From c288e32ee05257b85530e6173400e3fe6a4839dd Mon Sep 17 00:00:00 2001
From: Eric Lesiuta <elesiuta@gmail.com>
Date: Fri, 8 May 2026 00:34:07 -0400
Subject: [PATCH] Remove CSRF tokens

---
 templates/admin/user/sessions.tmpl             | 2 --
 templates/user/settings/security/sessions.tmpl | 2 --
 2 files changed, 4 deletions(-)

diff --git a/templates/admin/user/sessions.tmpl b/templates/admin/user/sessions.tmpl
index f15a8bf3df..75d3e197c3 100644
--- a/templates/admin/user/sessions.tmpl
+++ b/templates/admin/user/sessions.tmpl
@@ -6,7 +6,6 @@
 		<div class="ui right">
 			{{if gt .ActiveCount 0}}
 			<form class="tw-inline" action="{{AppSubUrl}}/-/admin/users/{{.User.ID}}/sessions/revoke_all" method="post">
-				{{.CsrfTokenHtml}}
 				<button class="ui red tiny button">{{ctx.Locale.Tr "admin.settings.sessions.revoke_all"}}</button>
 			</form>
 			{{end}}
@@ -48,7 +47,6 @@
 					{{if not .LogoutUnix}}
 					<div class="flex-item-trailing">
 						<form action="{{AppSubUrl}}/-/admin/users/{{$.User.ID}}/sessions/revoke" method="post">
-							{{$.CsrfTokenHtml}}
 							<input type="hidden" name="session_id" value="{{.ID}}">
 							<button class="ui red tiny button">{{ctx.Locale.Tr "settings.sessions.revoke"}}</button>
 						</form>
diff --git a/templates/user/settings/security/sessions.tmpl b/templates/user/settings/security/sessions.tmpl
index d4e67f3c2d..8784d9acf4 100644
--- a/templates/user/settings/security/sessions.tmpl
+++ b/templates/user/settings/security/sessions.tmpl
@@ -6,7 +6,6 @@
 	{{if gt .OtherActiveCount 0}}
 	<div class="ui right">
 		<form class="tw-inline" action="{{AppSubUrl}}/user/settings/security/sessions/revoke_all" method="post">
-			{{.CsrfTokenHtml}}
 			<button class="ui red tiny button">{{ctx.Locale.Tr "settings.sessions.revoke_all"}}</button>
 		</form>
 	</div>
@@ -49,7 +48,6 @@
 				{{if and (not .LogoutUnix) (ne .ID $.CurrentSessionID)}}
 				<div class="flex-item-trailing">
 					<form action="{{AppSubUrl}}/user/settings/security/sessions/revoke" method="post">
-						{{$.CsrfTokenHtml}}
 						<input type="hidden" name="session_id" value="{{.ID}}">
 						<button class="ui red tiny button">{{ctx.Locale.Tr "settings.sessions.revoke"}}</button>
 					</form>