Budget - CSRF + Perms

budget_edit.php

@@ -2,6 +2,8 @@
 
 require_once "inc_all.php";
 
+enforceUserPermission('module_financial', 2);
+
 // Fetch categories
 $query = "SELECT category_id, category_name FROM categories WHERE category_type ='Expense' AND category_archived_at IS NULL";
 $result = mysqli_query($mysqli, $query);
@@ -52,6 +54,8 @@ $grandTotal = 0;
     </form>
     <form id="budgetForm" method="POST" action="post.php">
         <input type="hidden" name="year" value="<?php echo $currentYear; ?>">
+        <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
+
         <table class="table table-bordered table-striped">
             <thead>
             <tr>