CSRF via delete-answer callback

The URL for deleting an answer does not protect against a cross-site forgery attack in which someone triggers an authenticated user into deleting their answer to a meeting poll.

For example, the URL for deleting an answer looks like /makemeeting/delete-answer/17

If an attacker embeds an img with the src equal to that URL and gets that person to view it, their browser will make a request to the URL and their answer will be deleted. You can read more about CSRF at http://drupalscout.com/knowledge-base/introduction-cross-site-request-fo...

You should use tokens as query parameters to the callback to protect against this.

(This doesn't appear to be an issue in the 1.x branches of the module and since the 2.x release isn't stable yet this can be discussed publicly in the issue queue.)