From 145e2661d3ed963ce54076b2a8493568bd073a14 Mon Sep 17 00:00:00 2001
From: Johan Cwiklinski <johan@x-tnd.be>
Date: Sat, 15 Aug 2026 08:12:23 +0200
Subject: [PATCH] Remove CSRF tokens from forms

Rework exclusions
---
 _define.php                                    | 2 +-
 templates/default/paypal_preferences.html.twig | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/_define.php b/_define.php
index ff78b71..e4ed79d 100644
--- a/_define.php
+++ b/_define.php
@@ -27,5 +27,5 @@
 );
 
 $this->setCsrfExclusions([
-    '/paypal_(success|notify|cancelled)/',
+    '/paypal_success/',
 ]);
diff --git a/templates/default/paypal_preferences.html.twig b/templates/default/paypal_preferences.html.twig
index 4f2629e..a693ea8 100644
--- a/templates/default/paypal_preferences.html.twig
+++ b/templates/default/paypal_preferences.html.twig
@@ -74,7 +74,6 @@
                 <i class="save icon"></i> {{ _T("Save") }}
             </button>
             <input type="hidden" name="valid" value="1"/>
-            {% include "components/forms/csrf.html.twig" %}
         </div>
     </form>
 {% endblock %}