Move the CSRF initialization into the constructor, I don't see why we

need it also in render().

1 files changed, 1 insertions, 2 deletions

diff --git a/modules/gallery/libraries/MY_Forge.php b/modules/gallery/libraries/MY_Forge.php
index b40d067d..6bdadea3 100644
--- a/modules/gallery/libraries/MY_Forge.php
+++ b/modules/gallery/libraries/MY_Forge.php
@@ -24,14 +24,13 @@ class Forge extends Forge_Core {
    */
   public function __construct($action=null, $title='', $method=null, $attr=array()) {
     parent::__construct($action, $title, $method, $attr);
-    $this->hidden("csrf")->value("");
+    $this->hidden("csrf")->value(access::csrf_token());
   }
 
   /**
    * Use our own template
    */
   public function render($template="form.html", $custom=false) {
-    $this->hidden["csrf"]->value(access::csrf_token());
     return parent::render($template, $custom);
   }