- a/templates/register.php
+++ b/templates/register.php
@@ -14,10 +14,11 @@ if ($_['entered']): ?>
 					<li><?php print_unescaped($_['errormsg']); ?></li>
 				</ul>
 				<p class="groupofone">
-				<input type="email" name="email" id="email" placeholder="<?php print_unescaped($l->t('Email')); ?>" value="" required autofocus />
+					<input type="email" name="email" id="email" placeholder="<?php print_unescaped($l->t('Email')); ?>" value="" required autofocus />
 					<label for="email" class="infield"><?php print_unescaped($l->t( 'Email' )); ?></label>
 					<img id="email-icon" class="svg" src="<?php print_unescaped(image_path('', 'actions/mail.svg')); ?>" alt=""/>
 				</p>
+				<input type="hidden" name="requesttoken" value="<?php p($_['requesttoken']); ?>" />
 				<input type="submit" id="submit" value="<?php print_unescaped($l->t('Request verification link')); ?>" />
 			</fieldset>
 		</form>
@@ -40,6 +41,7 @@ if ($_['entered']): ?>
 				<label for="email" class="infield"><?php print_unescaped($l->t('Email')); ?></label>
 				<img id="email-icon" class="svg" src="<?php print_unescaped(image_path('', 'actions/mail.svg')); ?>" alt=""/>
 			</p>
+			<input type="hidden" name="requesttoken" value="<?php p($_['requesttoken']); ?>" />
 			<input type="submit" id="submit" value="<?php print_unescaped($l->t('Request verification link')); ?>" />
 		</fieldset>
 	</form>