From 7b1c20410c2bb6beff729b98756e54570ece01af Mon Sep 17 00:00:00 2001
From: twotalesanimation <80506065+twotalesanimation@users.noreply.github.com>
Date: Wed, 3 Dec 2025 13:26:57 +0200
Subject: [PATCH] updated CSRF tokens

---
 account_settings.php | 2 ++
 bush_mechanics.php   | 1 +
 campsite_booking.php | 1 +
 driver_training.php  | 1 +
 forgot_password.php  | 1 +
 login.php            | 2 +-
 register.php         | 2 +-
 trip-details.php     | 1 +
 8 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/account_settings.php b/account_settings.php
index dbda0f2e..aad7da7a 100644
--- a/account_settings.php
+++ b/account_settings.php
@@ -101,6 +101,7 @@ $user = $result->fetch_assoc();
                                     <input type="email" id="email" name="email" class="form-control" value="<?php echo $user['email']; ?>" required>
                                 </div>
                             </div>
+                            <input type="hidden" name="csrf_token" value="<?php echo generateCSRFToken(); ?>">
                             <div class="col-md-12">
                                 <div class="form-group mb-0">
                                     <button type="submit" class="theme-btn style-two" style="width:100%;">Update Info</button>
@@ -113,6 +114,7 @@ $user = $result->fetch_assoc();
 
                     <!-- Change Password Form -->
                     <form id="changePasswordForm" name="changePasswordForm" action="change_password.php" method="post">
+                        <input type="hidden" name="csrf_token" value="<?php echo generateCSRFToken(); ?>">
                         <div class="col-md-12 mt-20">
                             <h4>Change Password</h4>
                             <div id="responseMessage2"></div> <!-- Message display area -->
diff --git a/bush_mechanics.php b/bush_mechanics.php
index b6e3f720..35210eba 100644
--- a/bush_mechanics.php
+++ b/bush_mechanics.php
@@ -169,6 +169,7 @@ if (!empty($bannerImages)) {
                                         <label for="agreeCheckbox" id="agreeLabel" style="color: #888;">I have read and agree to the indemnity terms</label>
                                     </div>
                                 </div>
+                                <input type="hidden" name="csrf_token" value="<?php echo generateCSRFToken(); ?>">
                                 <?php
                                 $button_text = "Book Now";
                                 $button_disabled = "";
diff --git a/campsite_booking.php b/campsite_booking.php
index 58ef72b6..4eaf9b7f 100644
--- a/campsite_booking.php
+++ b/campsite_booking.php
@@ -123,6 +123,7 @@ checkUserSession();
                         <?php endif ?>
 
                         <h6>Total: <span id="booking_total" class="price">-</span></h6>
+                        <input type="hidden" name="csrf_token" value="<?php echo generateCSRFToken(); ?>">
                         <button type="submit" class="theme-btn style-two w-100 mt-15 mb-5">
                             <span data-hover="Book Now">Book Now</span>
                             <i class="fal fa-arrow-right"></i>
diff --git a/driver_training.php b/driver_training.php
index b5180d47..4a0f415a 100644
--- a/driver_training.php
+++ b/driver_training.php
@@ -175,6 +175,7 @@ if (!empty($bannerImages)) {
                                         <label for="agreeCheckbox" id="agreeLabel" style="color: #888;">I have read and agree to the indemnity terms</label>
                                     </div>
                                 </div>
+                                <input type="hidden" name="csrf_token" value="<?php echo generateCSRFToken(); ?>">
                                 <?php
                                 $button_text = "Book Now";
                                 $button_disabled = "";
diff --git a/forgot_password.php b/forgot_password.php
index 2a3960c9..ee9051da 100644
--- a/forgot_password.php
+++ b/forgot_password.php
@@ -32,6 +32,7 @@
                                 </div>
                             </div>
                         </div>
+                        <input type="hidden" name="csrf_token" value="<?php echo generateCSRFToken(); ?>">
                         <div class="col-md-12">
                             <div class="form-group mb-0">
                                 <button type="submit" class="theme-btn style-two" style="width:100%;">Send Link</button>
diff --git a/login.php b/login.php
index 314e731e..aaeb2973 100644
--- a/login.php
+++ b/login.php
@@ -80,7 +80,7 @@ $login_url = $client->createAuthUrl();
 
                         <div class="col-md-12">
                             <div class="form-group mb-0">
-                                
+                                <input type="hidden" name="csrf_token" value="<?php echo generateCSRFToken(); ?>">
                                 <button type="submit" class="theme-btn style-two" style="width:100%;">Log In</button>
                             </div>
                         </div>
diff --git a/register.php b/register.php
index 8f883a88..c03e26b8 100644
--- a/register.php
+++ b/register.php
@@ -83,7 +83,7 @@
                             </div>
                             <div class="col-md-12">
                                 <div class="form-group mb-0">
-
+                                    <input type="hidden" name="csrf_token" value="<?php echo generateCSRFToken(); ?>">
                                     <button type="submit" class="theme-btn style-two" style="width:100%;">Register</button>
                                     <div id="msgSubmit" class="hidden"></div>
                                 </div>
diff --git a/trip-details.php b/trip-details.php
index 7e4c5e6d..6a03cec8 100644
--- a/trip-details.php
+++ b/trip-details.php
@@ -543,6 +543,7 @@ $conn->close();
                                     </div>
                                 </div>
                             <h6>Total: <span id="booking_total" class="price">-</span></h6>
+                            <input type="hidden" name="csrf_token" value="<?php echo generateCSRFToken(); ?>">
                             <?php if ($remaining_places < 1): ?>
                                 <button type="button" class="theme-btn style-two w-100 mt-15 mb-5" disabled>
                                     <span>FULLY BOOKED</span>