From 3e4055c5dcfc827f29383d998828121bcd5254b1 Mon Sep 17 00:00:00 2001
From: "Claude (Chronicler #61)" <claude@firefrostgaming.com>
Date: Sun, 5 Apr 2026 10:25:07 +0000
Subject: [PATCH] fix: Add CSRF token to update-config form

Signed-off-by: Claude (Chronicler #61) <claude@firefrostgaming.com>
---
 services/arbiter-3.0/src/views/admin/scheduler.ejs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/services/arbiter-3.0/src/views/admin/scheduler.ejs b/services/arbiter-3.0/src/views/admin/scheduler.ejs
index 41dddc2..ec9f5bc 100644
--- a/services/arbiter-3.0/src/views/admin/scheduler.ejs
+++ b/services/arbiter-3.0/src/views/admin/scheduler.ejs
@@ -37,6 +37,7 @@
                     </div>
                 </div>
                 <form action="/admin/scheduler/update-config" method="POST" class="flex gap-4 items-end">
+                    <input type="hidden" name="_csrf" value="<%= csrfToken %>">
                     <input type="hidden" name="node" value="<%= config.node %>">
                     <div class="flex-1">
                         <label class="block text-sm text-gray-500 dark:text-gray-400 mb-1">Base Time (UTC)</label>